Privacy Policy
Effective: 13.09.2026
This Privacy Policy explains how personal data is processed when you use Thalonaut.
1. Controller
The controller responsible for processing personal data under the General Data Protection Regulation (GDPR) is:
Dr. Lukas Janker-Bortel
Vienna, Austria
Email: support@thalonaut.com
2. Data we process
Depending on how you use Thalonaut, we may process the following categories of data:
Account data:
Name, email address, profile picture and technical identifiers provided as part of the sign-in process.
Dive data:
Information entered by users such as date, dive site, region, geographic location, depth, duration, water temperature and optional notes.
Observation data:
Species observations, identifications, date, dive site, depth, images and information relating to confirmation or correction of an identification.
Photos and image information:
Images uploaded by users and, where applicable, technical metadata contained in those images.
AI identification data:
Images or image crops selected for AI-assisted species identification, relevant contextual information and identification suggestions returned by the AI system.
Technical data:
Information required for operation, security and troubleshooting, such as session information, technical logs and, where applicable, IP address, browser and device information.
3. Sign in with ChatGPT
Thalonaut uses Sign in with ChatGPT for authentication.
If you choose this option and approve the sign-in, OpenAI may provide Thalonaut with the name, email address and, if available, profile picture associated with your ChatGPT account.
This sign-in does not give Thalonaut access to your ChatGPT conversations, Memory, files, billing information or other ChatGPT content.
The information is used to create or associate your Thalonaut account, authenticate you and provide user-specific functions such as dive logs and species collections.
4. Purposes and legal bases
Where account information, dive data, observation data and images are required to provide functionality requested by a user, processing is based on Article 6(1)(b) GDPR.
Technical security and logging data may be processed under Article 6(1)(f) GDPR. Our legitimate interests are the secure and reliable operation of Thalonaut, troubleshooting and prevention of abuse.
Where future processing relies on consent, it will be based on Article 6(1)(a) GDPR. Consent may be withdrawn at any time with effect for the future.
5. AI-assisted photo identification
Thalonaut provides AI-assisted identification of marine species.
When this feature is used, the selected image or an appropriate image crop, together with contextual information relevant to identification, is transmitted to the OpenAI API.
OpenAI processes this information in order to perform the requested analysis.
Under the currently applicable OpenAI API data practices, API inputs and outputs are not used to train or improve OpenAI models by default unless the API customer explicitly opts into data sharing for that purpose.
OpenAI may retain certain API information for a limited period as part of standard security and abuse-monitoring processes. Exact processing and retention depend on the API functionality used and the data-control settings configured for the relevant OpenAI project.
Thalonaut treats AI output as an identification suggestion. Users can confirm or correct the result.
AI species identification does not produce decisions with legal or similarly significant effects within the meaning of Article 22 GDPR.
6. Hosting and service providers
Thalonaut is currently hosted using ChatGPT Sites provided by OpenAI.
OpenAI may process information as necessary to host, operate, secure and provide the Site.
OpenAI is also involved in providing AI-assisted photo identification and Sign in with ChatGPT.
Where OpenAI processes personal data on behalf of Thalonaut, the applicable OpenAI agreements and data-processing terms for ChatGPT Sites and/or the OpenAI API apply.
7. International data transfers
ChatGPT Sites currently does not guarantee data or inference residency exclusively within the European Union.
Personal data may therefore be processed outside the European Economic Area.
Where such transfers occur, OpenAI states that applicable data-transfer safeguards are used, including adequacy decisions or Standard Contractual Clauses under Article 46 GDPR where appropriate.
8. Research and scientific use
Thalonaut is intended in the longer term to enable marine-life observations to contribute to biodiversity research and ocean conservation.
At present, personal user data, photographs and observation data are not disclosed to external research partners solely for this purpose.
If such functionality is introduced in the future, affected users will be informed in advance about the purpose, data involved and recipients.
Where consent is required or chosen as the legal basis for such processing, it will be requested separately and voluntarily.
Declining future research consent must not prevent normal use of Thalonaut's core functionality.
9. Public visibility
Private account, dive and observation data are not automatically made public.
If functions allowing users to publish or share information publicly are introduced in the future, the user must be clearly informed which information will become public before publication.
10. Retention
Account data and user-generated content are generally retained for as long as the Thalonaut account exists or for as long as necessary to provide the requested functionality.
Following a deletion request, personal data will be deleted unless legal retention requirements or another lawful basis prevents immediate deletion.
Technical security and log data are retained only for as long as necessary for security, troubleshooting or abuse prevention.
Information processed through the OpenAI API is additionally subject to OpenAI's applicable retention and security practices.
11. Cookies and similar technologies
Thalonaut currently does not intentionally use its own advertising or marketing tracking technologies.
Technically necessary cookies or similar technologies may be used by Thalonaut or its service providers for authentication, session management, security and operation of the service.
If non-essential analytics, marketing or tracking technologies are introduced in the future, this Privacy Policy will be updated and consent will be obtained before their use where required by law.
12. Your rights
Subject to the requirements of the GDPR, you may have rights including:
- access to your personal data;
- rectification of inaccurate data;
- erasure;
- restriction of processing;
- data portability where applicable;
- objection to certain processing;
- withdrawal of consent with effect for the future.
Requests can be sent to support@thalonaut.com.
You also have the right to lodge a complaint with a competent data-protection supervisory authority.
In Austria:
Austrian Data Protection Authority
Barichgasse 40–42
1030 Vienna
Austria
Email: dsb@dsb.gv.at
13. Changes to this Privacy Policy
Thalonaut is under active development. This Privacy Policy may therefore be updated, particularly where new features, service providers or processing purposes are introduced.
The current version will be published on Thalonaut together with its effective date.