Privacy Policy
Last updated: 14 October 2026 · Effective: 14 October 2026 · Previous version: 4 October 2026, 19:40
This policy describes what personal data Thalamus processes, on what legal basis, who it is shared with, how long it is kept and how you can control it. We do not sell data, show ads or run third-party analytics.
IN SHORT
We collect what the service needs to work: account sign-in, profile, provider listing and requests. We take no payments, so we hold no payment data. Data is stored in the European Union. There are no advertising or analytics trackers. You can delete your account yourself in profile settings. What you publish yourself, such as a provider listing, is readable by everyone.
1. WHO IS RESPONSIBLE FOR YOUR DATA
1.1 Controller
The data controller is Ilona Golman, Barcelona, Spain. Tax number (NIF/NIE): to be published upon registration as autónomo. Postal address: to be published upon registration as autónomo. Email: hello@thalamus.community.
1.2 Scope
This policy covers the site thalamus.community, all of its sections, and the Studio tool (studio.thalamus.community) embedded into the Studio page.
1.3 Data protection officer
The law does not require us to appoint a data protection officer: we do not monitor people systematically on a large scale and do not process special categories of data on a large scale. All questions go to the contacts in Section 14.
1.4 Applicable law
Processing is governed by Regulation (EU) 2016/679 (GDPR) and the Spanish law LOPDGDD 3/2018.
2. WHAT DATA WE COLLECT
2.1 Data you provide
- Account: email address, password as a hash or a one-time sign-in code, interface language.
- Telegram sign-in, if you used it: your Telegram account number, name, username and a link to your photo. Such an account starts without an email address — until you add one yourself in your profile.
- Two-factor authentication: the authenticator secret and the factor status, if you enabled it.
- Passkey, if you added one: the public part of the key, its name, and the dates it was added and last used. Your fingerprint and face stay on your device.
- Profile: name, city, origin and destination countries, languages, avatar.
- Activity in the service: relocation goals, favourite listings, votes for future features.
- Contact preference: which channel we use for notifications — Telegram, email, or “only in Thalamus” — and when you last opened the list of notifications in your profile.
- Provider listing: name, phone, email, website, description, services, prices, geography, extra blocks and events; the messengers you connected (username, number or link), visible only to signed-in Thalamus users; the “Joint projects” tag, if you turned it on.
- Provider verification: the type of proof and the document file.
- Verification by call, if you chose it instead of documents: your form answers (what you do, links to your work, how long, who for, how it started, what you expect from Thalamus, who told you about us — the last one optional); the check log — date, who checked, method (video or in person) and outcome; twice a year — your answer to “Still there?” and, if you write it, what’s new. No snapshot of your ID and no call recording: you show the document to the camera.
- Requests and deals: your contact details, the text of the enquiry, the chosen provider, the status and related notes and tasks.
- Support messages: whatever you write to us by email.
- An application to become a specialist, if you sent one: the name you will be shown under, your credentials, a link confirming them, and the topics you are ready to answer on, if the form asks for them.
- Community membership: which community you belong to, your role and your status — including a request the owner has not reviewed yet. If you invited someone with an invite link, we keep the link code and the fact that you created it.
- What you write in a community: the text of your posts and comments and your name next to them. In a public community the posts are visible to everyone, including people who are not signed in; your name next to them is shown only to members of communities you share, and everyone else sees you as “member”. The same applies to your name in a mention in a text and to the author name of a post that came from a Telegram group.
- Follows: which authors and which public communities you follow, and since when. Only you see this list: neither the author nor the community owner knows who follows them, and there is no follower count. You can follow an author only if you share a community with them.
- Meetups: which meetups you marked as going and what you wrote in the meetup chat. If you marked “looking for company” — that mark and the line about yourself, if you wrote one. Only people going to the same meetup see them, and the line is erased after the meetup. If you invited people with your link — who joined through it; you are shown only their number. A person who opens your link sees your name even before signing in. Only members see a private club’s meetup; the call link and the chat are seen by the members who are going and by the organiser.
- Your project in a Learning club, if you create one: its title, description, link and week-by-week steps, with your name next to them. Club members see it or, if you choose, only the club owner and moderators. People outside the club never see it.
- The end-of-session check in Learning, if you answered it: a mark that you answered the check for that session. The answers themselves are stored without your name — only as a total count per option, and that count cannot show who chose what.
- Your answer to “How did you hear about the cohort?”, if you gave one when joining a club with a pass: one option from a list — a friend, social media, a meetup, search or other. The question is optional; neither the club owner nor its members see the answer — only you and the Thalamus team.
