Privacy Policy

Information we receive from services you connect

Twintual works on top of the accounts you choose to connect. We only access a service after you sign in to it and grant permission on that provider’s own consent screen (OAuth or the provider’s official connection flow). You can disconnect any service at any time in Settings → Channels & profiles, or revoke our access in the provider’s own security settings.

We do not sell this information, and we do not use it for advertising.

Google user data: Limited Use

Twintual’s use and transfer of information received from Google APIs follows the Google API Services User Data Policy, including the Limited Use requirements. Specifically:

• Use: we use Google user data only to provide and improve the user-facing features you see in Twintual.
• Transfer: we do not transfer it to others except:
  • as needed to provide those features;
  • to comply with law;
  • as part of a merger or acquisition, with notice to you.
• Advertising: we do not use it for advertising.
• Human access: no person reads it unless:
  • you have given us explicit permission for specific messages, for example a support request;
  • it is needed for security or to comply with law;
  • the data is aggregated and anonymised.
• AI training: we do not use Google user data to develop, improve or train generalised AI or machine-learning models.

How we use AI

Twintual uses large language models to sort messages, draft replies, summarise threads, prepare briefs, transcribe your voice notes and answer your questions.

• What is sent: the minimum text needed for the task. For example, the thread you’re replying to, relevant context from your connected sources, and your writing preferences. Each request is limited to your own account.
• Providers:
  • OpenAI is our primary provider, for text and voice transcription.
  • Google (Gemini API, on a paid Google Cloud project) is a backup, used automatically if OpenAI is unavailable.
• No training: OpenAI does not use API content to train its models unless the customer opts in, and we have not opted in. Google does not use prompts or responses sent to the paid Gemini API to improve its products.
• Retention by AI providers: for abuse monitoring, OpenAI may keep API inputs and outputs for up to 30 days, and Google keeps paid Gemini API data for 55 days. Neither uses that monitoring data for model training.
• You stay in control: Twintual never sends a message, accepts an invite or takes an action on your behalf without your click, unless you turn on an Autopilot level that allows it. At its highest level, Autopilot sends only low-risk replies, such as acknowledgements and scheduling confirmations, for the contacts or categories you choose. Each such reply is held for at least 30 seconds so you can undo it, and is capped per day, per contact and per thread.

Who processes data for us (sub-processors)

Error tracking (GlitchTip) and the public status page run on our own servers, not with a third party.

Where your data is stored and international transfers

Your account data and connected-source data are stored on our servers in the European Union, in Finland. Encrypted backups are also copied to Google Cloud Storage in the European Union. Some sub-processors above, including the AI providers, Stripe, Apple and Resend, are based in the US. We have data processing agreements in place with all of our sub-processors. Where data leaves the EEA, we rely on the European Commission’s Standard Contractual Clauses and/or the EU-US Data Privacy Framework, as offered by each provider.

How long we keep data

• Synced messages and content: while your account is active and the source stays connected. Disconnecting a source immediately deletes the messages, threads and events we synced from it. Content in the source itself is not touched.
• Attachments you send from Twintual: staged copies are deleted 7 days after sending, or after 7 days if never sent.
• Audit logs: 24 months.
• Backups: encrypted daily. Copies kept on our servers rotate out after 14 days.
• Account deletion: when you delete your account, we delete it and its data from our live systems immediately. Copies disappear from backups as they rotate out. This does not delete content in Gmail, Slack, Teams or your other connected services.

Your rights

You can access, export, correct or delete your data at any time:

• Export: Settings → Trust & privacy;
• Delete your account: Settings → Delete account;
• Disconnect a source: Settings → Channels & profiles.

You can also email help@twintual.com. EU/EEA and UK residents also have the right to object, to restrict processing, to data portability, and to complain to their local data protection authority (in Spain, the AEPD). We respond within one month.