Theanna
Get early access
Legal

Privacy Policy

Updated: September 2026

I. INTRODUCTION

At Theanna, Inc., doing business as Theanna (“us”, “we”, “our” or the “Company”) we value your privacy and the importance of safeguarding your data. This Privacy Policy (the “Policy”) describes our privacy practices for the activities set out below. As per your rights, we inform you how we collect, store, access, and otherwise process information relating to individuals. In this Policy, personal data (“Personal Data”) refers to any information that on its own, or in combination with other available information, can identify an individual.

We are committed to protecting your privacy and complying with applicable privacy and data protection laws based on where we operate and where our users are located. These may include, depending on your location and our processing activities, laws such as the GDPR (EEA/UK), PIPEDA and applicable provincial laws (Canada), Quebec Law 25, the CCPA/CPRA (California), and other U.S. state privacy laws, LGPD (Brazil), and POPIA (South Africa).

Not all laws listed above apply to all users or all processing activities. Where required, we provide notices, choices, and rights consistent with applicable law.

1.1 Scope

This policy applies to the Company’s platform, websites, domains, applications, services, and products (collectively, the “Sites”). By visiting the Sites, you are consenting to the information collection, use, and sharing practices described in this Policy, as modified from time to time by us. If, for any reason, you do not agree with the content of this Policy, you should discontinue using the Sites and services immediately.

To access certain features of the Sites, you acknowledge that you may be required to register an account by providing certain additional Personal Data. We provide a notice at or before the point of collection when required by applicable law, including when you create an account, connect integrations, or enable specific features.

This Policy does not apply to third-party applications, websites, products, services or platforms (collectively, the “Third Party Services”) that may be accessed through links that we may provide to you, or integrated into our services. These sites are owned and operated independently from us, and they have their own separate privacy and data collection practices. Any Personal Data that you provide to these websites will be governed by the third-party’s own privacy policy. We cannot accept liability for the actions or policies of these independent sites, and we are not responsible for the content or privacy practices of such sites. Furthermore, this Policy does not address the data management practices or information usage policies of other sites to which the Site may link or integrate with, as it relates to those third-party site’s compliance with federal laws and regulations.

1.2 Processing Activities

This Policy applies when you interact with us by doing any of the following:

  • Make use of our application and services as an authorized user
  • Visit any of our websites that link to this Privacy Statement
  • Participate in our online community forums, post or share user-generated content, or engage with AI-driven features
  • Receive any communication from us including newsletters, emails, calls, or texts / SMS

1.3 Enterprise Customers and Business-to-Business Licensing

If you access the Services as an employee, contractor, or other authorized user of a company or other organization that has entered into a Master Services Agreement with us for its own instance of the Services (an “Enterprise Customer,” as defined in our Terms of Service), the Enterprise Customer is typically the business or controller responsible for its own privacy notices to you, and we act as a service provider or processor on the Enterprise Customer’s behalf with respect to the Personal Data of the Enterprise Customer’s authorized users, under a separate data processing agreement between us and the Enterprise Customer. In that case, your Enterprise Customer’s own policies and instructions may also govern how your Personal Data is used, and you should direct privacy questions relating to your organization’s use of the Services to your organization in the first instance, as well as to us using the information in the “Contact Us” section below. Enterprise Customer administrators may have visibility into certain of your account activity and business information through administrative or cohort-reporting dashboards, including engagement and milestone-progress data, financial and KPI data (such as revenue, MRR, and customer counts) pulled from Connectors you have enabled, and integration adoption. This visibility reflects information you have chosen to share.

II. PERSONAL DATA WE COLLECT

As the Company, Sites, and any services offered are not intended to be used by anyone under eighteen years old, we do not knowingly collect any personal information about children.

