1. Controller
Themys is operated by its founder as a natural person, who is the controller of the personal data described here and can be reached at hello@themysapp.com. The controller's full legal name and address will be published on this page before Themys charges for the service.
For the personal data you put into Themys about your own clients, you are the controller and we act as your processor, on your instructions, under these terms.
2. What we hold
- Account data — name, email address, password hash, authentication factors, profile details, timezone and working hours, subscription and membership status.
- Business data — your company and billing profiles, tax identifiers and bank details, your clients and their contact details, projects, tasks, time entries, costs and rates.
- Documents — contracts, invoices, their contents and the snapshots taken when an invoice locks, along with templates you create or upload.
- Signature records — for contracts sent for signature: the frozen copy of the document and its fingerprint, the signature image (typed, drawn or uploaded), the signer's name and email address, and an audit trail recording when the contract was sent, delivered, opened, viewed, signed or declined, each entry with the IP address and browser it came from. Your own saved signature is kept until you replace or delete it.
- Files — anything you upload: project files, client files, chat attachments, avatars.
- Messages — in-app conversations, client portal messages, and emails sent or received through the product.
- Records of consent and review — which version of these documents you accepted, when, from which IP address and user agent; your cookie and marketing choices and when you made them; and your confirmations that you reviewed a document before sending it.
- Technical and usage data — IP address, device and browser information, pages viewed and actions taken in the product.
3. Why, and on what legal basis
- To provide the service you signed up for, including creating, storing and delivering your documents — performance of a contract.
- To keep records of your acceptance of these documents and of your document reviews — legitimate interest in being able to establish what was agreed and what was confirmed, and legal obligation where applicable.
- To record who signed a contract, when, and what exactly they signed — performance of a contract with you, and legitimate interest in the signature being provable afterwards. A signature record that could be altered would be worthless, so these entries are never edited or deleted individually.
- To secure the service, prevent abuse and debug faults — legitimate interest.
- To bill you and meet our own accounting and tax obligations — legal obligation.
- To send product and service emails — performance of a contract; for anything promotional, consent, withdrawable at any time.
- To analyse how the product is used so we can improve it — legitimate interest.
4. Who we share it with
We do not sell your data. We use these providers, and data reaches them only so the product can work:
- Supabase — database, authentication, file storage and server functions (hosting infrastructure).
- Anthropic (Claude API) — writing, checking and translating contracts, and turning the contracts and invoices you upload into templates.
- Google (Gemini API) — the other AI features, such as the assistant, the brief and suggestions.
- OpenAI — audio transcription, when you use voice dictation.
- Resend — transactional and notification email.
- Paddle — payments and subscription billing, once paid plans are available. Themys does not charge during the free beta, and no payment data reaches Paddle until you buy a plan.
- PostHog — product analytics.
- Discord — the beta community invitation, if you join it.
- Google Workspace APIs — calendar and contact synchronisation, if you connect those integrations.
Content you send to an AI provider is processed to produce the response. Do not paste anything into AI features that you are not willing to have processed by a third-party provider.
We may also disclose data where we are legally required to, or to establish or defend a legal claim.
5. Cookies
Necessary cookies keep you signed in, keep your session secure and remember your settings. They cannot be switched off, because the product does not work without them.
Everything else only runs if you agree first, and you are asked before anything non-essential is set:
- Analytics — how the product is used, so we can see what works and what does not. Currently PostHog.
- Marketing — showing relevant advertising and measuring whether it worked. We do not use these yet. The option exists so that if we start, it starts with your permission rather than without it.
You can accept, reject or choose which categories you allow, and change your mind at any time from Privacy settings. Rejecting is exactly as easy as accepting, and rejecting does not limit your use of Themys.
6. Marketing
We will not use your personal data to market Themys unless you have agreed to it separately. Accepting the Terms is not agreement to any of the following, and refusing any of them costs you nothing.
- Product emails. Emails we must send you to run the service — security alerts, billing, changes to these documents, things you asked for — are part of the service and are not marketing. Anything promotional is sent only with your consent, and every such email has an unsubscribe link that works immediately.
- Testimonials and case studies. We will not name you, your company, or quote you publicly without asking you first and getting your agreement for that specific use. You can withdraw it later, and we will stop using it going forward.
- Advertising and audience targeting. If we start using your data to target advertising, it happens only under the marketing cookie category described above, only after you opt in, and this policy will say exactly what is involved before it begins.
- Launch list. If you leave your email on themysapp.com to hear when Themys opens to everyone, we keep that address, your language, the page you signed up on, any invite code or campaign tag in the link that brought you, and the exact wording you agreed to, with the date. You first get one email asking you to confirm, and nothing else until you do. After that we write to you about the launch only. Every email has an unsubscribe link that works with one click.
Each of these permissions is recorded separately with the date it was given, and each can be withdrawn at any time in Privacy settings or by writing to hello@themysapp.com. Withdrawing does not undo what was already done, but it stops it going forward.
7. International transfers
Some providers process data outside the European Economic Area. Where they do, transfers rely on the European Commission's standard contractual clauses or an adequacy decision.
8. How long we keep it
While your account exists, we keep your data indefinitely. We do not automatically delete old projects, invoices or files.
Some records are kept deliberately even when the underlying item changes:
- Invoice snapshots — taken when an invoice locks, so that what your client received can still be established later.
- Signature records — the frozen document, signature images and audit trail for every signed contract, kept for as long as the contract exists in your account. They are deleted when you delete your account, so download signed contracts you need to keep.
- Attestations and consent records — kept for as long as they could be needed to establish what was accepted or confirmed.
- Audit logs — changes to documents and tasks, including the previous contents, are retained.
- Launch list entries — an address that is never confirmed is deleted after 30 days, and the whole list is deleted three months after the launch email goes out. If you unsubscribe before then, we keep your address and the date you unsubscribed, only so that you are not emailed again.
When you delete your account, your data and your uploaded files are deleted from our systems. This cannot be undone. Records we are legally required to keep, such as our own billing records, are retained for the statutory period.
Deleting your Themys account does not satisfy your own record-keeping obligations. Themys is not your archive of record — keep your own copies of contracts and invoices for as long as the law requires.
9. Your rights
Under the GDPR you may request access to your data, correction, deletion, restriction of processing, portability, and you may object to processing based on legitimate interest. You may withdraw consent at any time where processing is based on consent.
Most of this is available directly in the product: Settings lets you export, correct and delete your data, including full account deletion. For anything else, write to hello@themysapp.com; we respond within one month.
You also have the right to complain to a supervisory authority — in Slovakia, the Office for Personal Data Protection (Úrad na ochranu osobných údajov SR).
10. Security
Access to your data is restricted by row-level security in the database, files are stored in private buckets and served through short-lived signed links, passwords are hashed, and two-factor authentication is available in Settings.
No service is perfectly secure. If a breach affects your personal data and presents a risk to you, we will notify you and the supervisory authority as the GDPR requires.
11. Children
Themys is a business product and is not directed at anyone under 18.
12. Changes
We may update this policy. Each version carries a version date and its text is fingerprinted, so which version applied at any time can always be established. Material changes are notified in the product.