Thayu.AI Home

Privacy Policy

Last updated 25 September 2026

Thayu.AI is a sales and marketing AI agent. It reads what a business publishes about itself, finds people and businesses who want what it sells, and helps it start conversations by WhatsApp or email. This policy explains what personal data we handle, why, and the choices you have. It applies to our website, the Thayu.AI app and the messages our customers send with it.

1. Who we are

Reliancy Kenya Limited, 7545-1000 Thika, Kenya ("Thayu.AI", "we", "us") is the controller of the personal data described in this policy, except where we process data on behalf of our customers (see section 6). You can reach our privacy team at privacy@thayu.ai.

2. What we collect

  • Account details: your name, email address, password (stored only as a salted scrypt hash), business name, website and social links, time zone and the country your sign-up came from.
  • Workspace settings: your WhatsApp number, sender name, reply-to email, business address, AI rules and quiet hours.
  • Your work in Thayu.AI: leads, lead searches, notes, drafted and sent messages, WhatsApp conversations, credit usage and plan details.
  • Payments: amount, currency, status and the provider's reference. Card details are handled by our payment providers and never reach our servers. For mobile money we keep the paying phone number to match the payment.
  • Public business information: what businesses publish about themselves on websites, Google Business profiles, public social media pages and public posts. We keep the link to every source.
  • Lead contact details: only contact details that a person or business published themselves or sent to our customer.
  • Device and usage data: IP address (used for security and rate limits and stored only as a one-way hash), browser type, pages visited and, only if you agree, analytics and advertising cookies.

We don't log in to anyone's accounts, join private groups, read private messages, or deliberately collect special category data (such as health, religion or political views). Reviewers' names are not stored.

3. How we use it, and our legal bases

  • To provide Thayu.AI (analysing your business, finding and scoring leads, writing and sending messages, billing): performance of our contract with you.
  • To analyse public business information and surface demand: our legitimate interest, and our customers', in helping businesses find customers who are publicly asking for what they sell. We limit this to information people chose to publish, keep the source of every lead, and honour objections and removal requests.
  • To keep Thayu.AI secure (fraud prevention, abuse detection, rate limits, backups): legitimate interests.
  • To keep financial records: legal obligation.
  • Analytics and advertising cookies: your consent, which you can withdraw at any time.
  • Service emails about your account, payments and important changes: performance of our contract. We send marketing emails only where the law allows, and every one has an unsubscribe link.

4. AI and automated scoring

Thayu.AI uses Claude, an AI model from Anthropic, to understand businesses, find public demand and write messages. The text needed for each task is sent to Anthropic through its commercial API. Under those terms, it is not used to train Anthropic's models. Lead scores (hot, medium, low) are calculated by our own code from the evidence we found. They are suggestions for you to review. Thayu.AI does not make decisions that have legal or similarly significant effects on anyone.

5. Who we share it with

We never sell personal data. We share it only with service providers who help us run Thayu.AI (hosting, database, AI, messaging, email delivery, payments, analytics and support), under contracts that require them to protect it. The current list is on our GDPR page. We may also disclose data when the law requires it, to protect people's rights and safety, or as part of a merger or acquisition, in which case this policy continues to apply.

6. Data we process for our customers

When a Thayu.AI customer saves leads, messages contacts or receives WhatsApp replies, that customer decides why and how the data is used, and we process it on their behalf under our Data Processing Addendum. If you received a message from a business using Thayu.AI, contact that business about your data. You can also reply STOP (or the same word in your language) on WhatsApp, or use the unsubscribe link in any email, and you won't be contacted by them through Thayu.AI again.

7. International transfers

Thayu.AI is available worldwide, and our providers may process data outside your country, including in the United States. When personal data leaves the European Economic Area, the United Kingdom or Switzerland, we rely on adequacy decisions (including the EU-US Data Privacy Framework where a provider is certified) or the European Commission's Standard Contractual Clauses and their UK and Swiss equivalents.

8. How long we keep it

  • Account and workspace data: for as long as your account is open. When you delete your account it is removed from our live database straight away.
  • Backups: overwritten on a rolling basis, within 30 days.
  • Public business profiles: refreshed when they are analysed again, and deleted when the business asks us to remove them.
  • Opt-outs and unsubscribes: kept for as long as needed to make sure the person is not contacted again.
  • Payment records: kept by our payment providers for as long as tax and accounting law requires.

9. Your rights

Depending on where you live (for example under the GDPR, the UK GDPR, or California's CCPA/CPRA), you can ask to access, correct, delete or move your data, object to or restrict how we use it, and withdraw consent at any time. We don't sell or share personal data for cross-context behavioural advertising without your consent.

You can also complain to your local data protection authority. Details are on our GDPR page.

10. Cookies and similar technologies

  • Essential: thayu_session keeps you signed in. It is strictly necessary and needs no consent.
  • Preferences: theme and lang remember light or dark mode and your language. thayu_consent (stored in your browser) remembers your cookie choice, and thayu.previewOffer carries your free preview into sign-up.
  • Analytics and advertising (only if you accept): PostHog product analytics and tags loaded through Google Tag Manager, such as Google Analytics and ad platform pixels. They stay off until you choose "Accept", using Google Consent Mode.

You can change your choice at any time with "Cookie settings" at the bottom of every page, or by clearing cookies in your browser.

11. Security

All traffic is encrypted with HTTPS. Passwords are hashed with scrypt, session tokens and IP addresses are stored only as hashes, WhatsApp access tokens and payment credentials are encrypted with AES-256-GCM, every workspace's data is kept separate, and payment webhooks are signature-checked. If a breach puts your data at risk, we will tell you and the relevant authorities without undue delay, and within 72 hours where the GDPR requires it.

12. Children

Thayu.AI is a business tool for people aged 18 and over. We don't knowingly collect data about children.

13. Changes

We'll update the date above when this policy changes, and email account holders before any material change takes effect.

14. Contact

Questions or requests: privacy@thayu.ai.