- The course you teach: its title, description, session texts, checklist items and module names, with your name and credential next to them. A published course is visible to everyone, including people who are not signed in; an unpublished one is visible to you, to the moderators of your club and to the service administrator.
2.2 Data collected automatically
- Hosting technical logs: IP address, browser type, request time. Needed for security and troubleshooting.
- Visit counter: the address of the page you opened, the host you came from and the time. No cookies, no IP address, no identifier — such a record cannot tell who you are.
- Log of actions on the pages: which filters you chose in the catalog and how many listings were found, which step of sign-up you reached and why it did not go through, and whether you pressed a contact on a provider’s listing. It records codes and numbers together with the page language, whether you were signed in, and the time. No email, no text, nothing you typed into form fields; no cookies, no IP address, no identifier — such a record cannot tell who you are.
- Rate limit on open forms: a fingerprint of your address — a one-way hash with a secret salt. The address itself is never stored. It exists so feedback and enquiry forms cannot be flooded by a script; the record lives one hour and is deleted.
- Studio access: the date it was first opened and the access status. There are no payment identifiers — we take no payments.
2.3 Data from third-party sources
If you sign in with Telegram, your name, username and photo link come to us from Telegram itself — by your decision and only after you have confirmed the sign-in on Telegram’s own site. Before that press not a single request goes to Telegram: the button on the form is ours, and pressing it takes you to Telegram. We have no access to your messages and cannot have any.
Sometimes a third party gives us a provider's or a client's contact details — for example, you were recommended to us. In that case, on first contact we tell you where your data came from, as Article 14 of the GDPR requires.
When we arrange a room for a meetup or an evening, we keep the venue manager's work contact: name, work email and phone. We take them from the venue's website or from our correspondence with it. We tell the manager where we got the contact on first contact and no later than one month, as Article 14 of the GDPR requires.
2.4 Other people's data
If you enter other people's data into the service — for example an employee's contact in a provider listing — you are responsible for the lawfulness of publishing it and for making sure the person knows about it.
2.5 Cookies and local storage
We use strictly necessary cookies — the sign-in session and the chosen language — and cookies for the appearance you chose yourself. There are no analytics or advertising cookies, hence no consent banner. The full map is in the Cookie Policy.
2.6 What we do not collect
- special categories of data: health, religion, political views, biometrics;
- children's data: the service is for people 18 and older;
- data for advertising profiles and cross-site tracking;
- bank card details: we take no payments and never ask for a card.
- payment data for a Learning cohort: the cohort is paid on the course author’s page, outside Thalamus, and the payment never reaches us;
3. PURPOSES AND LEGAL BASES
Each purpose of processing, the data involved, the legal basis under Article 6 of the GDPR and the retention period:
| Purpose | Data | Legal basis | Retention |
|---|---|---|---|
| Registration and sign-in | Email, password hash, sign-in codes, language, 2FA factors | Contract, Art. 6(1)(b) | Until the account is deleted |
| Profile and matching services to your route | Name, city, countries, languages, avatar, goals, favourites | Contract, Art. 6(1)(b) | Until the account is deleted |
| Publishing a provider listing in the catalog | Name, contacts, services, prices, geography, blocks, events | Contract, Art. 6(1)(b) | While the listing is published |
| Verifying a provider | Type of proof, document file | Legitimate interest, Art. 6(1)(f): the catalog needs verified providers | File — up to 30 days after the decision; the verification mark — while the listing exists |
| Verifying a provider by call and the twice-a-year recheck | Form answers, check log (date, who checked, method, outcome), recheck answer | Legitimate interest, Art. 6(1)(f): the catalog needs verified providers | Form — 30 days after the call, 60 days after sending if there was no call; “what’s new” answer — 30 days; check log and verification mark — while the listing exists |
| Passing a request to a provider and following the deal | Contact details, enquiry text, status, notes, tasks | Contract and legitimate interest, Art. 6(1)(f) | 24 months without activity, then automatic deletion |
| Negotiating with venues to rent or exchange a room | Venue manager's name, work email and phone; what we offered, what they replied, the next step | Legitimate interest, Art. 6(1)(f): agreeing on a room; where the manager is a party to the contract — contract, Art. 6(1)(b) | 24 months without activity, then the contact and negotiation notes are erased automatically; the venue itself stays on the list |
| Telling you about your request | The channel you chose, the request number and the name of the provider it went to; your Telegram account number or email address — whichever you picked | Contract, Art. 6(1)(b) | The delivery record — until the account is deleted |
| Transactional email: sign-in codes, request statuses | Email, event | Contract, Art. 6(1)(b) | Until the account is deleted; delivery logs per the email provider |
