SYSGRAFT privacy & data

We are a data controller under UK GDPR and the Data Protection Act 2018.

name, email address, organisation name, and payment information when you register

API calls, invocation counts, Brain Instance activity, and audit log entries

inputs you send to Brain Instances and the artifacts produced in response

IP addresses, browser type, and access logs for security and performance monitoring

provide and operate the Services

process payments and manage your subscription

send transactional emails (account confirmation, usage alerts, billing notifications)

monitor and improve platform performance and security

comply with legal obligations

We retain account data for the duration of your subscription plus 30 days following termination.

Brain Instance memory data (institutional ring entries) is deleted 30 days after account termination.

Audit logs are retained for 7 years for compliance purposes.

Supabase (database infrastructure, EU region); Fly.io (application hosting, EU region)

We share data with: Supabase (database infrastructure, EU region); Fly.io (application hosting, EU region); Stripe (payment processing); Brevo (transactional email).

All processors are bound by data processing agreements.

To exercise any of these rights, contact privacy@thalium.io.

access your personal data

correct inaccurate data

request deletion of your data

object to or restrict processing

data portability

withdraw consent where processing is based on consent

We do not sell your data to third parties.