Privacy Policy

1. Who We Are

Thorero — Operational Governance Platform. A product of Two Stone Nig Ltd (RC 1405761).

• Registered Office: 289, Ipaja Road, Agege, Lagos, Nigeria.
• Website: www.thorero.com
• General Enquiries: info@thorero.com
• Support: support@thorero.com
• Privacy Requests: privacy@thorero.com

2. Information We Collect

We may collect the following categories of information.

• Account Information — Name, email address, phone number, job title, company name, user role.
• Organisational Information — Facility information, asset information, department information, operational records, compliance records.
• User Activity Information — Login activity, access logs, audit trails, application usage data, device information.
• Documents & Uploaded Content — Operational records uploaded by the Customer, including but not limited to work orders, incident reports, audit reports, compliance records, personnel certifications, and attachments. The specific categories of records depend on the modules the Customer uses.
• AI Copilot Interactions — Where the AI Copilot functionality is used, we may process prompts submitted by users, questions asked, responses generated, and operational summaries requested, for the purpose of providing AI-assisted services.

3. How We Use Your Information

We use information to:

• Provide Thorero services
• Create and manage accounts
• Improve platform functionality
• Generate reports and analytics
• Deliver customer support
• Manage system security
• Detect fraud or misuse
• Improve AI-assisted services
• Comply with legal obligations

4. Legal Basis for Processing

Where applicable, we process information based on:

• Contractual necessity
• Legitimate business interests
• Consent
• Legal obligations
• Protection of users and services

5. Data Ownership

Customer data remains the property of the Customer.

Thorero does not claim ownership of asset records, incident reports, work order records, operational information, or business data uploaded by customers.

The Customer retains all rights to its organisational data.

6. Data Sharing

We do not sell customer or user data.

We may share information with the following categories of recipients:

• Service Providers — Cloud hosting providers, system monitoring providers, communication service providers, and AI model providers used to deliver the Copilot feature.
• Legal Authorities — Where required by law or legal process.
• Business Transfers — If Thorero or Two Stone Nig Ltd undergoes a merger, acquisition, restructuring, or sale.

7. Data Security

We implement reasonable technical and organisational security measures including:

• Role-Based Access Control
• Authentication Controls
• Encryption in Transit
• Password Protection
• Audit Logging
• System Monitoring
• Backup Procedures

8. Data Retention

We retain customer data for the duration of the subscription to provide services, meet contractual obligations, fulfil legal requirements, resolve disputes, and protect business interests.

Upon termination of the subscription, customer data remains available for export for 30 days after termination. Customer data is permanently deleted within 90 days after termination, unless a longer retention period is required by applicable law or by a separate written agreement.

Aggregated, anonymised statistics that cannot identify the Customer or its users may be retained indefinitely for platform improvement purposes.

9. User Rights

Subject to applicable law, users may request:

• Access to personal data
• Correction of inaccurate information
• Deletion of personal data
• Restriction of processing
• Withdrawal of consent
• Data export where applicable

10. Cookies and Analytics

The Thorero website may use essential cookies, security cookies, performance analytics, and user preference cookies. Cookies help improve user experience and platform functionality. Users may control cookies through browser settings.

11. Third-Party Services

Thorero uses third-party infrastructure to operate the platform, including cloud hosting and database services, application hosting services, AI model providers for the Copilot feature, email delivery services, and system monitoring services.

A current list of sub-processors is available on request via privacy@thorero.com.

In future releases, Thorero may integrate with customer identity providers (SSO) and ERP systems. Where such integrations are used, they will be subject to the privacy policies of those providers.

12. International Data Transfers

Information may be processed or stored in data centres located outside the user's country of residence. Where applicable, appropriate safeguards shall be implemented to protect personal data in accordance with applicable law, including the Nigeria Data Protection Act.

13. Children's Privacy

Thorero is designed for business and organisational use. The platform is not intended for individuals under the age of 18. We do not knowingly collect personal information from minors.

14. AI Services

The Thorero Copilot provides structured answers to operational questions using two mechanisms: rule-based answers, computed entirely within Thorero from data the user is already authorised to view; and AI-assisted answers, for questions that cannot be answered by rules alone.

For AI-assisted answers, a compressed summary of the user's query and the relevant scoped context is transmitted to a third-party AI model provider for processing. Only aggregate counts and summaries are sent — never full operational records.

The AI provider does not use Thorero customer data to train its models. Users may disable the AI Copilot from within the Copilot panel at any time. When disabled, only rule-based answers are provided.

AI responses are generated automatically and may contain inaccuracies. Users remain responsible for any business decisions made using AI-generated information. AI functionality is intended to assist users and does not replace professional judgement.

15. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be published on the Thorero website. Continued use of the platform after updates constitutes acceptance of the revised policy.

16. Contact Us

For questions about this Privacy Policy, please contact:

• Thorero — Operational Governance Platform
• A product of Two Stone Nig Ltd (RC 1405761)
• Website: www.thorero.com
• General Enquiries: info@thorero.com
• Support: support@thorero.com
• Privacy Requests: privacy@thorero.com
• Phone: +234 806 271 6983