Privacy Policy

1. Summary

• This website sets no cookies, runs no analytics and loads nothing from third parties.
• The Twiglo app keeps what it needs to run your account: your e-mail address, sign-in and security records, and your workspace's content. No passwords, no card data.
• Your bots' users: you decide what your bots collect; we process that data for you under the Data Processing Agreement.
• We do not sell personal data and do not use it for advertising or to train AI models.

2. Who is responsible

For the website and for Twiglo accounts, the controller is the company that operates Twiglo (being registered in Georgia; its name and address will be added here before the public launch). Contact: hello@twiglo.app. An EU representative under Article 27 GDPR will be named here before we offer the Service in the EU.

For the people who talk to bots built with Twiglo, the controller is the workspace that runs the bot; we act as its processor (section 8).

3. This website

• No cookies, no trackers, no third-party scripts. Fonts, images and code are served from this site.
• Your browser's local storage keeps two preferences if you set them: your theme (light or dark) and that you dismissed the language hint. They never leave your device.
• Server logs. Like any web server, ours records each request: IP address, time, page, browser user agent and referrer. We use the logs only to keep the site running and secure, and delete them after at most 30 days.
• E-mail. If you write to us (for example, to request access), we use your message and address to reply and keep the correspondence as long as needed for that conversation, then for at most 2 years.

4. Twiglo accounts: what we collect and why

The app sets only the cookies it needs to work: your sign-in session (and a short-lived one while you sign in). It keeps interface preferences, such as the theme, panel sizes and dismissed hints, in your browser's local storage; they do not leave your device.

Sign-in is passwordless by design: a one-time code sent by e-mail, Telegram, or a passkey. A passkey stays on your device or in your password manager; we keep only its public key, its name and when it was last used. A second factor (a passkey or an authenticator app) is asked for before sensitive actions. We hold no payment card data; when paid plans exist, payments will be handled by a payment provider acting as merchant of record, and this policy will be updated first.

5. AI features

When you or your bots use AI, the prompt (which may quote messages of your bot's users) is sent to our AI provider and the answer returned. Prompts and answers are kept for 7 days and then deleted; our staff cannot read them. We keep only usage figures (model, tokens, credits) for billing.

6. Who receives data

We share personal data only with the service providers that help us run Twiglo, listed with their purpose and location on the Sub-processors page, and with authorities when the law requires it. Telegram and Meta receive your bots' messages because they deliver them; they act under their own terms.

7. Where data is stored

Twiglo is built to run in data centres in the European Union. Until production runs there, this page will say so; any provider outside the EU/EEA is named on the Sub-processors page with the safeguard used (an adequacy decision or the EU Standard Contractual Clauses).

8. People who use bots built with Twiglo

If you chat with a bot built with Twiglo, the workspace that runs it decides what it collects (for example, your name, username, language, messages, answers and tags) and is responsible for it. We store and process that data on its behalf. Every bot answers these commands:

• /privacy shows the bot's privacy notice (each bot also has a privacy page);
• /forget deletes what the bot holds about you, except records the law requires us or the bot's owner to keep (payments, abuse reports);
• /stop stops messages from the bot.

For other requests, contact the bot's owner; if you cannot reach them, write to us and we will pass the request on.

9. Your rights

Depending on where you live, you can ask for access to your data, correction, deletion, restriction, portability, and object to processing based on legitimate interest. In the app you can export your data and delete your account yourself. Write to hello@twiglo.app for anything else; we reply within one month. You can also complain to your data protection authority.

10. Security

Each workspace's data is isolated in the database itself (row-level security), bot tokens are encrypted with a separate key per bot held in a key vault, traffic is encrypted in transit, backups are encrypted, sensitive actions require a second factor (a passkey or an authenticator app), there are no account passwords to steal, and changes are recorded in an audit log.

11. Children

Twiglo accounts are for adults (18+). We do not knowingly collect children's data for accounts.

12. Changes

We will post updates here with a new date and tell account holders about material changes by e-mail or in the app before they apply.