Theus Privacy Policy

Who We Are

Theus Incorporated operates the Theus platform and the identity service at identity.theus.ai. We are headquartered at 5001 Spring Valley Rd, Dallas, TX. You can reach us at support@theus.ai with any privacy questions or requests.

Theus is sold to commercial real estate organizations on a subscription basis. Each organization is a separate tenant on the platform. If you use Theus as an employee or authorized user of one of those organizations, that organization administers your account and provisions your access, and this policy describes how we handle your information on that organization's behalf as well as in our own operation of the Services.

Scope of This Policy

This policy covers the information practices of the Theus platform, the identity service at identity.theus.ai, and the AI agent features available through them, including the limited internal text-messaging feature described in the 'Text Messaging' section below.

This policy does not govern the independent practices of our Customer organizations or of third parties whose products or services a Customer connects to Theus. Customer organizations may maintain their own privacy policies that apply to their employees and authorized users; where there is a conflict regarding data the organization controls, the organization's own policies and instructions govern that data.

Controller and Processor Roles

Theus operates as a multi-tenant platform, and our role with respect to personal information depends on the type of data.

Customer organizations are the controllers (and, under U.S. state privacy laws, the 'businesses') of their users' personal information and of the commercial real estate business data they place in or connect to the Services. They decide what data to load, who may access it, and how their tenant-scoped agents are configured and used.

Theus acts as a processor (and 'service provider') on each Customer organization's behalf when handling that organization's user and business data. We process such data only to provide and support the Services in accordance with our agreement with the organization and its documented instructions, and not for our own independent purposes.

Theus is the controller of its own operational data, such as platform administration records, account-provisioning logs, security and audit logs, billing and account-management information, and aggregated or de-identified usage data used to operate, secure, and improve the Services.

If you are an employee or authorized user of a Customer organization and you wish to exercise privacy rights over data your organization controls, we will generally direct your request to that organization or act on its instructions, as described in 'Your Rights and Choices.'

Information We Collect

We collect information that Customer organizations and their users provide, information created through use of the Services, and a limited amount of information collected automatically. The categories below describe the information we handle.

• Account and identity information: names, work email addresses, the organization (tenant) a user belongs to, roles and permissions, and authentication credentials managed through identity.theus.ai.
• Customer business data: the commercial real estate data, documents, and records that a Customer organization connects to or stores in Theus so that its tenant-scoped agents can help its people understand and act on it. This data is controlled by the organization and may include personal information about the organization's own contacts, counterparties, or personnel.
• Agent interaction data: the prompts, instructions, queries, and conversations exchanged between a Customer's authorized users and the organization's tenant-scoped agents, along with the agents' outputs and the records of actions agents take within the platform.
• Messaging data: where the organization enables the internal text-messaging feature, the whitelisted phone numbers of the organization's employees or authorized users, the content of the conversational messages exchanged with the organization's agent, delivery and routing metadata (such as timestamps and delivery status), and consent and opt-out records (including STOP and HELP requests). This is described further in the 'Text Messaging' section.
• Usage, log, and device information: log data, IP addresses, browser or client type, session and audit events, and similar information generated automatically when the Services are used.
• Support and communications information: information you provide when you contact us for support or otherwise communicate with us, such as the contents of your messages and your contact details.
• Billing and account-management information: the contact, subscription, and administrative information associated with a Customer organization's account.

How We Use Information

We use the information we collect for the following purposes, and, where we act as a processor, only as needed to provide the Services and on the Customer organization's documented instructions:

• Provide, operate, and maintain the platform and each organization's tenant-scoped AI agents.
• Authenticate users and secure accounts through identity.theus.ai, and enforce tenant isolation, roles, and permissions.
• Enable agents to process Customer business data so they can help authorized users understand and act on it.
• Operate the internal text-messaging feature, where enabled, by routing conversational messages between an organization's agent and the organization's whitelisted users and maintaining conversation context.
• Respond to support requests and communicate with Customers and authorized users about the Services.
• Monitor, troubleshoot, and improve the reliability, safety, security, and performance of the Services, including through aggregated or de-identified analytics.
• Detect, prevent, and address fraud, abuse, security incidents, and technical issues.
• Maintain audit, security, and recordkeeping logs, and comply with legal, regulatory, and applicable carrier and messaging-program obligations.

Text Messaging

Text messaging (the "Theus Agent Messaging" program) is one optional, internal feature of the Theus platform; it is not the focus of the Services. Where a Customer organization enables it, Theus provisions phone numbers for that organization's tenant-scoped AI agents so the agents can exchange conversational, operational text messages with the organization's own people.

The feature operates on a closed-loop, organization-scoped, whitelist-only model. An organization's agent can send messages to, and receive messages from, only a whitelist of phone numbers belonging to that organization's own employees or authorized users. An agent cannot send messages to any external or non-whitelisted number. There is no external messaging, no cold outbound, and no marketing or promotional messaging of any kind. The feature is an internal business-communication tool only.

