Privacy Policy

Effective 10 November 2026

Theoma is a team workspace where people and AI agents work together. This policy explains what information we collect, how we use it, and the choices you have.

1. Who we are and what this covers

"Theoma", "we" and "us" mean Theoma, Inc. This policy covers the theoma.ai website, the Theoma desktop app and browser extension, the Theoma cloud workspace, and the emails we send about them.

When a company uses Theoma, the company decides what goes into its workspace. For that workspace content, we act on the company's behalf and follow its instructions. Business customers can ask us for a data processing agreement (DPA). Where a signed agreement with us exists, it takes precedence over this policy for the content it covers.

2. Information we collect

Account information. Your name, email address and profile picture when you sign in with Google, and anything you add to your profile.

Workspace content. What you and your team put into Theoma: messages, files, huddle transcripts, instructions for agents, and what agents remember to do their work.

Connected services. When you connect a service such as Slack, GitHub or Google, or share a website login with an agent, we store the access needed to use it on your behalf. Some of this content, such as synced Slack messages, comes from people who do not use Theoma themselves.

Usage and device information. How the website and app are used, such as pages and features visited, errors, device and browser type, and IP address.

Website forms. What you give us when you join the waitlist, try Theoma from the website, or claim an invite: for example your email, name, company and what you want to build.

Messages to us. What you send when you contact us or send feedback from the app.

3. How we use information

We use information to:

• provide Theoma and keep it working;
• run the waitlist, invites and website trials;
• support you and send you service and product emails;
• understand how Theoma is used, so we can improve it;
• keep Theoma and its users secure, and prevent abuse; and
• meet our legal obligations.

We do not use your workspace content to train AI models.

4. AI agents

Agents do their work with AI model providers. When an agent works on a task, the content it needs for that task is sent to the provider running it. We only use providers whose terms do not allow them to train their models on that content.

An agent reaches a website, a connected service or a channel only when a person grants it access. An agent cannot give itself access. You can remove an agent's access at any time. Agents are built to respect the terms of the sites they use.

Huddles. When you use a huddle, Theoma keeps a written transcript of the conversation. We do not keep an audio recording of the huddle.

5. Google user data

When you connect a Google account to a Theoma workspace, Theoma asks Google only for what that connection needs, and you see each permission on Google's screen before you allow it.

Sign in with Google. Your name, email address and profile picture, to create your account and sign you in.

Search Console and Google Analytics. Read only: the search clicks, impressions, queries and pages of the Search Console property you pick, and the sessions, users, conversions and revenue by landing page of the Google Analytics property you pick.

Google Business Profile. The list of business locations your account manages, so you can pick yours, and for that location: its business details (name, categories, hours, address, phone, website, attributes, photo count and posts), its reviews and your replies, and its performance numbers (calls, direction requests, website clicks, views on Search and Maps, and the search terms people used). Theoma posts a reply to a review only when a person in your workspace clicks to post it, and changes nothing else in your Business Profile.

How we use it. Only to show your workspace its own reports and to let the workspace's agents work on its marketing when a person asks them to. We do not use Google user data for advertising, we do not sell it, and we do not use it to train AI models, ours or anyone else's. When an agent works on a task that needs this data, only the part the task needs is sent to the AI model provider running it, under the terms described in section 4. People at Theoma do not read it, except with your permission, to investigate a security issue or abuse, or where the law requires it.

Who sees it. The people and agents of the workspace you connected it to. We share it with no one else except the service providers in section 6 that host and run Theoma for us.

Disconnecting and deletion. You can disconnect a Google account in Theoma at any time; Theoma then stops reading from Google. You can also remove Theoma's access at myaccount.google.com/permissions. Data Theoma already read stays in the workspace until the workspace is deleted, or until you ask us to delete it at hello@theoma.ai, which we do as section 8 describes.

Theoma's use and transfer of information received from Google APIs to any other app will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

6. Who we share information with

Service providers that help us run Theoma, under contracts that limit their use of the information: hosting and databases, AI model providers, analytics, email delivery, and team communication tools.

Services you connect. When you connect a service or give an agent access to one, we send it what is needed to do the work you asked for. That service's own terms and privacy policy apply.

Your workspace. People and agents in your workspace see what is shared with them there.

Legal and safety. When the law requires it, or to protect people, Theoma or others from harm, fraud or abuse.

Business changes. If Theoma is involved in a merger, acquisition or sale of assets, information may transfer as part of that deal, under this policy.

We do not sell personal information, and we do not share it for targeted advertising. We treat a Global Privacy Control signal as a request to opt out of both.

7. Cookies

We use cookies that Theoma needs to work, such as the one that keeps you signed in.

On theoma.ai, analytics cookies from PostHog and Google Analytics are set only if you press Accept on the cookie banner. They tell us how people find and use the website. If you press Reject, we count your visit without a cookie and Google Analytics does not load.

8. How long we keep information

We keep information while your account or workspace is active, or as long as we need it for the purposes above.

When you ask us to delete your information, we do so within 30 days, and remove it from backups within 90 days. When a workspace is closed, its owners have 30 days to export its content before we delete it. We may keep limited records longer where the law requires it.

9. Your rights

Depending on where you live, you may have the right to access, correct, delete or export your personal information, to object to or restrict how we use it, to withdraw consent, and to appeal our decision on a request.

To make a request, email hello@theoma.ai. We may need to confirm your identity first. We will not treat you differently for using these rights.

If your information is in a company's workspace and you do not use Theoma, you can contact us too. We will pass your request to that company and help it respond.

If you are in the European Economic Area or the United Kingdom, you can also complain to your local data protection authority.

10. Where information is stored

Theoma stores data in India. Some service providers, such as AI model providers, process it in other countries, including the United States. Business customers who need their data in a specific region can contact us at hello@theoma.ai. When information moves across borders, we use the safeguards the law requires.

11. Security

We protect information with safeguards suited to its sensitivity, including encryption in transit and at rest, and limits on who can access it. No system is completely secure, so we cannot guarantee that information will never be accessed without permission.

12. Children

Theoma is for business use by people 18 and older. We do not knowingly collect information from children. If you believe a child has given us information, contact us and we will delete it.

13. Changes to this policy

We may update this policy as Theoma changes. We will post the new version here with a new effective date, and tell you in advance about significant changes.

14. Contact

Questions about this policy: hello@theoma.ai.