Privacy policy

This Privacy Policy explains how Fairspleet LLC ("Fairspleet," "we," "us," or "our"), the Dubai-registered company that owns and operates Thally, collects, uses, shares, and protects personal data when you visit thally.io, use Thally Cloud or the Thally plugin in ChatGPT, contact us, or otherwise interact with services that link to this policy (collectively, the "Services").

Scope

This policy applies to the Thally Services operated by Fairspleet. It does not apply to a self-hosted Thally deployment that a customer or community member operates on infrastructure they control. The operator of a self-hosted deployment is responsible for its own privacy practices.

When an organization uses Thally Cloud to publish documentation or connect a repository, we may process personal data on that organization's behalf. In that context, the organization controls the data and your privacy request should normally be directed to it. This policy covers the information Fairspleet controls for account administration, billing, product operation, security, and our own business purposes.

Personal data we collect

Information you provide

Account and workspace information: your name, email address, organization, workspace membership, role, and account preferences.
Billing information: billing contact details, plan, subscription status, transaction records, and tax information. Payment card details are collected and processed by our payment provider; Fairspleet does not store complete card numbers.
Customer content: documentation, configuration, files, prompts, instructions, feedback, and other content you submit to the Services.
Repository and integration information: repository names, organization names, installation identifiers, pull request and issue metadata, commit information, and credentials or tokens needed to operate integrations you enable.
Communications: messages you send to support, sales, or legal; survey responses; and other correspondence.

Information collected automatically

When you use the Services, we may collect:

IP address, browser and device type, operating system, language, referring page, and approximate location derived from IP address;
pages and features viewed, dates and times of access, session activity, error reports, and security logs;
documentation analytics such as page views, human or agent traffic classification, search terms, search result interactions, API or discovery requests, page feedback, and chat activity; and
cookie and similar-technology data described in the Cookies section below.

Information from third parties

We may receive information from:

Identity providers when you sign in, such as your verified email address and basic profile information;
GitHub and other integrations that you authorize, including account, organization, repository, issue, pull request, and installation information;
payment providers regarding subscription and payment status; and
workspace administrators or teammates who invite you to or manage a workspace.

How we use personal data

We use personal data to:

provide, maintain, secure, and troubleshoot the Services;
create and administer accounts, workspaces, roles, subscriptions, and integrations;
host and deliver documentation and process customer instructions;
provide search, documentation analytics, AI answers, and documentation-drafting features;
generate pull requests and other actions you request through connected repositories;
process payments, prevent fraud, and maintain financial records;
communicate about the Services, including transactional, security, support, and product messages;
understand product usage and improve performance, reliability, and usability;
enforce our Terms of Service and protect the rights, safety, and integrity of Fairspleet, Thally users, and others; and
comply with law and respond to valid legal requests.

Where applicable law requires a legal basis, we process personal data as necessary to perform our contract with you, comply with legal obligations, protect our legitimate interests or those of others, and, where required, with your consent. Our legitimate interests include operating and improving the Services, securing our systems, preventing abuse, and communicating with customers. You may withdraw consent at any time where processing is based on consent.

You can opt out of marketing emails by using the unsubscribe link in the message or contacting us. You may still receive transactional, billing, security, and other service-related messages.

AI features

If you use an AI feature, we process the prompts, instructions, relevant documentation or repository context, retrieved passages, and generated output needed to provide that feature. We use models provided by Anthropic and OpenAI to process this information on our behalf.

Fairspleet does not use customer content, prompts, repository content, documentation, or AI output to train AI models. We use provider services and settings under which content submitted through Thally is not used to train Anthropic's or OpenAI's general-purpose models.

AI output can be inaccurate and should be reviewed before you rely on, publish, or merge it. Thally's documentation agent is designed to create reviewable changes and does not merge changes on its own.

Do not submit sensitive personal data, regulated data, or confidential information to an AI feature unless you are authorized to do so and the feature is appropriate for that data.

Thally in ChatGPT

Connecting the Thally plugin in ChatGPT is optional. You sign in to Thally, select a workspace, and approve the permissions shown on the consent screen. Read access and permission to create sites are separate. The connection remains subject to your current workspace role and the permissions you approved.

Information the connection uses

We receive the structured tool requests ChatGPT sends to Thally, such as a site identifier, an analytics date range, or the site name and repository settings needed to create a documentation site. The connection does not automatically give Thally your entire ChatGPT conversation history.

We store a connection record that includes your Thally user and workspace identifiers, the authorized client and permissions, creation and last-use times, request-budget counters, and revocation status. OAuth credentials are stored as hashes rather than readable token values. Sign-in and GitHub authorization happen through their secure connection flows; you do not need to paste passwords, payment card details, or GitHub tokens into chat.

Information returned to ChatGPT

Depending on your request and permissions, Thally returns information from the connected workspace to ChatGPT. This can include site names and URLs, authorized GitHub account and repository options, deployment status, AI readiness scores and check results, aggregate documentation analytics, potentially stale page paths and source-change evidence, and product-update work with associated pull request links and status. These results can reveal information about private sites and repositories, so connect only a workspace whose information you are authorized to share with ChatGPT.

The plugin's tool responses do not include integration credentials, raw visitor conversations or search text, full repository contents, build logs, or protected agent artifacts. Creating a site can create a repository through your authorized GitHub account and start Thally's managed deployment process.

OpenAI receives the information returned to ChatGPT and processes it under the terms, privacy policy, and data controls applicable to your ChatGPT account. Review OpenAI's Privacy Policy and your ChatGPT data controls. The commitments above about Thally's AI model providers do not determine how ChatGPT handles your conversations or plugin results.

Disconnecting and deleting data

You can revoke a connection in your Thally workspace under Settings, Integrations, ChatGPT. Revocation prevents further requests using that connection. To restore access, you must connect and approve permissions again.

