Legal & trust
Privacy notice
Effective 2026-10-19 · version 2.0
1. Who is responsible
Thalius AI AB (organisation number 559528-5635, VAT SE559528563501), Slipgatan 5, 117 39 Stockholm, Sweden, is the controller for the personal data described in this notice.
Privacy contact: [email protected]. We answer privacy requests within one month.
This notice covers:
- visitors to this site;
- people who register for or use the Hippocampus service, as owners or members of a workspace;
- people invited to a workspace;
- visitors of a public chat a workspace publishes;
- people who ask the Hippo Guide;
- people who join the beta notification list or send the Corporate form;
- partners in our referral programme.
It does not cover the documents customers upload or import into the Service. For those, the customer is the controller and we are its processor under the data processing agreement.
2. What we collect and why
| Who | Data | Purpose | Legal basis (GDPR Art. 6) |
|---|---|---|---|
| Every site visitor | Page, day, campaign tags (UTM source and campaign), referral link, and a salted one-way hash of the IP address | Count visits and sign-ups by page and campaign, and brake abuse, without identifying anyone | Legitimate interest |
| Site and app visitors who allow analytics or marketing | Analytics events and identifiers set by the tools in section 3; the first-touch cookie | Understand which pages and campaigns lead to sign-ups, and how the app is used | Consent |
| People who join the beta notification list | Email; name and company if the form asks; the words you agreed to and when; where you first came from (campaign tags, referral link, referrer site, entry page) | Email you when the beta opens | Consent |
| People who send the Corporate form | Work email, organisation, company size, message, where you first came from | Answer and follow up | Legitimate interest; steps before a contract |
| People who register | Email, name, the sign-in method you choose, the Terms and Privacy notice versions you accepted and when, the campaign tag of the sign-up | Create the account, prove acceptance, count sign-ups by source | Contract; legal obligation; legitimate interest |
| Account holders and members | Name, email, organisation, workspace memberships and roles, sign-in events, plan, credit usage | Provide and bill the Service, prevent abuse | Contract |
| People invited to a workspace | Email, inviting workspace, invitation status | Deliver and track the invitation | Legitimate interest of the inviter |
| Users of the Service | Questions asked and answers given, with the signed-in user attached; questions to the Hippo Guide are logged in your own workspace like any conversation | Conversation history, support, security audit | Contract; legitimate interest (security) |
| Users who connect a third-party service (for example Google Drive or Centuri, and any connector added later) | The files, folders, identifiers and metadata you choose to import, through the access you grant to that service; the connection token until you disconnect | Import into your workspace | Contract |
| Users who connect an app through the MCP server or API keys | App name and host, scope, time of grant, use | Let the app act for you; security | Contract; legitimate interest (security) |
| Users who ask through a connected AI app (for example Claude or ChatGPT) | What the app looked up for you (a search or a document it opened), when, and which app | Show you this activity under History | Contract |
| Visitors of a public chat | Question, answer, a hashed network address for rate limiting, thumbs feedback, and a push subscription if you allow notifications | Answer, prevent abuse, notify | The publishing workspace's legitimate interest; consent for push |
| Paying customers | Billing address, VAT ID and its VIES check result, invoices, payment status; card details are held by Stripe only | Billing, bookkeeping, VAT | Contract; legal obligation |
| Referral partners | Name, email, referral link, sign-ups attributed to the link, partner portal account | Run the referral programme | Contract |
Google data received through the Google Drive connector is used only to provide the import, in line with the Google API Services User Data Policy, including the Limited Use requirements.
Our staff may read questions and answers for support, abuse prevention and security; each access is logged.
We do not collect special categories of personal data on purpose, and we do not sell personal data.
Do you have to give us data? No. Without an email address we cannot create an account, add you to the beta list or answer the Corporate form. Declining cookies does not limit the site or the app.
Where data comes from. Most data comes from you. The sign-in provider you choose sends us your email and name. The campaign tag of a sign-up is passed from this site to the application, and the source of a referral comes from the link you followed.
3. Cookies and similar technologies
On this site, without your consent, no cookies are set. If Cloudflare Web Analytics is switched on, it measures page loads without cookies and without identifying you (legitimate interest). The site keeps three things in your browser's own storage: your consent choice, your light or dark theme, and where this visit came from (session storage, cleared when you close the tab).
In the app, a session cookie keeps you signed in (strictly necessary), and your browser's storage keeps your sign-in state, theme, tour progress and chat history. Without consent the app loads no analytics tool and measures nothing. With your consent, given in the app's cookie banner and changeable in Settings, the tools below run with cookies.