| Telling you that your question has an answer | The channel you chose, the text of your question and a link to the answer; your Telegram account number or email address, depending on that choice | Contract, Art. 6(1)(b) | Delivery record until the account is deleted |
| Telling you about a reply to your comment and about a mention of you in a community text | A quote of the reply up to 140 characters or the title of the text, a link to the post; the author’s name is not in the notification; your Telegram account number or email address, depending on your choice | Contract, Art. 6(1)(b) | Delivery record until the account is deleted |
| A daily summary of new posts in your clubs | The club name, the number of new posts by other members over the last day, a link to the club; no author names or post text in the summary; your Telegram account number or email address, depending on your choice | Contract, Art. 6(1)(b) | Delivery record until the account is deleted |
| Your feed of follows | Which authors and which public communities you follow, the date you followed | Contract, Art. 6(1)(b) | Until you unfollow or delete your account |
| A message to the administrator about a new club | The club name, whether it is open or closed, whether it is listed, a link to the admin panel; the creator’s name is not in the message. An open club is listed straight away, and the message lets the administrator remove it from the list | Legitimate interest, Art. 6(1)(f) | Delivery record until the administrator’s account is deleted |
| A club post in the “Looking for a team” strip of the Jobs section, if the author ticked “show in Jobs” | The first line and text of the post without phone numbers, email or messenger links, the club name and date; no author name. The tick is available only in an open club | Contract, Art. 6(1)(b) | Until the post is deleted: a deleted post leaves the strip at once and is erased after 30 days |
| A link from a post author’s name to their catalogue listing | The link between the post author and their published listing. Shown only to people who already see the author’s name: members of a shared club | Contract, Art. 6(1)(b) | Not stored separately: the link is built when the post is shown |
| The list of notifications in your profile | Your notifications from the sending log and the time you last opened the list | Contract, Art. 6(1)(b) | The list — until the account is deleted; the time is overwritten each time you open it |
| The “going” mark, company and the meetup chat | The mark that you are going; how you came — through the “Share” button or through another person’s personal link, and then who invited you; the “looking for company” mark and a line about yourself of up to 120 characters; your messages in the meetup chat. A message goes to the club’s Telegram group only if you send it there yourself | Contract, Art. 6(1)(b) | The “looking for company” mark and the line about yourself — until the meetup ends, erased by a daily job; the rest — until the account is deleted; deleting the meetup removes the marks and the chat |
| Notice of a club meetup and of a published session review | The title of the meetup or session and a link to it; your Telegram account number or email address — whichever you chose. Sent to club members and to those who marked that they are going | Contract, Art. 6(1)(b) | The sending record — until the account is deleted |
| The club member list for its owner and moderators | Your name and role in the club, the date you joined, the date of your last visit to the club, the number of your posts in the club feed over 7 days. “Only me” notes are not counted or shown | Legitimate interest, Art. 6(1)(f): the club owner runs the cohort and sees who needs help. You can object as described in section 9 | The visit date is overwritten on each visit; all of it is deleted when you leave the club or delete the account |
| Your project in a Learning club | Title, description, link and week-by-week steps; who sees it — club members or only the owner and moderators, as you choose. A note from your learning notes gets into the project only when you press “Add to project” and “Save” | Contract, Art. 6(1)(b) | Until you delete the project or the account. A deleted project can be restored for 15 minutes, then it is erased. While you are not in the club, the project is hidden |
| The end-of-session check in Learning | A mark that you answered the check for that session. Answers — only as a total count per option, without your name | Contract, Art. 6(1)(b) | The mark — until you delete the account; deleting the course removes it. The total count names no one |
| The “How did you hear about the cohort?” question when joining a club | One option from a list; answering is optional | Legitimate interest, Art. 6(1)(f): to understand how people find the cohort. You can object as described in section 9 | Until you leave the club or delete the account |
| Introducing a job seeker and an employer in the Jobs section | Your “looking for work” card: craft, interests, city, work format, availability, right to work; languages from your profile; introductions, their statuses and recommendations; the candidate's answer to a recommendation — confirmed or declined — and its date; a restriction mark after a decision that the information about the connection is false — right to recommend removed, access closed — with its date and reason. Complaints about recommendations themselves are in the row “A complaint about a recommendation in the Jobs section” | Contract, Art. 6(1)(b); the restriction mark — legitimate interest, Art. 6(1)(f): protecting employers and candidates from false information about a connection | While the card exists; “hidden” takes it out of results, and the “Delete the card” button erases it. Introductions, recommendations and restriction marks go when the account is deleted |
