Skip to main content

Privacy Policy

Effective date: April 10, 2026 (Updated August 2026)

Tullius Ltd. (Company Reg. No. 517362588) ("Tullius", "we", "us", or "our") provides an AI-powered interview system that helps users specify, design, and plan software projects. This Privacy Policy explains how we collect, use, and protect your information when you use our service.

1. Information We Collect

We collect the following types of information:

  • Account information — when you sign in via a supported authentication provider, we receive your name, email address, and profile identifier.
  • Interview content — the messages, decisions, specifications, designs, and task breakdowns you create during interview sessions.
  • Usage data — information about how you interact with the service, including pages visited, features used, and session durations.
  • Payment information — if you subscribe to a paid plan, payment details are collected and processed directly by our authorized Merchant of Record and payment processing partners. We do not store your full payment card details on our servers.

2. Legal Basis for Processing

We process your personal data under the following legal bases as defined by applicable laws, including the General Data Protection Regulation (GDPR) and the Israeli Privacy Protection Law:

  • Contract performance — processing necessary to provide the Tullius service, including running interview sessions, generating project artifacts, and managing your account and subscriptions.
  • Legitimate interest — processing necessary for service security, fraud prevention, and analyzing aggregated, de-identified usage patterns to improve reliability and features.
  • Legal obligation — processing required to comply with applicable laws, regulations, or legal proceedings.

3. How We Use Your Information

We use your information to:

  • Provide and operate the Tullius service.
  • Process your interview sessions and generate project artifacts (specs, designs, tasks).
  • Manage your account and subscriptions.
  • Communicate with you about service updates or issues.
  • Analyze aggregated, de-identified usage patterns to improve service reliability and features.
  • Detect, prevent, and respond to fraud, abuse, or security incidents.

4. AI Processing

Tullius relies on third-party AI service providers to power interview sessions. Your interview messages are transmitted to our trusted AI infrastructure providers solely for real-time processing during your active sessions. We do not use your content to train AI models, and we contractually restrict our AI service providers from using your content for model training or independent purposes.

5. Data Sharing & Service Providers

We do not sell your personal information. We share personal data only with trusted third-party service providers (data processors) strictly necessary to operate our platform, divided into the following categories:

  • AI Processing Providers — third-party AI infrastructure providers used strictly to process and generate responses for your interview sessions and project artifacts.
  • Authentication & Infrastructure Providers — cloud hosting, database, and identity management services used to secure user accounts and maintain system architecture.
  • Payment Processors & Merchant of Record Partners — authorized billing and checkout partners used to process subscription payments, handle tax compliance, and issue invoices.
  • Product Analytics Providers — privacy-preserving product analytics services used to understand system performance and feature usage. Analytics run in a cookieless mode: private project content, chats, and generated documents are masked and strictly excluded from analytics events, and screen recordings are not conducted.
  • Legal Requirements — authorities or legal entities if required by law, regulation, court order, or to enforce our legal rights.

6. International Data Transfers

Your data may be transferred to and processed in servers located outside your country of residence (including in the United States and the European Union) by our infrastructure providers. These transfers are protected by appropriate safeguards, including Standard Contractual Clauses (SCCs) as approved by the European Commission, or other legally recognized data transfer mechanisms.

7. Data Retention

We retain your personal data and project history for as long as your account remains active or as needed to provide you with the Service.

To ensure personal data is not held indefinitely, we may delete or anonymize data associated with accounts that have been completely inactive for more than 24 consecutive months, after providing prior notice to the email address associated with the account.

You can delete individual projects at any time. If you delete your account, we will permanently remove your personal data within 30 days, except where retention is strictly required by law or for statutory tax compliance.

8. Security & Incident Notification

We use industry-standard technical and organizational measures to protect your data, including encryption in transit (TLS) and at rest.

Security Incident Notification Procedure: In the event of a security incident, data breach, or unauthorized access that compromises your personal data, we will take immediate remediation actions to secure our systems. We will notify affected users and relevant supervisory authorities without undue delay and within the mandatory timeframes prescribed by applicable privacy laws (such as GDPR Article 33/34 and the Israeli Privacy Protection Regulations).

9. Cookies and Tracking

Tullius uses essential cookies and local storage required for authentication and core service functionality. We do not use third-party advertising cookies, and we do not track you across other websites.

Product analytics are conducted in a cookieless, privacy-preserving mode without setting tracking cookies on your device. Analytics data is tied to internal account identifiers—never your raw email address—and private project content (chat messages, decisions, generated documents, and titles) is masked. We honor browser "Do Not Track" signals, and you may object to analytics processing at any time by contacting us.

10. Intellectual Property

All content you create through Tullius — including specifications, designs, task breakdowns, and any other project artifacts — remains your sole intellectual property. Tullius claims no ownership over your content. We may only use your content to operate and provide the Tullius service to you.

11. Your Rights

Depending on your location, you have rights regarding your personal data:

  • Under GDPR (EEA/UK users): Rights to access (Art. 15), rectification (Art. 16), erasure ("right to be forgotten", Art. 17), restriction of processing (Art. 18), data portability (Art. 20), and objection to processing (Art. 21). You also have the right to lodge a complaint with a data protection supervisory authority.
  • Under Israeli Law: Under the Israeli Privacy Protection Law, 5741-1981, you have the right to inspect (access) and request the correction or deletion of personal data held about you.

To exercise any of these rights, please contact us using the details in Section 14 below. We will respond within 30 days of receiving your request.

12. Children's Privacy

Tullius is not intended for use by anyone under the age of 18. We do not knowingly collect personal data from children. If we become aware that we have collected data from a person under 18, we will take steps to delete that information promptly.

13. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes by posting a notice on the service or sending an email notification. Where changes materially affect how we process your data, we will seek your renewed consent where legally required before applying the changes to your existing data. Continued use of Tullius after non-material changes constitutes acceptance of the updated policy.

14. Contact Us

If you have questions about this Privacy Policy or wish to exercise your data rights, please contact us at:

Tullius Ltd.
Company Reg. No. 517362588
Address: 5 Odem St., Yonatan, Golan Heights, Israel
Email: [email protected]

Privacy Policy