Privacy Policy

1. Data controller

This policy explains how we process personal data in accordance with Regulation (EU) 2016/679, the General Data Protection Regulation ("GDPR"), and the Spanish data protection act, Ley Orgánica 3/2018, de 5 de diciembre, de Protección de Datos Personales y garantía de los derechos digitales ("LOPDGDD").

Data protection officer: we are not required to appoint one (Article 37 of the GDPR and Article 34 of the LOPDGDD). For any privacy question, write to us at admin@twinyx.app.

2. Who this policy applies to

• Twinyx users (the creators who subscribe to the service): Twinyx is the controller of the data relating to their account, their billing, security and commercial communications.
• Visitors to twinyx.app and the dashboard.
• Telegram contacts of creators (fans, clients and other creators): Twinyx processes their data on behalf of each creator, as a processor. See section 6 and the information for contacts.

3. What data we process

3.1 Account and registration

• Email address, preferred language and registration date.
• Password, stored only as a bcrypt hash and never in plain text. If you sign in with Google, we receive your email address, your name and an account identifier from Google. If you sign in with Telegram, we receive your Telegram ID, first name, last name and username (we do not store your photo); you type in your email address yourself and we verify it with a link.
• Security settings, such as two-factor authentication, whose secret is stored encrypted.

3.2 Telegram connection

• Your Telegram username and ID, and the identifier of the Telegram Business connection that routes the messages.
• The messages you send to your contacts from the dashboard or the app: they are delivered through Telegram and kept in the conversation history (section 9).

3.3 Service configuration

• Your personality context, your extracted writing style, example messages, response categories and templates, your services and prices, your payment methods and social media, your schedules and the other bot settings.
• The details the bot uses to speak on your behalf: your name or alias, your nicknames, your gender (for grammatical forms) and your country. Also your time zone, which we use only to apply your schedules and which is not sent to the AI. We suggest the country based on your IP address and the time zone based on your device's; you can change both.
• The lists of Telegram users you manage (contacts who are excluded, allowed or whose conversation was handed over to you, and trusted or banned promotion swap partners): their Telegram ID and username, the first name of swap partners and the notes or reasons you add.
• In your payment methods, the payout details you type in yourself, which may include a phone number (Bizum), an email address, a username or bank details such as an IBAN.
• Your ratings of the AI's replies, with the reason and the note you add if you choose to.
• The text of your artificial intelligence notice.

3.4 Screenshots

• The images you voluntarily upload to extract your writing style or the content of your categories, and the screenshots you upload as proof of views in a promotion swap with another Twinyx creator, are not stored by Twinyx: they are processed in memory and sent to the Google Gemini API. Google keeps what it receives for up to 55 days, only to detect abuse, and does not use it to train its models.
• Only the result is stored: the text that describes your style, the content of your categories or the number of views. The style analysis is configured not to extract names, phone numbers, email addresses, links or any other information that identifies your contacts.

3.5 Payment data

• We do not store card data: subscription payments are handled entirely through Stripe. The payout details you choose to add to your payment methods (section 3.3) are stored, as part of the bot configuration.
• We store the Stripe customer and subscription identifiers, the plan, the subscription status and dates, the pricing region and the history of billing events.

3.6 Technical and security data

• In the server's technical logs, your IP address, your browser and the address of each request, which may include what is searched for in the dashboard; in the security logs, your IP address and your browser (sign-ins, password changes, acceptance of legal documents, administrative access).
• Your IP address, to find out your country: we use it to work out the pricing region we show you (also if you only visit the website) and to suggest it when you set up the bot. The country you save stays in your configuration and is used in the AI's instructions to adapt replies to the expressions of your region.
• The Cloudflare Turnstile bot check at sign-up, sign-in and password reset.
• When you open a page with the Telegram button (sign-in, sign-up, confirmation to link Telegram to your account, Settings and Telegram connection), your device loads Telegram's sign-in component from telegram.org, so Telegram receives your IP address and your browser details. In the Android app this does not happen when the page opens (section 3.12).
• If you use voice dictation in the web dashboard, speech recognition is done by your browser with its own service (in Google Chrome, for example, Google processes the audio); we only receive the resulting text.
• Aggregated, anonymous web analytics with Umami, hosted by us and cookie-free.

3.7 Support

• The content of the requests you send us, your email address, your plan, your browser, the page you write from and any attachments. Attachments reach our email inbox and are not stored in the database.

3.8 Referrals

• Your referral code, who referred you and the source of the invitation, the conversion status and the milestones reached.
• What the other person sees: whoever invited you sees in their dashboard the first two characters of your email address, the date you signed up and, if you go on to pay, the date of your first payment. Anyone who opens your link or uses your code sees the first two characters of your email address.