2.1 What Personal Data We Collect

We may collect the following categories of Personal Data, depending on your interactions with us (e.g., creating an account, making a purchase, participating in the community, or using AI-driven services). This includes:

  • Account Information such as your name, email address, and password
  • Demographic Data including age, location (city, state, country) — per user opt-in
  • Purchase and Transaction Information — per user opt-in
  • Business information such as company name, company url, and company description
  • Mobile device specific identifiers such as make and model, IMEI and phone number
  • Mobile Number and SMS Consent Data, such as the mobile number you provide, the date and time you opted in to receive text messages, the form or field through which you opted in, the categories of messages you consented to receive, and any subsequent opt-out (STOP) request
  • Activity Data such as posts, saved posts and articles, milestones tracked and achieved, startup status and traction, articles saved, comments and engagements on posts, purchase information, and business and content analysis
  • Build Mode Data, such as prompts, instructions, specifications, code or low-code configurations, build logs, error logs, and outputs generated while you use Build Mode
  • Integration Data, such as files or content you choose to access via integrations (e.g., Google Drive documents you select), and metadata related to integrations (e.g., connected account identifiers, permissions granted, and audit logs of integration actions)
  • Financial and KPI Data, such as subscription metrics, revenue metrics, active paying customer counts, and related performance indicators pulled from integrations (e.g., Stripe)
  • Workspace Data, such as organization/workspace names, roles, permissions, fundraising status, cofounder count, employee count, and collaboration activity — per user opt-in only
  • Plan and Credit Usage Data, such as your subscription tier, and consumption by feature
  • Community participation data, including forum posts, comments, milestones, business updates, and interactions with AI-powered tools and/or recommendations
  • Feedback, such as customer support or product reviews
  • Product information, such as serial number, product registration, licensing information
  • User Generated Content, such as posts, comments, audio, or documents

Sensitive Data Disclaimer: We do not intentionally collect “Sensitive Personal Data” (e.g., health, biometric, racial/ethnic origin, political opinions, religious beliefs, sexual orientation). If you choose to share such data in our community or services, you explicitly consent to its processing as described in this Policy. If you do not want us to process such data, please do not submit it.

2.2 How We Collect Your Personal Data

We collect Personal Data from the following sources:

2.2.A From You. You may give us your Account Information, Payment Information, Financial Information, Demographic Data, Purchase Information, Content, Feedback, Product Information, by filling in forms, using our products or services, entering information online or by corresponding with us by post, phone, email or otherwise. This includes Personal Data you provide, for example, when you:

  • Create an account or purchase products/services on our website
  • Use our products or services
  • Create content through our products or services
  • Express interest in our products or services
  • Downloading software and/or our mobile application
  • Subscribe to our newsletter or other email communications
  • Complete a voluntary market research survey
  • Contact us with an inquiry or to report a problem (by phone, email, social media, or messaging service)
  • Log in to our website via social media accounts

2.2.B Automated technologies or interactions: As you interact with our website, we may automatically collect the following types of data (all as described above): Device Data about your equipment, Usage Data about your browsing actions and patterns, data about incomplete transactions (ex: abandoned orders). We collect this data by using cookies, server logs and other similar technologies. Please see our Cookie section (below) for further details.

2.2.C Third parties: We may receive Personal Data about you from various third parties, including:

  • Account Information and Payment Information from another individual when they purchase a gift for you on our website
  • Device and Usage Data from third parties, including analytics providers such as Google
  • Account Information and Payment Data from social media platforms when you log in to our website using such social media platforms
  • Content from communication services, including email providers and social networks, when you give us permission to access your data on such third-party services or networks
  • Account Information and Payment Data from third parties, including organizations (such as law enforcement agencies), associations and groups, who share data for the purposes of fraud prevention and detection and credit risk reduction
  • Account Information, Payment Data, and Financial Data from providers of technical, payment and delivery services

We design integrations to request only the permissions needed for the selected features and to access only the content you choose to connect or import. If you connect accounts that contain information about other individuals (customers, employees, contractors), you represent that you have the right to provide that information and authorize us to process it to provide the Services.