A person is added to the whitelist by their own organization as an authorized user. Messaging with the organization's agent is conversational and account- or operational-business in nature. By being added to the whitelist and engaging with the agent (for example, during onboarding or first contact), an authorized user consents to receive these conversational messages from their organization's agent. Message frequency varies and is recurring. Message and data rates may apply. Reply STOP at any time to opt out, or HELP for help.

We do not sell mobile phone numbers or opt-in consent, and we never share phone numbers or opt-in consent with third parties or affiliates for their own marketing or promotional purposes. We share messaging data only with the service providers that make message delivery work, and only to operate this feature for the organization, as described in 'How We Share Information.'

How We Share Information

We do not sell personal information, and we do not share phone numbers or text-messaging opt-in consent with third parties or affiliates for their own marketing. We share information only in the limited circumstances below.

• Service providers and subprocessors: vendors who process information on our behalf to run the Services, such as cloud hosting and database providers, AI model providers used to power agent functionality, messaging carriers and text-message delivery providers (for the internal messaging feature), security and logging providers, and customer-support and billing tools. These providers may use the information only to provide services to us and are contractually required to protect it.
• Within the Customer organization: because the Services are provided to organizations, an organization's administrators and authorized users may have access to account, usage, and agent data associated with that organization's tenant, consistent with the organization's own roles and permissions.
• Legal and safety: when required by law, regulation, subpoena, or legal process, or to protect the rights, property, or safety of Theus, our Customers, their users, or others, or to investigate and prevent fraud, abuse, or security incidents.
• Business transfers: in connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to the protections of this policy.
• With consent or direction: at the direction of the Customer organization that controls the data, or otherwise with the relevant party's consent.

Subprocessors

We engage subprocessors to help deliver the Services, including cloud infrastructure, database, AI model, messaging-delivery, security, and support providers. We require subprocessors to handle information consistently with this policy and our Customer agreements, to use it only to provide services to us, and to maintain appropriate safeguards. Customer organizations may request information about the subprocessors we use to support their tenant by contacting us at support@theus.ai.

No Sale of Personal Information

Theus does not sell personal information, and we do not 'share' it for cross-context behavioral advertising. In particular, mobile phone numbers and text-messaging opt-in consent are never sold, rented, or shared with third parties or affiliates for their own marketing or promotional purposes. We act as a service provider to our Customer organizations and process their data only to provide and support the Services.

Data Security

We use administrative, technical, and physical safeguards designed to protect information, including encryption in transit, access controls, tenant isolation between organizations, authentication managed through identity.theus.ai, and logging and monitoring. No method of transmission or storage is completely secure, so we cannot guarantee absolute security; however, we work to protect information and to respond promptly to any incident, including notifying affected Customers as required by law and our agreements.

Data Retention

We retain personal information for as long as needed to provide the Services, maintain Customer accounts and agent context, comply with our legal, regulatory, and applicable carrier-compliance obligations, resolve disputes, and enforce our agreements.

For data we process on a Customer organization's behalf, we generally retain it for the term of the organization's subscription and delete or return it after termination in accordance with our agreement with the organization, subject to limited retention required by law. Messaging opt-in and opt-out records are retained as needed to honor user preferences and demonstrate compliance. When information is no longer needed for these purposes, we delete or de-identify it.

International Data Transfers

Theus is based in the United States, and we and our service providers may process and store information in the United States and in other countries where we or they operate. Where we transfer personal information across borders, we take steps to ensure it receives an appropriate level of protection, which may include relying on recognized transfer mechanisms or contractual safeguards. By using the Services, or where a Customer organization directs us to process data, you understand that information may be processed in the United States and other jurisdictions whose data-protection laws may differ from those of your location.

Your Rights and Choices

Depending on where you live, you may have rights to access, correct, delete, port, or obtain a copy of your personal information, and to object to or restrict certain processing. We will not discriminate against you for exercising these rights.

If you are an employee or authorized user of a Customer organization, much of your information is controlled by that organization. To exercise rights over data the organization controls, please contact your organization directly; if you contact us, we will generally refer your request to the organization or act on its instructions. For information for which Theus is the controller, you may contact us directly at support@theus.ai.

For the internal text-messaging feature, you can opt out at any time by replying STOP to the organization's agent, and you can reach support by replying HELP or emailing support@theus.ai. Opting out applies to the conversational messaging feature and may limit your ability to interact with the agent over text.

Children's Privacy

The Services are business tools intended for use by commercial real estate organizations and their authorized personnel. They are not directed to children, and we do not knowingly collect personal information from anyone under 18. If you believe a minor has provided us information, contact support@theus.ai and we will take appropriate steps to delete it.

Changes to This Policy

We may update this Privacy Policy from time to time. When we make material changes, we will revise the 'Last updated' date and, where appropriate, provide additional notice to Customers. Continued use of the Services after an update takes effect means you accept the revised policy.

Contact Us

If you have questions about this Privacy Policy or how we handle information, contact us at:

Theus Incorporated, 5001 Spring Valley Rd, Dallas, TX. Email: support@theus.ai.