What information we collect
This website does not use tracking or advertising cookies, and there is no third-party tracking. Our hosting provider sets one strictly necessary technical cookie (named GAESA, expires after 30 days) that routes your requests to the right server. It is not used to identify you or to track your activity. If you start a call with our voice assistant, we set one more strictly necessary cookie, described in the section on the voice assistant below.
We collect four kinds of information: aggregated visit statistics from our own cookieless measurement (described below), the information you choose to send us through our contact form or by email, only if you use it, the information described in the section on our voice assistant, and information about clients who use our client portal, described in the section on the client portal.
If you switch between light and dark display mode, that choice is saved in your browser's local storage on your own device. The same applies once you have confirmed the notice shown before your first call with our voice assistant, so it does not appear every time. These entries are never sent to us and contain no personal information.
Website analytics
To understand how this website is used, we run our own privacy-friendly measurement on our own servers. No outside analytics provider is involved, and no cookies, local storage entries, or similar identifiers are placed on your device for this purpose.
When you open a page, your browser sends us the page address (including campaign tags such as utm_source, if the link you followed contained them), the address of the website that referred you, and later how long the page was visible. From the request itself we derive your country, your device type (desktop, mobile, or tablet), and the names of your browser and operating system. Of the referring website we store only its domain, not the full address.
Your IP address is used only briefly in memory: to determine your country, and to form a one-way hash together with your browser's user-agent string and a random value that changes every day. The IP address itself is never stored. The random value is kept only on our server and is deleted after its day, so the hash cannot be used to identify you or to recognize you on a later day. Your country is looked up in a database stored on our own server, so your IP address is not sent to any other service for this purpose.
We also count how many contact forms were submitted successfully, without linking that count to the content of the form. We review these statistics only in aggregated form (for example, total page views or the most visited pages), do not combine them with other data, and do not use them for advertising or to build profiles. Stored analytics records are deleted after 25 months.
Do Not Track and Global Privacy Control
If your browser sends a Do Not Track (DNT) or Global Privacy Control (GPC) signal, our measurement script sends nothing, your visit is not counted, and a contact form you submit is not included in our statistics. No third parties collect personal information about your online activities over time or across different websites through this website.
Contact form and email
When you submit our contact form, your name, email address, subject, and message are stored in our business email system, and a notification is delivered to us via Resend (a transactional email service). The same applies when you email us directly at an @thaloryn.dev address: your email, including your address and anything you include in it, is received through Resend and stored in our business email system. We use this information only to handle your inquiry and to maintain our business records. We do not use it for marketing and do not share it with third parties other than the service providers named below. We keep inquiries and related correspondence for as long as we need them to respond to you and for our business records.
Voice assistant (Thally)
Our website offers an optional AI voice assistant called Thally. A call starts only when you click Thally and confirm the notice, and your browser then asks for permission to use your microphone. Calls are limited to a few minutes.
What is processed. While a call is active, the audio from your microphone is sent from your browser directly to OpenAI, L.L.C. (USA), which processes it to understand what you say and to generate Thally's spoken replies. As part of this connection, OpenAI also receives your IP address. Our server sets up the call but does not receive your audio. We do not record or store audio. We do not use your voice to identify you, and we do not create voiceprints. Under OpenAI's API data policy, data sent through its API is not used to train its models, and OpenAI may retain it for up to 30 days to monitor for abuse.
Call transcripts. Each call is transcribed. We store a written transcript on our server: what you say, as converted to text by OpenAI's speech recognition, Thally's replies, and technical events of the call (for example, which page Thally opened and whether a message was sent). If you mention your name or contact details during the call, they are part of the transcript. We use transcripts only to check that Thally works reliably and safely and to improve it. Transcripts are deleted after 30 days. To have yours deleted sooner, contact us and tell us the date and approximate time of your call.
Messages to our team. If you ask Thally to pass a message on to us, Thally shows the details on screen (your name, email address, and message, and optionally your company and phone number) and sends them only after you confirm. They are then handled in the same way as a contact form submission, marked as a voice request. While you confirm, a temporary copy is kept on our server; it expires after 10 minutes and is then deleted.
Abuse protection. To limit misuse and costs, we set a strictly necessary cookie (named thally_device, expires after 30 days) when you start your first call. It contains a random identifier and is used only to apply daily call limits per device. For the same purpose, we keep one-way hashes of your IP address and of this identifier, together with the times and status of your calls, for up to 30 days. We do not use this information for analytics, advertising, or profiles.
Please do not share sensitive personal information during a call.
Client portal
If your company is a Thaloryn client, we may invite you to our client portal at thaloryn.dev/portal. We only create a login for business email addresses your company has given us, and only after we have confirmed them. In the portal we process your business email address, the company you belong to, and the invoices, credit notes and activity reports we have issued to your company. Sign-in is provided by Clerk, which processes your email address and sets cookies that are necessary to keep you signed in. We keep this information for as long as your company is our client and as required for our business and tax records. Payment pages for individual invoices can be opened without signing in through the link on the invoice; they set no cookies.
Third-party services
The third-party services involved in operating this website are: our hosting provider, which runs our servers and database and may log IP addresses and basic request information for standard infrastructure security and operational purposes; Resend, an email service used to receive email sent to our @thaloryn.dev addresses and to deliver contact-form notifications (including messages passed on by our voice assistant) and our email replies; the email provider where we receive these notifications and messages; Clerk, which provides sign-in to our client portal; and OpenAI, which processes your voice during a call with our voice assistant, as described above. None of them receives marketing data from us. We do not sell or share personal information and do not use it for targeted advertising.
Your choices and requests
You can ask us what personal information we hold about you and ask us to correct or delete it, using our contact form or by email to hello@thaloryn.dev. For a call with our voice assistant, please tell us its date and approximate time. We may need to confirm that a request comes from you, and we may keep information where the law requires it.
Children
This website is intended for businesses and is not directed to children under 13. We do not knowingly collect personal information from children under 13. If we learn that we have, we delete it.
Changes to this policy
We may update this Privacy Policy from time to time. The updated version will be indicated by an updated "Effective date" and the updated version will be effective as soon as it is accessible.
Contact for privacy questions
If you have questions or comments about this policy, you may use our contact form or email us at hello@thaloryn.dev.