2.2.D Service Integrations and Connected Accounts: We use third-party service providers to host, process, and support the Services. Depending on the feature, if you choose to connect third-party services (such as but not limited to: Google Drive, Google Workspace services including Calendar, QuickBooks, Stripe, Slack, Linear, GitHub, Cloudflare, HubSpot, Carta, and DocuSign) (each, a “Connector”), we may access, process, and store information from those services as authorized by you and as necessary to provide the hosting, authentication, integration, analytics, and related features. For certain Connectors, including GitHub, Linear, and Cloudflare, we retrieve data from the connected account only after you have affirmatively enabled that Connector, and only when the data is relevant to your active session, prompt, or request, consistent with our Terms of Service. This may include repositories, tickets, configuration, logs, and related content and metadata (“Connector Data”). Where Build Mode or another agentic feature takes, or proposes to take, an action on a connected account (for example, opening a pull request, updating a ticket, or changing a configuration), we also retain a record of that action as part of your Integration Data.

You can disconnect integrations at any time, but certain data (such as logs, audit records, or KPI history) may remain stored as described in the Retention section. We do not receive your passwords for third-party services; connections typically occur via OAuth or similar authorization methods provided by the third party.

If you provide us, or our service providers, with any Personal Data relating to other individuals, you represent that you have the authority to do so and acknowledge that it will be used in accordance with this Policy. If you believe that your Personal Data has been provided to us improperly, or to otherwise exercise your rights relating to your Personal Data, please contact us by using the information set out in the “Contact us” section below.

2.3 Device and Usage Data

When you visit a Company website, we automatically collect and store information about your visit using browser cookies (files which are sent by us to your computer), or similar technology. You can instruct your browser to refuse all cookies or to indicate when a cookie is being sent. The Help Feature on most browsers will provide information on how to accept cookies, disable cookies or to notify you when receiving a new cookie. If you do not accept cookies, you may not be able to use some features of our Service; however, essential cookies are required for core functionality. We also process information when you use our services and products. This information may include:

  • Device IDs
  • Login information
  • IP Address
  • Time stamps
  • Authentication records
  • Location information
  • Individual Products you view
  • Web terms or searches that led you to the site
  • Time zone
  • Other operational data

2.4 AI-Powered Features, AI Training

Some features of the Services use artificial intelligence to generate outputs, make recommendations, or automate tasks. This may include the “Build Mode” feature, agents, and other AI-assisted features. When you use AI-powered features, we may process information you submit (e.g., prompts, instructions, files you choose to provide, integration data you authorize, and build context) and the outputs generated (e.g., suggestions, code/steps, summaries). AI processing may be performed using third-party model providers (for example, Anthropic, our primary model provider, and Google, including its Gemini models, as a fallback provider) and hosted infrastructure providers (for example, AWS). Each user (or workspace) has a logically separated database environment. We implement controls designed to prevent one user from accessing another user’s content, prompts, or data.

We configure our AI model providers to process your data only to provide the Services to us, and not to train or improve their general models. However, model providers may retain limited data for abuse monitoring and safety purposes as permitted by their terms, unless otherwise restricted.

2.5 Data Collected Engaging With Site Features

If you enable the Traction Board and connect financial integrations (such as Stripe), we may pull and process KPI metrics including (for example) monthly recurring revenue (MRR), active paying customers, realized revenue, and revenue to date / year-to-date. Scoreboards can be private, shared with specific users, or public, depending on the settings you choose. If you choose to share or publish a scoreboard, the KPI metrics or progress indicators you select will be visible to the audience you select. If you are an authorized user of an Enterprise Customer, sharing your scoreboard with your cohort or its administrators is your choice; we do not disclose your KPI metrics or milestone progress to your Enterprise Customer’s administrators beyond what your own sharing settings make visible. However, if you publish information publicly, it may be copied, cached, indexed by search engines, or otherwise retained by third parties outside our control. We do not sell your financial KPI data. We may use de-identified and aggregated KPI and usage information to operate, secure, and improve the Services, including improving recommendations, benchmarking, and product experience.