| A complaint about a recommendation in the Jobs section | The recommendation as it stood at the time of the complaint — text, kind of connection, author and candidate; who complained and their note; the administrator's decision and its reasoning | Legal obligation, Art. 6(1)(c): statement of reasons under Regulation (EU) 2022/2065 on digital services (DSA), Art. 17 | Until the candidate's or the author's account is deleted — the complaint goes together with the recommendation. If the account of the person who complained is deleted, the complaint stays without their name |
| A conversation about work with someone the administrator looks after personally | What you wrote yourself in the form behind your personal link: name, contact, city, craft, interests, languages, what you are looking for; the consent mark with its date. The administrator’s notes after the conversation and their “who to reply to” tasks. Only the administrator sees this; it never reaches the catalog or search results | Consent, Art. 6(1)(a): the checkbox in the form. Withdraw it with the “Delete my data” button behind the same link, or as described in section 9 | 12 months after the last contact, then deleted automatically. An unfilled invitation — 30 days |
| Telling you about a matching position and about an introduction moving | The channel you chose, the position number and the introduction status; your Telegram account number or email address, depending on that choice | Contract, Art. 6(1)(b) | Delivery record until the account is deleted |
| Studio access during the test launch | User identifier, date access was opened, status | Contract, Art. 6(1)(b) | Until the account is deleted |
| Checking a specialist's credentials and admitting them | Name shown under the answer, credentials, confirmation link, topics; for an application also the decision and the reason for refusal | Contract, Art. 6(1)(b): you ask to be admitted yourself | Application — 6 months after the decision; an admitted specialist's card — while the role lasts |
| Security and troubleshooting | Technical logs: IP, browser, time | Legitimate interest, Art. 6(1)(f) | Per the hosting provider's policy |
| Protecting open forms from flooding | Address fingerprint (one-way hash), form name, counter — never the address itself | Legitimate interest, Art. 6(1)(f) | 1 hour, then deleted automatically |
| Understanding which pages are read | Page address, referrer host, time — no IP, no identifiers | Legitimate interest, Art. 6(1)(f) | 12 months, then deleted automatically |
| Moderation and handling complaints | The report, including one made with the “Report” button on a post, comment or meetup chat message: who reported, the grounds, the text at the time of the report; the decision and its reasoning; correspondence. We notify whoever decides on a new report. The name of the person who reported is seen both by whoever decides and by the author of the post, comment or message that was reported | Legal obligation, Art. 6(1)(c): Regulation (EU) 2022/2065 | 6 months from the decision, then deleted |
3.1 Notifications
When something in Thalamus concerns you — an answer to your question or comment, a mention in a text, a move on your request, your club meeting tomorrow, a course session review being out — it appears under Notifications in your profile. There you also see whether the message reached Telegram or email. You choose the channel in your profile: Telegram, email, or “only in Thalamus”. The choice is followed literally: if you chose email, we will not write to you on Telegram. “Only in Thalamus” switches off messages on Telegram and by email; the events stay in your profile. About a question we send the question itself, a link to the answer, and a reminder that this is not a doctor’s appointment. For the “something new” mark we keep one timestamp — when you last opened the list. There is no viewing history.
3.2 Marketing
A marketing mailing, separate from transactional email, covers topics like relocation and residency permits. Signing up is voluntary: a separate form with an explicit, not pre-checked consent box. The mailing list is kept apart from accounts — it has no effect on sign-in emails or other transactional messages. Unsubscribe with one click from any mailing.
3.3 Matching in the Jobs section
The section compares your card with open positions on five points: craft, place, work format, language and the right to work. A match is a suggestion, not a decision: every position is open to you without it, and a person decides whom to invite. The language a position requires is printed on its card, so you can see which condition did not match.
Your card is visible to exactly the audience you choose in its settings, down to “hidden”. Messages about matches go to the channel you chose in your profile; “only in Thalamus” switches them off on Telegram and by email — matches stay under Notifications in your profile, and every message carries a link to that choice.
A recommendation about you becomes visible to an employer only after you have confirmed it. Until you answer, only you and the author see it. An administrator reviews complaints about recommendations; if the information about the connection is false, the consequences in clause 3.7 of the Terms apply.