3.9 Notifications

• The push notification identifiers of your browser or device, and the dashboard notifications.

3.10 Consents

• The record of your acceptances and withdrawals of the Terms, of this Policy and of consent to commercial communications, with date, version, IP address and browser.

3.11 Diagnostics and observability

• AI traces: every reply and every screenshot analysis is recorded in our observability tool, hosted by us, with the instructions sent to the AI (for replies, your configuration and the recent history of the conversation; for analyses, without the images), the result, your account identifier and the rating you give that reply. We use them only to run and debug the service, and they are erased after 30 days.
• Automatic error reports: if saving the setup wizard fails, the dashboard sends us a report with the error message, the step and a content-free summary of what you had set up (counts and the language). It is stored in the security logs with your IP address and browser, and we use it to diagnose and fix the failure.

3.12 Mobile app (Android)

• The Twinyx Android app shows the same dashboard as the website and processes the same data. It includes no third-party advertising or analytics kits, and it only asks your permission to show you notifications: it does not use your device's GPS location, does not read your phone's address book and does not use the camera or the microphone. We work out your approximate country from your IP address (section 3.6).
• Your session is kept with the same cookie as on the website, stored in the app, on your device. The app is left out of Android backup to your Google account.
• For notifications it includes Firebase Cloud Messaging (Google). When you open the app for the first time, Firebase creates an installation identifier and a device token and registers them on its servers, even if you do not turn on notifications. Only if you turn them on does the app send us that token, which we store to send you alerts.
• The Cloudflare Turnstile bot check also works inside the app (section 3.6). In the app, no page loads anything from telegram.org when it opens: Telegram's sign-in page opens, inside the app itself, only when you tap the button, and only then does Telegram receive your IP address and your browser details.
• The copy of your data (section 10) can also be downloaded from the app: the system share sheet opens so you can save or send the file. The app keeps the latest copy in its private storage, on your device, until the next export or until you clear the app's data or uninstall it.

4. Purposes and legal bases

Where the basis is legitimate interest, we have weighed it against your rights, and you can object by writing to us (section 10).

5. Artificial intelligence and automated decisions

5.1 AI-generated replies

To reply to your contacts in your style, we send your personality context, the details the bot uses to speak on your behalf (section 3.3), your categories with your payment methods and the recent history of each conversation to our AI provider, Google (section 7). Google does not use this data to train its models and keeps it for up to 55 days, only to detect abuse. Google also keeps your personality context for up to 1 hour so it can reply faster.

5.2 Automated decisions

The service decides automatically, for example, whether to reply to a message, which category it fits, whether a conversation should be handed over to you, whether a contact looks like spam or whether they may be a minor. None of these decisions produces legal effects on you or your contacts or affects them in a similar way (Article 22 of the GDPR): when the system does not reply, the conversation is left to you, and you can review and change any decision from the dashboard.

6. Your contacts' data

When your contacts write to you on Telegram, and when you add someone to your lists (section 3.3), you are the controller of their data and Twinyx acts as processor on your behalf, under the Data Processing Agreement, which forms part of the Terms. In short:

• Before any AI reply, each contact receives the artificial intelligence notice and, except for verified counterparties in a promotion swap (see the Data Processing Agreement), a request for explicit consent, with a declaration that they are of legal age. Without a YES, their messages are not processed with AI; with STOP they can withdraw it whenever they want.
• If a contact indicates that they are a minor, the AI stops replying to them and we alert you.
• We do not use your contacts' data for our own purposes, or to train AI models.
• Your contacts can find the full information on the privacy page for contacts, which the chat itself links to.

7. Recipients and processors

We disclose data to these providers, which process it on our behalf as processors, under an agreement that complies with the GDPR. Below the table we describe the exceptions: when Telegram and Google act as independent controllers, Cloudflare's own use of Turnstile signals and your browser's push service.

• Telegram, as a messaging platform and when your device loads its sign-in button (section 3.6), and Google or Telegram when you sign in with them, process data as independent controllers, under their own policies.
• Cloudflare processes the data as a processor when it checks on our site that you are not a bot, and as an independent controller of the signals it uses to improve its bot detection (IP address, TLS fingerprint, browser and site key), under its Turnstile privacy addendum.
• Your browser's push service: push notifications in the browser go through the service of the browser's maker (for example, Google for Chrome, Mozilla for Firefox, Apple for Safari or Microsoft for Edge), which receives them encrypted end to end and cannot read their content.
• Have I Been Pwned: when you choose a password (sign-up, change or reset), we check whether it appears in known breaches by sending only the first 5 characters of its SHA-1 hash, which hundreds of different passwords share. Neither your password nor your email address leaves our servers.
• Tools hosted by us: AI observability (section 3.11) and web analytics (Umami) run on our own OVHcloud infrastructure; they do not share data with third parties.
• We may disclose data to judges, courts and authorities when the law requires it.

