Deb Get started

Legal

Privacy policy

Effective date: 11 October 2026

1. Who we are

Deb is provided by Thalassis Pte. Ltd., 160 Robinson Road, Singapore. You can reach us at deb.support@thalassis.co.

2. What Deb is

Deb connects an AI assistant you choose, such as Claude or ChatGPT, to the LinkedIn, WhatsApp, Gmail and Outlook accounts you connect, including your calendars, Google Drive and OneDrive. Your assistant uses Deb to read, search and draft in those accounts, and to send messages after you confirm them.

3. Data we process

  • Account details: the details you give us when you create your Deb account.
  • Sign-in details: your passkeys, of which Deb keeps only the public part, and your email address if you add one, which is also your login name if you set a password. If you set a password, Deb keeps only a salted, one-way hash of it, never the password itself. When you choose one, and each time you sign in with it, Deb checks it against a public list of leaked passwords (Have I Been Pwned) by sending only the first 5 characters of a fingerprint of it. If it has appeared in a leak, Deb asks you to set a new one by email. If you sign in with Google or Microsoft, Deb keeps that account's ID and the email address it gave when you linked it, never your Google or Microsoft password, and asks Google or Microsoft only for your basic profile (your name and email address).
  • Connections: the connections you create to LinkedIn, WhatsApp, Google and Microsoft, so Deb can act in those accounts for you. When you connect LinkedIn, the email and password you enter are passed to our messaging connectivity provider to sign you in. Deb doesn't store your LinkedIn password.
  • Content from those services: messages, emails, calendar events, files, profiles and posts that Deb reads from them when your assistant asks for them.
  • Drafts and scheduled messages: content saved to be sent later.
  • Billing data: your plan, subscription and payment records. Your payment details are collected by our payment provider; Deb never receives your full card number.
  • Activity logs: a record of which Deb tools ran, when, and with what result, kept for security and troubleshooting. These logs are designed not to hold message content. For anything sent to other people, they also keep the recipients' email domains (for example gmail.com) and one-way fingerprints of the recipients, the text, any attached files and the message or post being replied to. A fingerprint cannot be turned back into an address or text; we use it only to check, while investigating a security incident, whether a specific address, text or file was involved. These logs are deleted after 180 days, or when you delete your account.
  • Feedback reports: when your assistant runs into a problem with Deb, it can file a report describing what happened. You can opt out of these reports on your account page.

Our Security page explains what Deb stores and how it protects it.

4. How we use it

We use this data only to provide Deb's features. We do not sell personal data or use it for advertising.

We don't use your data, or content from the accounts you connect, to train AI models.

5. Your AI assistant

Content Deb returns to Claude or ChatGPT is processed by Anthropic (for Claude) or OpenAI (for ChatGPT) under your agreement with them.

6. Google user data

Deb's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

7. Subprocessors

We use service providers to run Deb, and share with each only what it needs for its job:

  • Hosting and database: stores Deb's data and runs its services, in Singapore.
  • Network and security: carries traffic between you, your AI assistant and Deb, and protects Deb from attacks.
  • Email delivery: sends sign-in codes, recovery links, security notices and, if you delete your account while a Microsoft account is connected, one email with the steps to remove Deb at Microsoft.
  • Messaging connectivity: connects Deb to the LinkedIn and WhatsApp accounts you link, and carries the messages Deb reads and sends there.
  • Payments: our payment provider sells Deb subscriptions as the seller of record. It handles checkout, billing, tax and payment support under its own terms and privacy policy.

Google and Microsoft process your data under your own accounts with them. Deb connects to them only with the permissions you approve.

8. Retention and deletion

We keep data only as long as we need it:

  • Connected accounts and their sign-in keys: until you disconnect the account or delete your Deb account.
  • Drafts: until you send or delete them.
  • Scheduled messages: deleted 30 days after they're sent, fail or are cancelled.
  • Files you upload to attach: deleted about a day after upload.
  • Sign-in codes and recovery links: deleted within about a week after they expire.
  • Activity logs: deleted after 180 days.
  • Feedback reports: deleted after 12 months.
  • Billing records: kept for as long as tax and accounting law requires.

Cancelling your subscription doesn't delete your data. To delete it, delete your Deb account from your account page. That immediately deletes your account, your connections and their sign-in keys, your passkeys, the hash of your password, the Google and Microsoft sign-ins you linked, drafts and scheduled messages. For Google accounts, Deb also asks Google to cancel its access. Activity logs are stripped of anything that identifies you and deleted after 180 days. Billing records are kept as the law requires, and our payment provider keeps its own records of your purchases under its privacy policy.

Microsoft accounts. When you remove a Microsoft account or delete your Deb account, Deb deletes the keys it held, so it can't reach that account again. Microsoft doesn't let apps withdraw their own permission, so Deb stays listed in your Microsoft account until you remove it. You can do that at any time: personal accounts at https://account.live.com/consent/Manage, work or school accounts at https://myapps.microsoft.com. If your organisation's administrator approved Deb for everyone, only they can remove it. Removing Deb at Microsoft doesn't delete anything Deb stored; deleting your Deb account does.

9. International transfers

Deb stores your data in Singapore, where Thalassis Pte. Ltd. is based. If you use Deb from another country, your data is transferred to Singapore. Some of our service providers, such as our network and payment providers, also process data in other countries where they operate. Google, Microsoft, LinkedIn and WhatsApp handle your data in their services under their own terms.

10. Your rights and how to exercise them

Depending on where you live, you may have the right to access, correct, delete or export your personal data, and to object to or restrict how we process it. To exercise these rights, email deb.support@thalassis.co. You can also disconnect any connected account at any time.

11. Changes to this policy

When this policy changes, we update this page and its effective date. Effective date: 11 October 2026.