Disconnecting does not delete your Thally sites, GitHub repositories, the connection record, or information already returned to ChatGPT. To request deletion of data held by Thally, contact legal@thally.io. For information held in ChatGPT or GitHub, use that service's deletion controls or privacy request process.

We may share personal data with:

service providers that help us with hosting, storage, authentication, payments, email, customer support, security, analytics, and AI processing, including PostHog for privacy-minimized product analytics and Anthropic and OpenAI for AI features;
integrations you direct us to use, such as GitHub or your identity provider;
workspace owners, administrators, and members according to workspace roles and settings;
the public, when you or your organization publish documentation or otherwise choose to make content public;
professional advisers and authorities when reasonably necessary to comply with law, protect rights or safety, or establish, exercise, or defend legal claims; and
a successor or transaction participant in connection with a merger, financing, acquisition, reorganization, bankruptcy, or sale of assets, subject to appropriate safeguards.

We do not sell personal data. We do not share personal data for cross-context behavioral advertising or use it to serve third-party targeted advertisements.

Customer-controlled and public content

Workspace customers decide what documentation and repository content to submit, connect, and publish. Public documentation and public repository content may be indexed, copied, or used by other people and services, including search engines and AI agents. Fairspleet cannot control how third parties use information after it has been made public.

If an organization has provided your personal data to Fairspleet through a Thally workspace, repository, or documentation, contact that organization first to exercise your rights. We will assist the organization as required by applicable law and our agreement with it.

Cookies and similar technologies

We use cookies and similar technologies that are necessary to:

keep you signed in and maintain secure sessions;
complete authentication and prevent fraud;
remember preferences such as theme or interface settings; and
operate and understand use of the Services.

You can control cookies through your browser settings. Blocking essential cookies may prevent account sign-in or other parts of the Services from working.

Some browsers offer "Do Not Track" or Global Privacy Control signals. Because we do not sell personal data or share it for cross-context behavioral advertising, there is no sale or advertising-related sharing to opt out of. Where applicable law requires a different response to a browser signal, we will honor that requirement.

Data retention

We retain personal data only for as long as reasonably necessary for the purposes described in this policy, including to provide the Services, comply with legal and accounting obligations, resolve disputes, and enforce agreements.

Retention depends on the type of information and why we process it:

Account, workspace, and customer content: generally retained while the relevant account or workspace is active. Contact legal@thally.io to request deletion. Content in a customer-controlled GitHub repository must also be managed through GitHub.
ChatGPT authorization: an authorization code is valid for 5 minutes and can be exchanged once. Each access token is valid for 15 minutes. Refresh authorization expires 30 days after the initial token exchange; rotating a refresh token does not extend that deadline. Revocation can end access sooner.
ChatGPT connection records: credential expiry and revocation disable access; they do not automatically erase the connection metadata or credential hashes. Deleting the workspace record from the active database also removes its ChatGPT connection records. This does not erase copies in backups or records held by third-party services. Deletion requests remain subject to the legal and security exceptions described in Your privacy rights.
Backups, security logs, and financial or legal records: may remain after deletion from active systems where needed for recovery, security, accounting, or legal obligations. Their retention depends on the applicable system and obligation, rather than the OAuth validity periods above.
De-identified or aggregated information: may be retained where it can no longer reasonably identify you.

Deleting data from Thally does not remove information previously sent to a connected third-party service. That service's own retention and deletion practices apply.

International data transfers

Fairspleet and its service providers may process personal data in countries other than the country where you live. Those countries may have different data-protection laws. Where required, we use recognized safeguards for international transfers and take steps designed to protect personal data consistently with this policy.

Security

We use reasonable administrative, technical, and organizational safeguards designed to protect personal data. These measures include access controls, encrypted network connections, and controls appropriate to the sensitivity of the data. No method of transmission or storage is completely secure, so we cannot guarantee absolute security.

You are responsible for protecting your credentials, limiting repository and workspace access, and promptly notifying us if you believe an account or integration has been compromised.

Your privacy rights

Depending on where you live, you may have the right to:

access or obtain a copy of your personal data;
correct inaccurate personal data;
delete personal data;
restrict or object to certain processing;
receive certain data in a portable format;
withdraw consent where processing is based on consent; and
appeal or complain to a data-protection authority.

You may also have the right to know the categories of personal data we collect, the sources and purposes of collection, and the categories of recipients. We will not discriminate against you for exercising a privacy right.

To make a request, email legal@thally.io. We may need to verify your identity and authority before completing a request. An authorized agent may submit a request where permitted by law. Some information may be exempt from a request, including where retention is required by law or needed to protect security and legal rights.

Because we do not sell personal data or share it for cross-context behavioral advertising, there is no need to opt out of those activities.

Children

The Services are not directed to children under 13. You must be at least 13 years old, or the higher minimum age required in your country to use the Services. If you are below the age of legal majority where you live, your parent or legal guardian must give permission and agree to our Terms of Service on your behalf. We do not knowingly collect personal data from children under 13 or below the applicable minimum age. If you believe a child below that age has provided personal data to us, contact legal@thally.io so we can investigate and take appropriate action.

Third-party services

The Services may link to or interoperate with third-party services. Their privacy practices are governed by their own policies. Review the permissions and privacy terms of a third-party service before connecting it to Thally.

Changes to this policy

We may update this policy as the Services or applicable laws change. We will post the revised policy here and update the date above. If a change materially affects your rights, we will provide additional notice when required by law.

Contact us

For privacy requests and legal questions, email legal@thally.io.

For general, support, or account questions, email team@thally.io.

Mail: Fairspleet LLC, 348 Business Bay, Dubai, UAE.