This notice covers thonissystems.com, its public evaluation environments, and first-contact email. Customer work requires a separate written data boundary based on the actual records, systems, providers, locations, retention, and authority involved.
The guided starting path prepares an inquiry in your browser. THONIS does not receive or store its text through the website, and the site does not provide a customer-data upload. Selected guide topics and unsent answers remain in page memory and clear on a fresh visit. Prepared guide answers use public THONIS information and do not call an AI provider. The inquiry text stays in this page until you deliberately open the prepared message in your email application; opening it shares that text with your email application, and sending it delivers it to THONIS. At that point, your email provider and THONIS's email provider process the message and associated metadata. Do not enter or send credentials, export-controlled data, CUI, regulated records, or sensitive customer evidence through an unapproved path.
02
Public evaluation environments
Public evaluations use fixed fictional or synthetic records. They do not require an account or customer-data upload. Browser-generated sample files are provided for local inspection and do not establish a customer deployment or accepted result.
03
Hosting, security, and essential cookies
Hosting and network providers process request and connection information needed to deliver, defend, and troubleshoot the site. Cloudflare may set the strictly necessary __cf_bm cookie for bot detection. The current cookie and measurement inventory is published on the Cookies and Measurement page.
04
Consent-gated measurement
Google Analytics page, product-route, CTA, worksheet-request, inquiry-start, synthetic-demo result, prepared-inquiry review, workflow-guide topic/source/context, and AI answer-outcome measurement loads only after analytics consent; Google Signals and advertising personalization remain off. AI outcome events contain only an authored topic identifier, a fixed outcome status, placement and corpus version. THONIS does not send questions, answers, inquiry text, email content, filenames, or customer evidence as analytics events. Sitewide content-masked Microsoft Clarity heatmaps and session replay load only after separate experience consent and are excluded from inquiry, direct demo, deck, and preview routes. Optional measurement can be refused or withdrawn through Privacy choices. No Cloudflare Web Analytics beacon currently loads. No advertising or retargeting pixel currently loads, and THONIS does not use browser fingerprinting, data-broker enrichment, or cross-site behavioral profiling.
05
Customer engagements
Before a pilot or production service uses approved customer records, the parties define the data boundary, roles, access, hosting, model use, subprocessors, transfer locations, retention, deletion, logging, incident path, and acceptance tests in writing. Public website terms do not replace those engagement-specific obligations.
06
Optional AI answers and customer information
If the optional AI question form is available, sending a question shares that question and approved public THONIS information with OpenAI through our server. This requires the form's separate acknowledgement; analytics consent does not authorize it. Keep sensitive information out. Prepared answers remain available without using AI.
THONIS does not save the question or answer in its application database or include either in analytics. We retain request identifiers, timestamps, a daily rotating keyed hash of the network address, and reserved or confirmed usage for abuse prevention and cost accounting. Uncertain charges remain reserved until reconciled. Hosting providers also process connection information. OpenAI response storage is disabled for this feature, but this is not a promise of zero retention: OpenAI may retain abuse-monitoring logs under its API data policies.
THONIS does not assume permission to use customer information to train a general-purpose model. Any model use, retrieval boundary, prompt handling, logging, retention, training, evaluation, or human-review requirement must be explicitly authorized for the engagement. See AI Governance and Human Authority.
07
Providers and third-party destinations
Cloudflare supports public-site delivery and security. Google receives consented analytics requests. Microsoft receives consented Clarity interaction data from marketing pages whose public document root is marked for sitewide content masking. Their services operate under their own terms and privacy notices. Links to social networks, standards bodies, Government sources, and other third parties are provided for context; a link is not an endorsement, integration, or permission to transfer sensitive information.
08
Access, correction, and deletion requests
You may ask THONIS to identify, correct, or delete information you sent through an approved public channel, subject to lawful security, audit, contract, and dispute-preservation obligations. A request may require reasonable identity verification before disclosure or deletion.
Privacy, access, correction, or deletion requests: john.mawad@thonissystems.com. Do not attach sensitive records to the first message. Last updated September 27, 2026.