We maintain internal analytics and reporting tools that help us understand how users are using the Services (for example, build stage, feature adoption, and operational metrics). We use this information to operate, support, secure, and improve the Services.

2.6 Data We Collect From Third Parties

We may receive your Personal Data from third parties such as companies subscribing to Company services, partners and other sources. This Personal Data is not collected by us but by a third party and is subject to the relevant third party’s own separate privacy and data collection policies. We do not have any control or input on how your Personal Data is handled by third parties.

Where required by law, you have the right to review, rectify, or request deletion of this information. If you have any questions you should first contact the relevant third party for further information about your Personal Data. If that third party is unresponsive, you may contact the Data Protection Officer at Company (contact details below).

Our websites and services may contain links to other websites, applications and services maintained by third parties. The information practices of such other services, or of social media networks that host our branded social media pages, are governed by third parties’ privacy statements, which you should review to better understand those third parties’ privacy practices.

2.7 Purpose and Legal Basis for the Processing of Personal Data

We collect and use your Personal Data only where we have a lawful basis, which may include consent, contractual necessity, compliance with legal obligations, or our legitimate interests (e.g., fraud prevention, service improvement). These purposes include:

  • To deliver your product or service
  • To fulfill orders including electronic and non-electronic shipment
  • Building a safe and secure environment
  • To verify or authenticate your identity
  • Investigate and prevent security incidents such as breaches, attacks and hacks
  • Providing, developing, and improving our products and services
  • Deliver, maintain, debug and improve our products and services
  • Enable you to access Company services and set up accounts
  • Provide you with technical and customer support
  • To communicate with you about the products and services
  • Organize and deliver advertising and marketing
  • Send you newsletters and other marketing communications about current and future products, programs and services, events, competitions, surveys and promotions held by us or hosted on our behalf
  • Organize events or register attendees and schedule meetings for events
  • For research and development
  • For prospective buyers of Company as part of a transaction
  • Complying with the law, legal process, or enforceable government request

Where we process your Personal Data to provide a product or service, we do so because it is necessary to perform contractual obligations. All of the above processing is necessary in our legitimate interests to provide products and services and to maintain our relationship with you and to protect our business for example against fraud. Where consent is the lawful basis, you may withdraw it at any time. If you decline to provide necessary data under a contractual or legal requirement, we may be unable to provide certain services to you.

2.8 International Data Transfer and Storage

Where possible, we store and process data on servers within the general geographical region where you reside (note: this may not be within the country in which you reside). Your Personal Data may also be transferred to, and maintained on, servers residing outside of your state, province, country or other governmental jurisdiction where the data laws may differ from those in your jurisdiction.

We will take appropriate steps to ensure that your Personal Data is treated securely and in accordance with this Policy as well as applicable data protection law. For transfers outside the EEA, UK, or other regions with data protection requirements, we rely on Standard Contractual Clauses, adequacy decisions, or other approved safeguards. More information about these clauses can be found here.

2.9 Sharing and Disclosure

We will share your Personal Data with third parties only in the ways set out in this Policy or set out at the point when the Personal Data is collected.

If you access the Services as an authorized user of an Enterprise Customer, your Enterprise Customer’s administrators are a category of recipient of your Personal Data, limited to the account activity, engagement, milestone, and financial/KPI information you have chosen to share.

We also use Google Analytics to help us understand how our customers use the site. You can read more about how Google uses your Personal Data here. You can also opt-out of Google Analytics here.

We may also use your Personal Data to provide you with targeted marketing via advertisements or communications (such as newsletters). For more information about how targeted advertising works, you can visit the Network Advertising Initiative’s (“NAI”) educational page here. Additionally, you can opt out of some of these services by visiting the Digital Advertising Alliance’s opt-out portal here.

