Privacy
Effective date: 13 November 2026. This notice is in force.
Who operates Tharu
Tharu Studio operates as a registered DBA of a Texas limited liability company, based in Katy, Texas, USA. In this notice, “we” and “us” mean that company. Write to support@tharu.studio about anything on this page.
When you ask for access
When you ask about access through the form on this site, we use the name, studio name, email address and anything you write in the message to review your request and reply to you. We do not use it for anything else, and we do not sell or share it for advertising.
When your studio uses Tharu
A studio using Tharu enters order, contact and fulfilment details in order to serve its own customers. For that information the studio decides what is collected and why; Tharu stores and processes it on the studio’s behalf. If you are a customer of a bakery that uses Tharu and you want your details corrected or removed, ask that bakery first — they control their own records.
The services we use
Tharu runs on other companies’ systems. Each category below receives personal information — not a sanitised copy of it — in the course of doing its job:
- Hosting, accounts and file storage — holds everything a studio puts into Tharu: customers, orders, quotes, recorded payments, messages and uploaded images. Stored in the United States.
- Email delivery — receives the recipient address and the full content of every message Tharu sends, including the ones a studio sends to its own customers.
- AI receipt processing — receives a supplier receipt image when a studio asks for one to be read, with whatever is printed on it. See Reading receipts.
- Payment processing — receives the billing contact and card details for a studio’s subscription to us, once subscription billing is switched on. It is not switched on today, and card details are never held by us.
- Website and network services — serves this site and the application, so visitors’ IP addresses and request details pass through them.
Service providers names the companies in each category, says what each one receives and where it is processed.
These companies process data for us under their own terms, which also give them their own reasons to handle it — security, abuse prevention, billing — so we do not claim they act only on our instructions. Processing happens in the United States, which may not be where you or your customers are.
Cookies and browser storage
This website sets no cookies, runs no analytics and carries no tracking pixel. The access form sends what you type to us and stores nothing in your browser.
The Tharu application keeps your sign-in in your browser’s local storage rather than in a cookie. That is authentication data: it identifies you to the application, which is the whole point of staying signed in. Signing out or clearing your browser data removes it.
Besides the sign-in, the application sets one cookie, sidebar_state, which remembers
whether the sidebar is open and lasts seven days, and stores three preferences locally: whether
amounts are hidden, whether the sidebar is collapsed, and whether you have dismissed the setup
checklist. Those four are preferences only — they are not used to identify or track you.
Our emails carry no open tracking and no click tracking.
Reading receipts
A studio can photograph a supplier receipt and ask Tharu to read it. When it does, the photo itself is sent to Anthropic, together with the studio’s currency, today’s date in the studio’s timezone, our list of expense categories, and the names of shops that studio has saved as its usual suppliers. Tharu attaches no customer, order or enquiry record to that request. The document itself is whatever the studio photographed, so if a receipt happens to show a name or an address, that is part of the image being read.
What comes back is a suggestion — merchant, date, total, tax, payment method and a category — and it is never saved on its own. The baker sees it, checks it against the receipt and confirms or corrects it before anything is recorded.
Anthropic publishes that it does not train its models on data sent through its business API, and that it keeps such data only for a limited period, with longer retention where something is flagged under its usage policy. Those are Anthropic’s own terms, which it can change and which carry their own exceptions, so read them at anthropic.com/legal/commercial-terms and in its privacy policy rather than relying on our summary. Reading is capped at 300 receipts per studio per month, and if the feature is not switched on nothing is sent at all.
How long we keep things
We review retained information every three months and remove records that have reached the applicable retention period, subject to the exceptions below. Because reviews are quarterly, routine deletion may occur up to three months after that period ends. For privacy or deletion requests, contact support@tharu.studio.
