Data Processing Agreement

1. Parties and scope

This Data Processing Agreement ("DPA") is part of the Terms of Service between the company that operates Twiglo ("Processor", "we") and the customer that owns a Twiglo workspace ("Controller", "you"). It applies whenever we process personal data on your behalf while providing the Service, mainly the data of the people who use your bots ("End Users"). It follows Article 28 of the EU General Data Protection Regulation ("GDPR") and applies in the same way where other data protection laws apply.

If this DPA and the Terms conflict on personal data, this DPA prevails.

2. Details of the processing

• Subject matter: running your Telegram and WhatsApp bots, Mini App forms, broadcasts, audience tools and AI features.
• Duration: while you use the Service, plus the deletion periods in section 9.
• Nature and purpose: receiving and sending messages, keeping conversation state, storing answers and audience records, sending broadcasts, checking links, and calling the AI provider when your flows or you use AI.
• End User data: messenger user id (for WhatsApp, the phone number or business-scoped id), first and last name, username, language, messages, answers to your bots' questions (which may include e-mail addresses, phone numbers, dates and free text you ask for), tags and profile fields you set, referral links, Telegram Stars payment records, delivery state of messages, and the time of their last message (for WhatsApp's 24-hour window).
• Data subjects: End Users; people named in content you upload.
• Special categories: none are needed by the Service. Do not configure bots to collect them unless you have a lawful basis and the safeguards the law requires.

3. Your instructions

We process End User data only on your documented instructions: these Terms, this DPA and your configuration of the Service (your bots, flows, broadcasts and settings). We tell you if we think an instruction breaks the law. We do not sell End User data, use it for advertising, or use it to train AI models.

You are responsible for having a lawful basis for the processing, for the notices you give End Users, and for the content your bots send.

4. Confidentiality and staff

Only staff who need access to operate and support the Service can reach End User data, under confidentiality obligations. Staff access to the admin console is restricted to a private network with hardware-key sign-in and is recorded in the audit log. Staff cannot read AI prompts and answers.

5. Security

We maintain the technical and organisational measures in Annex 2 and keep them up to date with the state of the art. We may improve them as long as the overall level of protection does not go down.

6. Sub-processors

You authorise the sub-processors listed on the Sub-processors page. We bind each one by written terms that protect personal data at least as well as this DPA, and we remain responsible for them. We will announce a new or replacement sub-processor at least 30 days before it starts processing End User data (on that page and by e-mail to workspace owners); you may object on reasonable data protection grounds, and if we cannot resolve the objection you may end the Service without penalty.

Telegram and Meta deliver your bots' messages. They are not our sub-processors: you choose the messenger, and WhatsApp runs through your own WhatsApp Business account under your terms with Meta.

7. Helping you with End User requests

The Service gives you and your End Users tools to exercise data protection rights: every bot answers /privacy (a notice and a privacy page per bot), /forget (erases what the bot holds about that person, except records the law requires us or you to keep: payments, abuse reports) and /stop; you can export and erase audience records in the app. We help you with other requests, impact assessments and consultations with authorities as far as reasonably possible.

8. Personal data breaches

We notify you without undue delay, and in any case within 48 hours, after we become aware of a personal data breach affecting your End User data, with the information you need to meet your own obligations, and we keep you updated as we learn more.

9. Deletion and return

You can export your data at any time in the app. When you delete a workspace, it is kept for a 30-day grace period and then permanently deleted, together with its End User data; encrypted backups are overwritten on their normal rotation. Individual records are deleted earlier where the Service says so (for example, sessions 30 days after they end, AI prompts and answers after 7 days, and immediately on /forget).

10. Audits

We make available the information needed to show compliance with this DPA, including the description of our measures and our records of processing, and answer reasonable questionnaires. Where that is not enough, you may audit us once a year with 30 days' notice, at your cost, under confidentiality, in a way that does not disrupt the Service or expose other customers' data.

11. International transfers

The Service is built to run in data centres in the EU. Where a sub-processor processes End User data outside the EU/EEA, we rely on an adequacy decision or the EU Standard Contractual Clauses, as stated on the Sub-processors page.

12. Liability and changes

Each party's liability under this DPA is subject to the limits in the Terms, except where the law does not allow it. We may update this DPA to reflect changes in law or in the Service; we will notify you of material changes in advance.

Annex 1. Contact points

• Processor: hello@twiglo.app (legal entity details will be added before the public launch).
• Controller: the workspace owner's e-mail address in the account.

Annex 2. Technical and organisational measures

• Isolation: every workspace's data is separated in the database by row-level security enforced on every tenant table.
• Encryption: bot tokens are encrypted with a key per bot (envelope encryption) held in a separate key vault (OpenBao Transit); traffic is encrypted in transit (TLS); database backups are encrypted (AES-256) and copied to a second location.
• Access control: passwordless sign-in with one-time e-mail codes and required two-factor authentication; session list and revoke; the admin console is reachable only over a private network with hardware-key sign-in; least-privilege database roles.
• Accountability: an audit log of changes by workspace members and staff, with IP addresses stored only as keyed hashes.
• Minimisation and retention: automatic deletion on the schedules in section 9; AI prompts and answers kept 7 days; logs filtered of tokens, cookies and sign-in codes.
• Abuse prevention: links in broadcasts and Mini Apps checked against lists of unsafe sites; reports through /report handled with notice and action.
• Resilience: health-checked services, monitored backups and restore drills.

Annex 3. Sub-processors

See the Sub-processors page.