8. International transfers

Some providers process data in the United States. These transfers rely on:

• The EU-U.S. Data Privacy Framework (European Commission adequacy decision of July 10, 2023) for certified providers.
• Standard contractual clauses approved by the European Commission (Implementing Decision (EU) 2021/914) for the others, with an assessment of the level of protection and supplementary measures such as encryption in transit and minimizing the data sent.

You can ask us for a copy of the safeguards by writing to admin@twinyx.app.

9. Retention periods

9.1 Blocking of data

When we erase data that may be needed to deal with claims, we block it instead of deleting it straight away (Article 32 of the LOPDGDD): it is set aside, unused, and available only to judges and courts, the Public Prosecutor's Office or the competent authorities during the limitation period. Specifically: the record of your consents (5 years), the security logs (within their 3-year period; the record of the account deletion itself is not blocked, see section 11) and the proof of the AI notice and of your contacts' consent, with the flags of possible minors (3 years). After that, it is destroyed. The identifier of the Telegram accounts first connected to Twinyx from your account, and your account's identifier, which we keep so the free trial is not repeated, are not blocked, because they are still used to prevent fraud: they are erased within the period in the table.

9.2 Backups

We make a daily backup of the database, which is overwritten every 24 hours. Whatever is erased also disappears from the backup within that period.

10. Your rights

Under the GDPR and the LOPDGDD, you can exercise the following rights at any time:

• Access: to know what data of yours we process and to obtain a copy: from Settings you can download a JSON file with your account data, your configuration and your conversations (in the mobile app, through the system share sheet).
• Rectification of inaccurate data.
• Erasure, when the data is no longer necessary (you can delete your account from Settings, see section 11).
• Restriction of processing in the cases provided for by law.
• Portability, in a structured, machine-readable format (the same JSON file).
• Objection to processing based on legitimate interest.
• Withdrawal of consent, without affecting the lawfulness of earlier processing.
• Not to be subject to automated decisions with legal or similar effects.

How to exercise them: write to admin@twinyx.app from your account email, stating the right you want to exercise. We will only ask you for more information to identify you if we have reasonable doubts about your identity (Article 12.6 of the GDPR). We will reply within one month, which may be extended by two further months in complex cases, and exercising your rights is free of charge.

Deceased persons: their relatives, people with a de facto relationship to them and their heirs may request access to, rectification or erasure of their data, unless the deceased person prohibited it (Article 3 of the LOPDGDD).

If you believe we have not handled your request properly, you can lodge a complaint with the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es).

11. Delete your account

You can delete your Twinyx account at any time (Twinyx is the service and Android app run by BAIXOSAMA INVERSIONES, SL):

• From the web dashboard or the app: in Settings, with the "Delete account" button. If you have a password, we ask for it to confirm; if you only sign in with Google or Telegram, we email you a confirmation link that is valid for 1 hour.
• Without the app or the dashboard: write to admin@twinyx.app from your account email asking us to delete it. Our staff will delete it within the period in section 10 and confirm to you by email what was erased and what is kept.

When you delete it from Settings, we immediately erase your account, your configuration, your Telegram connections, the conversation history, the notifications, your support requests and the rest of the service data, cancel your subscription at Stripe and remove you from the commercial communications list. Only the following is kept:

12. Security

We apply technical and organizational measures appropriate to the risk, including:

• Encrypted communications (TLS/HTTPS).
• Passwords stored as bcrypt hashes and checked against leaked passwords.
• Two-factor authentication available to all users and mandatory for administrative staff.
• Data isolation per account, parameterized queries and limits against abuse.
• Logging of administrative access to conversation data.
• Signature verification for Stripe and Telegram webhooks.
• Daily backup, breach management procedures and regular security reviews.

13. Minors

Twinyx is intended exclusively for people aged 18 or over, who declare this when they register. We do not knowingly collect data from minors. If you know that a minor has given us data, write to admin@twinyx.app and we will erase it.

14. Cookies and local storage

See the Cookie Policy. We only use technical or preference cookies and storage, which do not require consent.

15. Changes to this policy

If we change this policy, we will update the version and date at the top. If the changes are significant, we will notify you in the service or by email and ask you to accept the new version to keep using it.

16. Contact

• Email: admin@twinyx.app
• Postal address: Rua Condesa Casa Barcenas, 11, 36204 Vigo, Pontevedra