Privacy Policy

PRIV-01 — Who we are and what this policy covers

This Privacy Policy explains how ThutaTech ("ThutaTech", "we", "us"), located in Japan, handles personal information when you use the ThutaTech Ecosystem: thutatech.com (marketing and documentation), Account Center (account.thutatech.com), Thuta App Builder, Thuta Studio, Thuta Flow, Thuta Agent (pre-release), and the Thuta IDE desktop application (together, the "Services").

We handle personal information in accordance with Japan's Act on the Protection of Personal Information (APPI) and other applicable laws. Product-specific details are in the Product Terms and the Subprocessors list.

Thuta IDE is a local-first desktop application: your project files, editor data, and AI keys stay on your device except for requests you direct to your own AI provider accounts. See PRIV-06 and the Thuta IDE Product Terms.

PRIV-02 — Information we collect

• Account data (Account Center, App Builder, Studio, Flow): name, email address, profile picture, and authentication identifiers, managed through our authentication provider Clerk. If you sign in with Google, we receive your name, email address, and profile picture from your Google account.
• Billing data (Account Center): plan, purchase history, subscription identifiers, and payment status. Payments are processed by PayPal; we do not receive or store full card numbers or bank details.
• Credit and usage data: credit wallets, reservations, ledger entries, and usage events used for billing accuracy.
• Content you provide ("Input"): prompts, uploaded files and media, design projects, brand kits, workflow configurations, and — if you use Thuta Studio's career features — documents such as resumes/CVs that you upload for analysis.
• Generated content ("Output"): content, designs, documents, and application source code the Services generate for you, stored so you can access your project history.
• Workflow and integration data (Thuta Flow): workflow definitions, execution logs, webhook payloads, and OAuth tokens for services you connect (for example Meta or Google accounts).
• Technical and security data: IP address, device/browser information, access timestamps, and security event logs.
• Analytics data: cookieless, aggregate web analytics (Vercel Web Analytics) on the learning site learn.thutatech.com only — page visited, referrer, country/region, device type, browser, and operating system. Your IP address is not retained and no identifier is stored on your device. No other ThutaTech domain runs analytics or marketing scripts (PostHog was removed on 2026-07-18). Per-domain details are in the Cookie & External Transmission Policy.
• Support data: messages you send us when requesting help.

PRIV-03 — Purposes of use

We use personal information to: provide, operate, and maintain the Services and your account; process subscriptions and credits and prevent billing errors; secure the Services and investigate abuse and security incidents; respond to support requests; send service notifications; improve the Services through usage analysis; and comply with legal obligations. We do not sell personal information. We do not use your Input or Output to train our own AI models.

PRIV-04 — AI processing

When you use AI features, relevant Input is sent to third-party AI model providers to generate your requested Output. Which providers each product uses, and what those providers may do with the data, is described in the AI Data Use Policy. We send only what is needed to perform the action you requested and do not expose our server-side API credentials in your browser.

PRIV-05 — Sharing and service providers

We share personal information only with service providers needed to operate the Services. The complete, product-scoped list — including authentication (Clerk), hosting (Vercel, Cloudflare), web analytics (Vercel, learning site only), databases, payments (PayPal), collaboration and job infrastructure (Liveblocks and Inngest, Studio only), error monitoring (Sentry, Studio only), email (Resend, Studio only), and AI model providers — is maintained on the Subprocessors page. We may also disclose information if required by law, to protect rights and safety, or in connection with a business transfer with notice to you.

PRIV-06 — Thuta IDE and local data

Thuta IDE stores your projects, editor indexes, and recovery data on your device. AI API keys you supply are stored in your operating system's keychain and are used to call your own AI provider accounts directly. Crash and diagnostic telemetry is recorded locally on your device only; performance and usage events are off unless you opt in, and no telemetry upload service is currently operated. Update checks contact our release server (releases.thutatech.com, hosted on Cloudflare), which receives your IP address.

Thuta IDE connects to Account Center only if you sign in (optional Managed AI mode): sign-in tokens are stored in your device keychain, the prompts of AI requests you make in Managed mode are processed through our AI gateway and the providers in the AI Data Use Policy, and we record the usage events needed for credit billing (action, credits, token counts, model). The gateway does not store your prompts or outputs. Without sign-in, no account or project data is sent to ThutaTech (see the IDE Product Terms).

PRIV-07 — International transfers

Our service providers process data on servers outside Japan, including the United States. Where APPI requires, we take measures so that such providers protect personal information to a standard consistent with APPI, including contractual safeguards, and we provide the information about the destination country's data-protection system required by APPI Article 28. Provider locations are listed on the Subprocessors page. If any AI provider located in a country without an adequacy framework is enabled for a product, the AI Data Use Policy identifies it.

PRIV-08 — Retention

Retention periods per data category are set out in the Data Retention & Deletion Policy. Where a category does not yet have a defined retention period, that policy says so explicitly instead of stating an invented period. Billing and audit records are kept as required for legal, tax, and accounting obligations even after account deletion.

PRIV-09 — Deletion and your rights

Subject to the APPI and other applicable laws, you may request disclosure, correction, deletion, or cessation of use of your personal information. You can delete your account from Account Center security settings; this automatically removes your profile, subscription, wallets, reservations, credit ledger and usage history, API tokens, OAuth connections, and Studio career-analysis records (resumes and job-matching data). Security audit logs are retained for fraud-prevention and legal purposes as described in the Data Retention Policy, and payment transaction records remain with PayPal under its own retention rules. You can export your account data from the Account Center data-export function before deleting. If you are in a jurisdiction granting additional rights (for example the EU/UK GDPR), we will honor the rights that apply to you; contact: info@thutatech.com.

PRIV-10 — Security

We protect personal information using measures described in the Security Policy, including encryption in transit, server-side storage of API credentials, role-restricted admin access, audit logging, and rate limiting. No system is perfectly secure; if a breach affecting your personal information occurs, we will notify affected users and the Personal Information Protection Commission as required by the APPI.

PRIV-11 — Cookies and external transmission

Cookies, browser storage, and information transmitted from your device to third parties are described per domain in the Cookie & External Transmission Policy.

PRIV-12 — Children

The Services are not directed to anyone under the minimum age stated in the Terms of Service (currently 18; provisional pending legal review), and we do not knowingly collect personal information from children below that age.

PRIV-13 — Changes

We may update this Policy. For material changes we will give prior notice through the Services. The version and effective date are shown at the top of this page and in the Legal & Trust Center.

PRIV-14 — Contact / business operator

Business operator (個人情報取扱事業者): ThutaTech Address: disclosed upon request during the private beta; a business address will be published before public launch Privacy contact: info@thutatech.com