2.10 Legal Requirement

We may use or disclose your Personal Data if required by applicable law or in good faith belief that such disclosure is necessary in order to comply with the law or a legal obligation; in connection with a request from a public or government authority; in connection with court or tribunal proceedings; to prevent loss of life or injury; to enforce terms of use of our services; to detect, prevent, or otherwise address illegal activity, fraud, or security issues; or to protect our rights or property. Where possible and practical to do so, we will tell you in advance of such disclosure.

2.11 Service Providers and Other Third Parties

We may engage third party service providers, independent contractors, agencies, or consultants to deliver and help us improve our products and services. We may share your Personal Data with marketing agencies, database service providers, backup and disaster recovery service providers, email service providers and others but only to maintain and improve our products and services. For further information on the recipients of your Personal Data, please contact us by using the information in the “Contacting us” section below.

2.12 Email Marketing

We will only send you newsletters, promotional emails, or other marketing communications if you have provided your explicit consent to receive them (for example, by ticking a consent box at the point of collection). When you give consent, we may use your email address to send you marketing communications about our Services, events, or other offerings that we believe may be of interest to you.

You may withdraw your consent at any time by clicking the “unsubscribe” link in any marketing email, adjusting your communication preferences in your account (if applicable), or contacting us directly. Please note that even if you withdraw your consent to marketing communications, we may continue to send you necessary transactional or service-related emails.

III. COOKIES

3.1 What are Cookies?

Cookies are small text files that are placed on your device when you visit a website. Cookies allow the website to recognize your device and store information about your preferences or past actions. Cookies may contain account information such as, but not limited to: information about how you access and use our Site and your account, including device information, browser information, information about your network connection, your IP address and other information regarding your interaction with the Services, and your username and password if You opt in to the automatic login option. We use this information for site functionality, to personalize your experience, and for analytics.

3.2 Types of Cookies We Use

To give you the best experience possible, we use the following types of cookies:

  • Strictly Necessary: These cookies are required for the operation of the Services and cannot be disabled. They enable core functionality such as authentication, security, and account access.
  • Preference: These cookies allow the Services to remember choices you make (such as language or region) and provide enhanced functionality.
  • Personalization: These cookies allow us to tailor content, recommendations, and features based on your usage and preferences, including AI-driven features.
  • Analytics: These cookies help us understand how users interact with the Services (for example, pages visited, features used, and performance metrics) so we can improve functionality and user experience.
  • Marketing: These cookies may be used to deliver relevant advertising, measure campaign effectiveness, or support targeted advertising.
  • Consent and Critical Cookies: Where required by applicable law (including in the EEA, UK, Quebec, and other jurisdictions), we will not place non-essential cookies on your device unless and until you provide your explicit consent. You can manage your cookie preferences at any time through our Cookie Manager, which allows you to accept or reject cookies by category. You may also withdraw your consent at any time. If you do not consent to non-essential cookies, strictly necessary cookies will still be used to ensure core functionality of the Services.

3.2A California Privacy Rights

Under California law, certain cookies used for analytics or advertising may be considered a “sale” or “sharing” of personal information. California residents may opt out of such sale or sharing through our Cookie Manager or by enabling Global Privacy Control (GPC) signals in their browser, which we honor where required by law.

3.3 How to control your cookies, browser settings

So long as the cookie is not strictly necessary, you may opt in or out of cookie use at any time. To alter the way in which we collect information from you, visit our Cookie Manager. You may also adjust your browser settings; however, some features’ functionality will be impacted if cookies are disabled.

IV. RETENTION & DELETION

We will hold your personal information on our systems only for as long as required to provide you with the services you have requested, including for the purposes of satisfying any legal, regulatory, tax, accounting or reporting requirements.

We generally retain account data for as long as your account is active. We retain audit logs, security logs, and certain usage records for a reasonable period to maintain security, prevent fraud, and comply with legal obligations. KPI history and integration-derived metrics may be retained to provide trend reporting and historical analysis unless you request deletion where available and legally permissible.