3.4 New purposes
If we need data for a purpose not listed here, we will tell you before the processing starts and ask for consent where required.
4. WHO WE SHARE DATA WITH
Data is not sold and is not passed to advertising networks. Processing is carried out by contractors, each under a data processing agreement (DPA):
| Recipient | Role | What it receives | Where data sits | Transfer mechanism |
|---|---|---|---|---|
| Supabase | Processor | Database, authentication, verification files | EU, region eu-west-3 (Paris) | DPA and EU Standard Contractual Clauses |
| Vercel | Processor | Site hosting, technical logs | US and edge nodes | EU-US Data Privacy Framework |
| Brevo | Processor | Sending transactional email and notifications, plus the voluntary marketing mailing — under separate consent | France, EU | Data stays in the EU |
| Cloudflare | Processor | DNS and domain email routing; the “not a robot” check on the sign-in and sign-up forms: IP address and browser data | US and global network | EU-US Data Privacy Framework |
| The provider you sent a request to | Independent controller | Your contact details and the enquiry text | The provider's country | Transfer on your instruction |
| Telegram | Not our processor | The fact of signing in: Telegram learns that you are signing in to Thalamus. If you chose Telegram as your notification channel, also the text of the notification: for example, your question and a link to the answer, or a quote of a reply to your comment. Separately from that, service signals go to the site owner’s working chat: a new request, and a sign-up that was never completed. The email address in such a signal is shortened to its first three characters and the domain | Telegram Messenger countries | Transferred by your decision: when you press the sign-in button (before that press not a single request goes to Telegram), and when you choose Telegram as your notification channel. Service signals to the site owner rest on legitimate interest: to learn about a request and about a broken sign-up, so we can answer and fix it |
| Google Maps | Not our processor | IP address — only after you press “Show map” | US | Loaded at your decision |
4.1 Authorities
Data is disclosed to public authorities only on a lawful request and only to the extent necessary.
4.2 Business transfer
If the service is sold or reorganised, data may pass to the successor. We will tell you in advance and you will keep the right to delete your account.
4.3 What is public
Publicly visible: the provider listing with the contacts stated in it, the level and type of verification, and events with the status “published”. User profiles, requests, goals and verification files are not public.
For an admitted specialist, the name, the credentials and the confirmation link are public: they appear next to everything they publish as a specialist. The application itself never becomes public — neither before the decision nor after a refusal.
5. THE STUDIO AND ITS TOOL
5.1 What we store
On our side we store only Studio access: the user identifier, the date access was opened and its status. There is no payment data: we take no payments and have connected no payment provider.
5.2 What stays in your browser
Scripts, notes and materials in the Studio tool, your ticks and notes in Learn, the document checklist and your identity map stay on your device in browser storage. We do not receive them and keep no copies. Clearing browser data deletes them permanently. The full list is in section 3 of the Cookie Policy.
5.3 Token passed to the embedded frame
The Studio tool opens in an embedded frame from studio.thalamus.community. Only a temporary access token for your session is passed to it, so the tool can recognise you. The token lives about an hour, the exchange is restricted to the Thalamus and Studio domains, and the long-lived session refresh key is never passed.
5.4 Your own language-model key
If you connect a language-model key in the Studio tool, it is stored in your browser and never reaches our servers. The prompt text goes directly to the model provider you chose and is processed under their policy: in that part we are neither controller nor processor.
6. HOW LONG WE KEEP DATA
| Category | Retention |
|---|---|
| Account and profile | Until the account is deleted |
| Provider listing | While published; deleted immediately after removal |
| Verification file | No more than 30 days after the verification decision |
| Verification-by-call form | 30 days after the call; 60 days after sending if there was no call |
| “What’s new” recheck answer | 30 days after the answer |
| Call check log | While the listing exists |
| Requests and deals | 24 months without activity, then deleted automatically on a schedule |
| Venue manager contacts and negotiation notes | 24 months without activity, then erased automatically on a schedule |
| Studio access | Until the account is deleted |
| Visit counter rows | 12 months, deleted on schedule |
| Page action log rows | 12 months, deleted on schedule |
| Infrastructure backups | Up to 30 days |
| Applications to become a specialist | 6 months after the decision, then deleted |
| An admitted specialist's card | While the role lasts; deleting the account erases it at once |
| Complaints about recommendations in the Jobs section and restriction marks | Until the candidate's or the author's account is deleted |
| Complaint and moderation records | 6 months from the decision, then deleted |
6.1 After you delete your account
Profile, goals, favourites, requests and memberships are deleted immediately. A provider listing where you are the only member is deleted together with its verification files; a listing with other members stays with the team. Infrastructure backups hold deleted data for no more than 30 days.