With your consent, given in the banner and changeable at any time from "Cookie settings", we may use the tools below. The banner appears only while at least one of them is switched on.
| Tool | Category | What it does |
|---|---|---|
th_ft first-party cookie |
Analytics or marketing | Remembers for 90 days the campaign or referral link that first brought you here, so a later sign-up can be attributed to it. It holds no name or email and is removed when you withdraw consent. |
| PostHog (EU cloud) | Analytics | Page views, events, the path from visit to sign-up, and heatmaps where enabled. On this site, before consent it runs in memory only, with no cookie; in the app it loads only after consent. |
| Google Analytics 4 | Analytics | Visit and campaign measurement with IP anonymisation and Google Consent Mode. Cookies only after consent. |
| Google Tag Manager | Analytics or marketing | Loads measurement or advertising tags only for the categories you allowed, with Google Consent Mode. |
| Google Ads conversion measurement (through Google Tag Manager) | Marketing | Records that a visit from one of our Google ads led to an account, so we can see which ads work. Sets _gcl_au and _gcl_aw only after you allow marketing. |
Google Ads. If you allow marketing, we measure whether a visit that came from one of our Google ads leads to an account, on this site and in the app. Google receives the visit, the ad click and the fact of a sign-up, never your email. Allowing marketing grants Google's ad_storage, ad_user_data and ad_personalization signals. We do not use them to build advertising audiences. For this measurement Google acts as an independent controller under the Google Ads Controller-Controller Data Protection Terms. Google is in the United States; see section 5.
4. Who receives data
- Service providers that process data for us under data processing agreements: Stripe (payments and invoices); Google (Identity Platform sign-in, and the Drive API when you connect it); the sign-in provider you choose, which is Google, Microsoft, Apple or GitHub (your identity at that provider); Google Workspace (service email from [email protected]); Cloudflare (this site and the application edge; no chat logs are stored there); Google Cloud in the EU (the Service, including conversation logs, public chat logs and push subscriptions); the browser push services of Apple, Google and Mozilla (an encrypted payload and a device token, only when you allow notifications); the analytics tools in section 3; and the providers on the sub-processors page for the Service itself.
- Authorities, when the law requires it.
- A buyer or successor, if the business is transferred, under the same protections.
Referral partners see only counts of sign-ups attributed to their link, never who signed up.
5. Transfers outside the EU/EEA
Documents and the knowledge structure of the Service are stored in the EU (Finland). Some providers, including Google, Microsoft, Apple, GitHub, Stripe, Cloudflare and the AI model providers used by default, are based in the United States. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on Standard Contractual Clauses with a transfer risk assessment. Corporate customers can choose EU-hosted or customer-hosted inference. You can ask us for a copy of the safeguards.
6. How long we keep data
| Data | Retention |
|---|---|
| Visit counts with hashed IP | 26 months |
| Analytics tool data | 26 months, or the tool's shorter setting |
th_ft cookie |
90 days in your browser |
Google Ads cookies _gcl_au, _gcl_aw |
90 days in your browser |
| Beta notification list | Until the beta opens and we have told you, or until you withdraw consent, whichever comes first |
| Corporate enquiries | 2 years from the last contact |
| Invitation records | Until accepted, or 90 days |
| Account data, acceptance records and conversation logs | While the account exists; deleted within 30 days of account deletion, and from backups within 90 days |
| A Free workspace not used for 3 months | Deleted after 30 days' notice by email |
| Connected-app grants | Until you revoke them |
| Connector tokens | Until you disconnect the service |
| Public chat logs and push subscriptions | 30 days |
| AI connector activity (what a connected AI app looked up for you) | 90 days; only you can read it, and you can delete it under History |
| Invoices, VAT records and payment records | 7 years (Swedish Bookkeeping Act) |
| Referral partner data | While the partnership lasts, plus 3 years |
After that, data is deleted or anonymised. A Corporate agreement can set other periods.
7. Security
Data is encrypted in transit and at rest. Documents in the Service are encrypted with per-document keys bound to the workspace. Access to personal data is limited to the people who need it, and security-relevant operations are logged. Details are on the security page.
If a breach is likely to put your rights at risk, we notify the Swedish Authority for Privacy Protection (IMY) within 72 hours and tell you without undue delay.
8. Your rights
You have the right to:
- access your personal data and get a copy;
- have it corrected;
- have it erased;
- restrict its processing;
- receive it in a portable format;
- object to processing based on legitimate interest, and to direct marketing at any time;
- withdraw consent at any time, without affecting processing before the withdrawal.
In the app you can delete your account, download a full export of a workspace you own, delete a workspace you own in Billing settings, and disconnect apps and connected services. If you cannot, write to [email protected]; we act within 30 days. For other requests write to [email protected]. We do not charge unless a request is manifestly unfounded or excessive. If your data sits in a customer's workspace, we forward your request to that customer.
You can also complain to the Swedish Authority for Privacy Protection (IMY), Box 8114, 104 20 Stockholm, [email protected], www.imy.se, or to the authority where you live or work.
9. Emails and notifications
We send service notifications without asking, because the Service needs them: activation and sign-in links, invitations, payment and plan notices, inactivity notices, and changes to these texts. As a customer you may also receive product news about Hippocampus; you can stop it at any time through the link in every such email or, once available, in notification settings.
10. Automated decisions
We make no decisions with legal or similarly significant effects on you based solely on automated processing. The AI features of the Service are described in the AI Act disclosure.
11. Age
The site and the Service are for people aged 18 or older.
12. Changes
When we change this notice, we update the version and effective date above. Material changes are announced on this site at least 30 days before they apply and, for account holders, by email.