A period below is therefore the point from which a record becomes eligible for deletion, not the day it disappears. A deletion you ask for is handled on its own, as described under Deleting on request, and does not wait for the next quarterly review.
| What | How long we keep it |
|---|---|
| A studio's records — customers, orders, quotes, payments, activity | While the studio exists. Once it stops, 12 months from the day the clock starts below, then deleted at the next review. |
| Files a studio uploaded — receipt photos, enquiry photos, logos | With the studio they belong to, on the same clock. |
| The original enquiry as it arrived, before it was tidied onto an order | 24 months from the enquiry — unless an order we are still keeping refers to it, in which case it stays as long as that order does. |
| Records of emails a studio sent, and what the provider reported back | 24 months — unless an order we are still keeping relies on one as its record of what the customer was told, in which case it stays with that order. |
| Receipt readings — what was extracted and checked | With the expense they belong to; if no expense was saved, 12 months. |
| Access requests made through this website | 12 months after we decide, so we can answer questions about it. |
| Our own operational logs | Held by our hosting provider on its schedule, not ours. We do not control the period. |
| Our own backups of the database and uploaded files | We do not hold backups of our own yet, so there is nothing here to state a period for. When we do, this row will say how long a copy is kept and the deletion wording below will account for it. Our providers’ own backups are described at the end of this section. |
When the clock starts. For a studio that subscribed, from the day the subscription ended. For a studio that only ever trialled, from the day the trial ended, whether or not it ever subscribed. For a studio that never began a trial, from the day the account was created. A studio that is simply paused has not stopped, and is not on this clock.
Studios we have exempted. Some studios — our pilots, and any other studio we have granted free use to — have no subscription at all, by arrangement. Having no subscription is not the same as a subscription having ended, so no clock runs against them and the review does not treat them as eligible for deletion. If such an arrangement ends, the clock starts from that day, and we would write to the owner before anything was removed.
What the review checks before deleting. Records here refer to one another — an order points at the enquiry it came from and at the emails sent about it. Before anything is removed the review checks what still depends on it, and something a retained order relies on is kept with that order rather than deleted on its own clock. We would rather hold a record a little longer than leave an order we are keeping with its history torn out.
We may keep longer what the law requires us to keep — for example records of a payment, for tax — and will say so if that applies to a request. These periods are our own policy. They are not a claim that any particular law is satisfied by them.
Deleting on request. The studio owner asks; we carry it out. Write from the email address on the studio’s owner account to support@tharu.studio, which reaches Tharu Studio’s privacy contact. If the request arrives from any other address, we will confirm it from the owner account before doing anything, because a deletion cannot be undone. We then remove the studio’s records from the database and its uploaded files from storage, and write back to say what was removed. Export first if you want a copy: a studio owner can download their customers, orders and payments as spreadsheets from inside Tharu at any time, including while the studio is paused.
Our providers’ copies. Our providers hold operational logs and any backups of their own, on their own schedules and under their own terms. A deleted record can remain in those for a period after we have removed it, and we cannot promise a date by which it is gone everywhere.
Who can see it
Each studio’s records are separated in the database, and that separation is enforced by the database on the tables holding studio records rather than by the application asking politely. One studio cannot read another studio’s customers, orders, receipts or enquiry photos.
Logos are the exception. A studio’s uploaded logo is stored so that it can appear in emails, which means anyone holding its address can fetch it. Receipts and enquiry photos are not: those buckets are private, and a file is reached through a link we issue only to someone signed in to that studio. Such a link expires after a short time, but while it is valid it works for whoever holds it — so treat one you have copied or forwarded as you would the file itself.
Beyond the studio’s own members, these can reach studio data:
- Two platform administrator accounts. The screen they use shows studio-level figures only — name, plan, how many customers and orders, enquiries in the last 30 days, when the studio was last active. It shows no customer names, order contents or contact details.
- Our own server-side code, which runs with a key that is not limited by the per-studio separation. It sends a studio’s email, reads a receipt and prepares an export. Some of it also runs on a schedule rather than in response to anything you do — checking hourly whether a billing email is due, and processing queued messages — so it reads studio records in the background as well as on request.
- The company’s owner, who holds direct database access, used to run the service, fix a fault, or help a studio with its own data.
- Our providers, who can technically reach what they host, under their own terms.
Your choices
Write to support@tharu.studio to ask for access to the information we hold about you, to correct it, to export it, or to have it deleted. We aim to reply within 30 days. A studio owner can export their own studio’s records from inside Tharu at any time.
Changes
If we change this notice we will update the effective date and, for a change that matters, tell studios by email before it takes effect.
Nothing on this page is legal advice.