Privacy

The short version

• Your deals are private to your account. Nobody else sees them unless you share a read-only link.
• We don't sell your data and we don't use your files to train AI models.
• You can download or delete all your data at any time in Settings → Privacy & data.
• When a founder answers your questions, the answers go only to you.

What we store

• Account: your name, email and photo. Passwords are stored only as a secure hash. If you use Google sign-in, we get your name, email and picture from Google.
• Your criteria: the stages, sectors, regions, check size and notes you save.
• Deals and files: the files you upload and the text we read from them.
• AI results: scores, problems found, memos, suggested decisions and the AI team's work log.
• Your decisions, reasons and follow-up dates, and your Ask AI chats.
• Founder emails you send, and the answers and files founders send back.
• Basic records: how many analyses you ran, plus security logs such as account deletions and admin actions.

How AI reads your files

To analyze a deal, the text of its files is sent to AI models from Google (Gemini) and Anthropic (Claude) through Emergent's AI service. They process it and send back a result. Ask AI may also run a Google web search for public information when your question needs it.

We don't use your data to train AI models. Each AI provider's own policy covers how it handles the text sent to it. We don't hide personal details inside your files before analysis, so only upload files you're allowed to share.

Outside checks use public information only

The Investigator looks at the company's public website, domain records, SSL certificate, public GitHub and web search results. It doesn't log in anywhere and doesn't scrape LinkedIn or private sites.

Who can see what

• Share links show a read-only memo, score, file conflicts and outside checks. They never show your files, notes or decision. New links expire after 30 days unless you choose 7 days or never, and you can turn a link off at any time.
• Founder emails sent "from Thesys" go through Brevo, our email service. Brevo receives the founder's email address and name, your questions, and your name and email (so the founder can reply to you). If you choose "Open in my email", the email is sent from your own email app instead.
• If paid plans are turned on, payments are handled by Stripe. We never see or store card numbers.
• The app runs on Emergent's cloud, and files are kept in secure cloud storage.
• We never sell data or share it for advertising.

For founders

If an investor sends you questions through Thesys, your answers and files go only to that investor and become part of their record of your company. They can't be seen by other Thesys users. To have them removed, ask the investor, or email us at admin@thesys.app.

How long we keep data

We keep your data while your account exists. When you delete your account, your data is removed from our database straight away and your files can no longer be opened by anyone. Deleting a deal or a file works the same way. We keep a short security record that the account was deleted (the email and the time). If you had a paid plan, Stripe keeps its own payment records as the law requires.

UAE data protection law

We aim to follow the UAE Personal Data Protection Law (Federal Decree-Law No. 45 of 2021). We process personal data only to run Thesys for you, on the basis of your consent and our agreement with you, and we collect only what the service needs.

Thesys runs on cloud servers that may be outside the UAE, and the AI providers named above may process file text outside the UAE. You can ask to see, correct, download or delete your data at any time. Most of this you can do yourself in Settings → Privacy & data, or email admin@thesys.app and we'll reply within 30 days.

How we protect it

• All traffic uses HTTPS.
• Sign-in locks for 15 minutes after 5 wrong passwords, and changing your password signs out every other device.
• Passwords are hashed with bcrypt. Sign-in uses a secure, HTTP-only cookie.
• Every request is checked against your account, so one user can never open another user's deals.
• Share links and founder links use long random codes that can't be guessed.
• Admin actions are logged.

Cookies and analytics

We use one sign-in cookie. Your light or dark theme choice is saved in your browser. Our hosting platform (Emergent) collects basic, anonymous page analytics so we can see how the app is used. There are no advertising trackers.

Your choices

• Download a copy of your data, including deals, memos, decisions, chats and the AI team's work log: Settings → Privacy & data.
• Delete your account and all your data from the same place. It can't be undone.
• Turn off any share link from the deal's Share button.
• Questions or requests: admin@thesys.app.

Age

Thesys is meant for investors aged 18 or over.

Changes

If we change how we handle data, we'll update this page and the date at the top.