We may retain your personal data for a longer period in the event of a complaint or if we reasonably believe there is a prospect of litigation in respect to our relationship with you. In some circumstances (1) You can ask us to delete your data: see ‘Your Rights’ below; or (2) We may anonymize your Personal Data (so that it can no longer be associated with You) for research or statistical purposes, in which case we may use this information indefinitely without further notice to you.

V. MERGER OR ACQUISITION

If we are involved in a merger, acquisition or asset sale, your personal information may be transferred. We will provide notice before your personal information is transferred and becomes subject to a different Policy. Under certain circumstances, we may be required to disclose your personal information if required to do so by law or in response to valid requests by public authorities (e.g. a court or a government agency). If the successor entity’s processing differs materially, we will provide you with notice and, where required, seek renewed consent.

VI. HOW WE KEEP YOUR DATA SAFE

We have appropriate organizational safeguards and security measures in place to protect your Personal Data from being accidentally lost, used, or accessed in an unauthorized way, altered or disclosed. However please note that while we use industry-standard measures (including encryption, access controls, monitoring, and contractual requirements for third parties such as AWS, Google, and Anthropic), no system can be guaranteed 100% secure. Security is a shared responsibility, and we encourage you to maintain the security of your devices and account information.

The communication between your browser and our website uses a secure encrypted connection wherever your Personal Data is involved.

We require any third party who is contracted to process your Personal Data on our behalf to have security measures in place to protect your data and to treat such data in accordance with the law.

In the unfortunate event of a Personal Data breach, we will notify you and any applicable regulator as required by law.

VII. CHILDREN’S PRIVACY

As the services are not intended for anyone under eighteen (18) years of age, consistent with our Terms of Service, we do not knowingly collect Personal Data from children under eighteen (18). Any information we unknowingly collect from a minor will be promptly deleted once the user’s age is made known to us.

VIII. YOUR RIGHTS FOR YOUR PERSONAL DATA

Depending on your geographical location and citizenship, your rights are subject to local data privacy regulations. These rights may include:

  • Right to Access (PIPEDA, GDPR Article 15, CCPA/CPRA, CPA, VCDPA, CTDPA, UCPA, LGPD, POPIA): If you have an account with us, you have the right to learn whether we are processing your Personal Data and to request a copy of the Personal Data we are processing about you. You can review, update, and/or correct your account information (such as your name and contact information) online by making the appropriate selections or changes. We make good faith efforts to provide you with access to your personal information and the ability to correct the information if it is inaccurate. We require users to reliably identify themselves and the information they wish to access, correct, or remove before processing these requests, and We may decline to process requests that We believe in good faith are unreasonable or unduly burdensome (such as requests that are repetitive, require disproportionate technical effort, jeopardize the privacy of others, or would be impractical to satisfy).
  • Right to Rectification (PIPEDA, GDPR Article 16, CPRA, CPA, VCDPA, CTDPA, LGPD, POPIA): You have the right to have incomplete or inaccurate Personal Data that we process about you rectified.
  • Right to be Forgotten (right to erasure) (GDPR Article 17, CCPA/CPRA, CPA, VCDPA, CTDPA, UCPA, LGPD, POPIA): You have the right to request that we delete Personal Data that we process about you, unless we need to retain such data by law, in order to comply with a legal obligation, or to establish, exercise or defend legal claims. If you wish to reactivate an account with us you may be required to re-enter your account information, re-subscribe to services, and re-enter payment information.
  • Right to Restriction of Processing (GDPR Article 18, LGPD): You have the right to restrict our processing of your Personal Data under certain circumstances. In this case, we will not process your Data for any purpose other than storing it.
  • Right to Portability (PIPEDA, GDPR Article 20, LGPD): You have the right to obtain Personal Data we hold about you, in a structured, electronic format, and to transmit such Personal Data to another data controller, where this is (a) Personal Data which you have provided to us, and (b) if we are processing that data on the basis of your consent or to perform a contract with you or the third party that subscribes to services.
  • Right to Opt Out (CPRA, CPA, VCDPA, CTDPA, UCPA): You have the right to opt out of the processing of your Personal Data for purposes of: (1) Targeted advertising; (2) The sale of Personal Data; and/or (3) Profiling in furtherance of decisions that produce legal or similarly significant effects concerning you. Under CPRA, you have the right to opt out of the sharing of your Personal Data to third parties and our use and disclosure of your Sensitive Personal Data to uses necessary to provide the products and services reasonably expected by you. We do reserve the right to contact you on matters that We believe in good faith to be urgent or of particular importance even if You opt out from other communications, but these would not include marketing communications.
  • Right to Objection (GDPR Article 21, LGPD, POPIA): Where the legal justification for our processing of your Personal Data is our legitimate interest, you have the right to object to such processing on grounds relating to your particular situation. We will abide by your request unless we have compelling legitimate grounds for processing which override your interests and rights, or if we need to continue to process the Personal Data for the establishment, exercise or defense of a legal claim.
  • Nondiscrimination and Non-retaliation (CCPA/CPRA, CPA, VCDPA, CTDPA, UCPA): You have the right not to be denied service or have an altered experience for exercising your rights.
  • Automated Decision-Making (GDPR Article 22): Some features of our services may rely on AI systems to analyze your data for personalization, recommendations, or community moderation. You have the right to request human review of decisions that significantly affect you.
  • File an Appeal (CPA, VCDPA, CTDPA): You may appeal our response to your request. If unresolved, you may contact the attorney general in your state (see links below). If you are based in Colorado, please visit this website to file a complaint. If you are based in Virginia, please visit this website to file a complaint. If you are based in Connecticut, please visit this website to file a complaint.
  • File a Complaint (GDPR Article 77, LGPD, POPIA): You have the right to bring a claim before their competent data protection authority. If you are based in the EEA, please visit this website for a list of local data protection authorities.

