Thyra
Privacy Policy
Last updated: 17 October 2026
Thyra builds AI employees (bots) for businesses. We are based in Botswana, and this policy is written first to meet the Botswana Data Protection Act, 2024 (Act No. 18 of 2024). It also explains your rights under other major data protection laws, because our clients and their customers may live anywhere.
1. Who we are
Thyra (“we”, “us”) is run by Tshiamo Raphael Mohamadi in Gaborone, Botswana. For personal data we collect about you on this website and in your account, we are the data controller. When our bots handle your customers' data for your business, you are the controller and we are your data processor (see section 11).
2. What we collect
- Account details: name, email address and password. Passwords are stored as a one-way hash, never in plain text. If you sign in with Google, we receive only your name, email address and profile picture.
- Security data: a bot check (Cloudflare Turnstile), one-time email codes or links, sign-in times, and the IP address and device details needed to keep your account safe.
- What you send us: messages by WhatsApp, email or this website, and what you share in a free AI audit.
- Client business data: if you become a client, what your bots need to work, such as prices, services, bookings, invoices and customer messages.
- Basic usage data: pages visited and errors, to keep the site working. We do not use advertising cookies or sell data to advertisers.
We do not knowingly collect sensitive personal data (such as health, religion, biometric or criminal records). Please don't send it to us or to a bot unless it is truly needed and lawful.
3. Why we use it, and our legal basis
| Purpose | Legal basis |
|---|---|
| Create your account and let you sign in securely | Performing our contract with you |
| Set up, run and improve the bots you pay for | Performing our contract with you |
| Bot checks, one-time codes and fraud prevention | Our legitimate interest in keeping Thyra and your data safe |
| Replying to your messages and audit requests | Your request, and our legitimate interest |
| Invoices and tax records | Legal obligation |
| Marketing messages (only if you agree) | Your consent, which you can withdraw at any time |
We only collect what we need for these purposes, keep it accurate, and do not use it for unrelated purposes.
4. Who we share it with
We never sell your personal data. We share it only with service providers that help us run Thyra, under contracts that require them to protect it:
- Supabase: accounts and database
- Vercel: website hosting
- Cloudflare: bot check
- Google: “Continue with Google” sign-in
- Resend: account emails and codes
- Anthropic: the AI model behind the bots
- Meta (WhatsApp) and phone providers: when a bot messages or calls on your behalf
We may also share data if the law requires it, or to protect someone's safety.
5. Sending data outside Botswana
Some of these providers store or process data outside Botswana, including in the United States, the European Union and Asia. Under Part VII of the Botswana Data Protection Act, 2024, we only transfer personal data abroad where the country gives adequate protection, or where appropriate safeguards are in place (such as contracts with data protection terms), or where another lawful ground under the Act applies. Where the Act or the Information and Data Protection Commission requires a copy of personal data to be kept in Botswana, we will do so.
6. How long we keep it
- Account data: while your account is open. After you close it, we delete it within 30 days.
- Client business data: for as long as you are a client, then returned or deleted within 30 days, as you choose.
- Invoices and tax records: as long as Botswana law requires.
- Security logs: up to 12 months.
7. How we protect it
We use encrypted connections (HTTPS), hashed passwords, a bot check, one-time codes at sign-in, access limited to people who need it, and providers with recognised security standards. No system is 100% secure, but we work to keep your data safe and to fix problems quickly.
8. If something goes wrong
If a data breach is likely to put your rights at risk, we will notify the Information and Data Protection Commission within 72 hours of becoming aware of it, as the Act requires. We will tell you without undue delay if it is likely to pose a high risk to you, including what happened and what you can do.
9. Your rights
Under the Botswana Data Protection Act, 2024, you have the right to:
- Know what personal data we hold about you and how we use it
- Access a copy of it
- Correct it if it is wrong or incomplete
- Delete it (“right to be forgotten”) where we no longer need it
- Restrict how we use it
- Object to our use of it, including for direct marketing
- Take it with you (data portability) in a common, readable format
- Not be subject to decisions made only by a machine that have legal or similarly significant effects on you
- Withdraw consent at any time, where we rely on it
- Complain to the Information and Data Protection Commission
To use any of these rights, contact us (section 15). We will reply within 30 days and may ask you to prove who you are first. It's free, unless a request is clearly unfounded or excessive.
10. AI and automated decisions
Our bots use AI to answer messages, write quotes, sort email and prepare reports. They do not make final decisions with legal or similarly significant effects on people. Anything important or tricky is handed to a human. We do not use your data, or your customers' data, to train public AI models.
11. If you are a client: your customers' data
When a Thyra bot handles your customers' data (for example in WhatsApp chats or calls), your business is the data controller and Thyra is your processor. We only use that data to run your bots, on your instructions. You are responsible for having a lawful basis to collect it and for telling your customers, for example in your own privacy notice. We can provide a data processing agreement on request.
12. Laws in other countries
If you live outside Botswana, you may have extra rights under your local law. We respect them:
European Union and United Kingdom (GDPR and UK GDPR)
You have the rights listed in section 9, and you can complain to your local data protection authority. We rely on the legal bases in section 3, and transfers from the EU or UK use safeguards such as Standard Contractual Clauses.
South Africa (POPIA)
You can access, correct and delete your information, object to processing and direct marketing, and complain to the Information Regulator.
Kenya, Nigeria and other African countries
The Kenya Data Protection Act 2019, the Nigeria Data Protection Act 2023 and similar laws give you comparable rights. You can complain to the data protection authority in your country.
United States: California (CCPA/CPRA) and other states
You can ask what personal information we collect, ask us to delete or correct it, and opt out of its sale or sharing. We do not sell or share personal information for cross-context advertising, and we will not treat you differently for using your rights.
Everywhere else
Wherever you are, you can contact us to use the rights in section 9, and we will help as far as your local law and ours allow.
13. Children
Thyra is a service for businesses and is not meant for anyone under 18. We do not knowingly collect children's data. If you think a child has given us data, contact us and we will delete it.
14. Disclaimers
- AI can make mistakes. Thyra bots use artificial intelligence and may give wrong, incomplete or out-of-date answers. Check important numbers, quotes, prices and messages before you act on them.
- Not professional advice. Nothing a bot or this website says is legal, tax, accounting, financial or medical advice. Penny (our AI accountant) prepares records, but a registered accountant must still sign off tax returns and audited accounts.
- Demo data is fictional. Our live demo runs on an imaginary business, Thebe Auto Works. Its customers, bookings, invoices and figures are examples, not real people or results.
- Estimates are estimates. Savings, salary comparisons and prices on this site are based on public information and may differ for your business.
- Third-party services. WhatsApp, Google, phone networks and other services we connect to have their own terms and privacy policies, and we are not responsible for them.
- This policy is not legal advice. It explains how we handle data. If you need advice about your own legal duties, speak to a qualified lawyer.
15. Contact and complaints
For any privacy question or request, contact our data protection contact:
- Email: mmatr1xnq@gmail.com
- WhatsApp: +267 78 802 834
If you're not happy with our answer, you can complain to the Information and Data Protection Commission of Botswana, or to the data protection authority where you live.
We may update this policy. We'll change the date at the top, and tell clients about important changes by email.