6.2 What we must keep
Some data is kept longer where the law requires it: accounting and tax documents, and records about disputes and complaints.
7. TRANSFERS OUTSIDE THE EEA
7.1 Where data is stored
The primary storage — the database and files — is in the European Union, in the Paris region.
7.2 Residual transfers
Some contractors — hosting and domain email routing — operate from the United States. Those transfers rely on certification under the EU-US Data Privacy Framework and, where there is none, on the European Commission's Standard Contractual Clauses.
7.3 Copy of the safeguards
You can request a copy of the contractual safeguards by writing to hello@thalamus.community.
8. SECURITY
8.1 Measures
- row-level access control in the database: a user sees only their own records;
- verification files in private storage, accessible to the administrator only;
- passwords stored only as hashes, sign-in codes single-use;
- two-factor authentication for access to other people's data;
- traffic encrypted over HTTPS;
- rotation of access keys whenever compromise is suspected.
8.2 Data breach
If a breach creates a risk to your rights, we notify the Spanish supervisory authority AEPD within 72 hours of becoming aware of it. Where the risk is high we also tell you: what happened, what we did and what you should do.
8.3 Your part
Use a strong password, do not share access to your mailbox, and enable two-factor authentication if you work with client data.
9. YOUR RIGHTS
9.1 The rights
- access: find out what data we process and get a copy;
- rectification: correct inaccurate data;
- erasure: ask us to delete data;
- restriction of processing;
- objection to processing based on legitimate interest;
- portability: receive your data in a machine-readable format;
- withdrawal of consent where processing is based on it; withdrawal does not affect the lawfulness of processing before it.
9.2 How to exercise them
Write to hello@thalamus.community from the address on your account. If we have reasonable doubts about who is asking, we will ask you to confirm your identity — and will request no more than needed for that check.
9.3 Response time
We answer within one month. That period may be extended by two further months for complex requests — we will tell you about the extension and its reason within the first month.
9.4 Deleting your account
You can delete your account yourself in profile settings. No payment obligations remain: we take no payments.
9.5 Complaints
If you believe we handle data improperly, you can lodge a complaint with the Spanish data protection agency AEPD (aepd.es) or with the supervisory authority of your country of residence.
10. CHILDREN
10.1 Age
The service is for adults: you must be 18 or older to use it. We do not create accounts for children and do not collect anything by which a child could be identified.
10.2 If a child's data reaches us
Write to hello@thalamus.community and we will delete such data without delay.
11. AUTOMATED DECISIONS AND ARTIFICIAL INTELLIGENCE
11.1 No decisions without a human
We take no decisions producing legal or similarly significant effects on you by automated means alone. Verification, moderation and blocking are decided by a human.
One action is taken by a schedule on its own, and we name it plainly. A listing verified by call gets a “Still there?” question by email and notification twice a year. With no answer in 14 days the listing leaves the catalog. It is not deleted, every message warns about this in advance, and any answer — the button in your account, a message or an email to us — brings it back.
11.2 No profiling
We build no advertising profiles and do not score people algorithmically.
11.3 Where a model is used
A language model is used only in the Studio tool, with a key you connect yourself. Catalog, request and profile data is not used to train models and is not passed to model providers.
12. COOKIES
12.1 What is set
Strictly necessary cookies — the sign-in session and the chosen language — and cookies for the appearance you chose yourself. Browser storage holds what you tick off and write for yourself: it stays on your device. The full map is in the Cookie Policy.
12.2 Consent
Under AEPD rules technical cookies need no consent, so there is no banner. If analytics with identifiers appears, an honest banner with equally weighted accept and reject buttons will come first.
13. CHANGES TO THIS POLICY
13.1 How we announce them
We announce material changes on the site or by email at least 30 days before they take effect.
13.2 Previous versions
The dates of the current version and of its entry into force are in the page header, along with a link to the previous version.
14. CONTACT
14.1 Where to write
- Data questions and requests to exercise rights: hello@thalamus.community
- Postal address: to be published upon registration as autónomo
- Supervisory authority: Agencia Española de Protección de Datos, aepd.es
Last updated: 14 October 2026 · Effective: 14 October 2026