8.1 Withdrawing Consent

If you have consented to our processing of your Personal Data, you have the right to withdraw your consent at any time, free of charge, such as where you wish to opt out from marketing messages that you receive from us. If you wish to withdraw your consent, please contact us using the information found at the bottom of this page.

8.2 How to Exercise Your Rights

You can make a request to exercise any of these rights in relation to your Personal Data by sending the request to our privacy team by using the form below.

For your own privacy and security, at our discretion, we may require you to prove your identity before providing the requested information.

IX. FAIR INFORMATION PRACTICES

To be compliant with the Fair Information Practices we will take the following responsive action, should a data breach occur: We will notify the users via in-site notification within seven (7) business days. Where required by law (such as under GDPR or CPRA), we will notify affected individuals and regulators without undue delay, which may be sooner than seven (7) days.

We also agree to the Individual Redress Principle which requires that individuals have the right to legally pursue enforceable rights against data collectors and processors who fail to adhere to the law. This principle requires not only that individuals have enforceable rights against data users, but also that individuals have recourse to courts or government agencies to investigate and/or prosecute non-compliance by data processors.

X. CAN SPAM ACT

We comply with CAN-SPAM Act, which sets rules for commercial email, establishes requirements for commercial messages, gives recipients the right to have emails stopped from being sent to them, and spells out tough penalties for violations.

We collect your email address in order to:

  • Send information, respond to inquiries, and/or other requests or questions
  • Process orders and to send information and updates pertaining to orders
  • Send you additional information related to your product and/or service
  • Market to our mailing list or continue to send emails to our clients after the original transaction has occurred

To be in accordance with CANSPAM, we agree to the following:

  • Not use false or misleading subjects or email addresses
  • Identify the message as an advertisement in some reasonable way
  • Include the physical address of our business or site headquarters
  • Monitor third-party email marketing services for compliance, if one is used
  • Honor opt-out/unsubscribe requests quickly
  • Allow users to unsubscribe by using the link at the bottom of each email

In addition to emails, you may also receive in-app or community notifications. You can manage these preferences in your account settings.

Unsubscribe

If at any time you would like to unsubscribe from receiving future emails, you can email us support@theanna.io or follow the unsubscribe instructions at the bottom of an email from us.

XI. SMS / TEXT MESSAGING

This section describes how we collect, use, and protect mobile numbers in connection with text messages (SMS and MMS) sent by Theanna. We send text messages through Twilio, our messaging service provider.

11.1 How You Opt In

We only send text messages to mobile numbers that have been provided to us directly by the person who uses that number. When you enter a mobile number in the account settings or verification field, the form displays a notice directly above the submit button explaining what you are agreeing to receive. You must actively enter your number and submit the form to opt in. Your consent is captured and timestamped in our user records, together with the wording of the notice you were shown.

We never purchase, rent, import, or otherwise obtain mobile numbers from third-party lists, data brokers, or affiliates. Consent to receive text messages is not a condition of purchasing any product or service from us.

11.2 Categories of Messages

We send text messages in the following categories, each of which requires its own opt-in:

  • Verification codes: one-time passcodes used to verify your identity, confirm your mobile number, or complete a login. These are sent only in response to an action you take.
  • Account and service messages: security alerts, account and billing notices, and reminders or updates about programs, cohorts, or events you have registered for.
  • Marketing messages: news, offers, program launches, and community updates. You will receive these only if you separately and affirmatively opt in through a dedicated checkbox at the point of collection. This consent is never bundled with any other consent, and declining it does not affect your access to the Services.

11.3 Message Frequency

Message frequency varies. Verification codes are sent only when you request one. Account and service messages are sent based on your activity and typically number no more than ten (10) messages per month. If you opt in to marketing messages, you will receive no more than eight (8) marketing messages per month.

11.4 Message and Data Rates

Message and data rates may apply. Any charges for text messages you send or receive are billed by, and payable to, your mobile service provider. Theanna is not responsible for these charges. Carriers are not liable for delayed or undelivered messages, and message delivery is subject to the effective transmission of your mobile carrier.

11.5 We Do Not Share Mobile Numbers

We do not sell, rent, lease, or trade mobile numbers. No mobile information will be shared with third parties or affiliates for marketing or promotional purposes. Text messaging originator opt-in data and consent are not shared with any third party for any purpose. All other categories of data sharing described in this Policy exclude text messaging originator opt-in data and consent.

We share your mobile number only with our messaging service provider (Twilio), acting on our behalf and solely to deliver the messages you have consented to receive, and where disclosure is required by law or legal process.

11.6 How to Opt Out

You may opt out at any time by replying STOP to any text message from us. You will receive a single confirmation message, after which we will send no further text messages to that number. You may also opt out by removing your mobile number in your account settings or by emailing us at support@theanna.io.

Replying STOP stops all text messages to that number, including verification codes, which may prevent you from using text-based verification to access your account. To opt back in, reply START or re-enter your number in your account settings. Opting out of text messages does not opt you out of email; email preferences are managed separately as described above.

11.7 Help

For help, reply HELP to any message from us or email support@theanna.io.

11.8 Retention

We retain your mobile number for as long as your account is active or as needed to send the messages you have consented to receive. We retain records of your opt-in and any opt-out request for as long as required to demonstrate compliance with applicable law, including the Telephone Consumer Protection Act, even after you opt out or close your account.

XII. CHANGES

We may modify this Policy at any time. If we make changes to this Policy then we will post an updated version on this website and update the “last modified” date. Where required by law or where changes are material, we will notify you directly and/or request renewed consent.

XIII. CONTACT US

To request a copy for your information, unsubscribe from our email list, request for your data to be deleted, or ask a question about your data privacy, we’ve made the process simple:

To contact us, please email support@theanna.io.

Write to us at:
Data Privacy Officer of Theanna
2606 Hilliard Rome Rd Unit #V251, Hilliard, Ohio, 43026