1. Controller
Twains is operated by the sole proprietorship of Talat KOÇ (Türkiye), which is the data controller under the Turkish Personal Data Protection Law No. 6698 (KVKK) and, where it applies, the GDPR. Contact: support@twains.ai.
2. Data we process
- Account data: email address, name, language and sign-in records (time, IP address, browser).
- Billing data: subscription status and Paddle customer ID. Card details never reach us; Paddle.com is the merchant of record.
- Content: documents you upload, emails and attachments imported from mailboxes you connect, and notes, drafts and reminders created by your assistant. Content may include special categories of data such as health, legal or financial information.
- Mailbox credentials: the app password of mailboxes you connect, stored encrypted and used only to sync mail, save drafts and send emails you approve.
- WhatsApp data (optional): your phone number and the messages you exchange with your assistant, if you link WhatsApp.
3. Purposes and legal bases
We process data to provide the service (performance of a contract), to meet legal obligations and to keep the service secure (legitimate interest). For special categories of data in your content and for international transfers we rely on your explicit consent, which you can withdraw at any time by deleting your account.
4. Where data is stored and who receives it
- Hosting: Hetzner Online GmbH, Helsinki (Finland). Each customer's disk is encrypted with its own key.
- AI: the assistant on your server runs on your own Claude account. When you talk to it, the content it reads is sent to Anthropic PBC (USA) to generate the answer, under your agreement with Anthropic.
- Payments: Paddle.com Market Ltd. (United Kingdom) as merchant of record.
- WhatsApp (optional): if you link your number, reminders, approval requests and your conversations with the assistant pass through the WhatsApp Business platform of Meta Platforms (Ireland/USA).
- Email delivery: account emails such as sign-in codes are sent through our own mail relay.
We never sell your data, share it for advertising or use it to train AI models.
5. Access and security
Your server runs isolated from other customers and its internet access is limited. Our team does not access your content in normal operation; any access needed to resolve an incident is logged. Key actions are shown to you on the Settings page.
6. Retention
Content is kept while you are subscribed. When the subscription ends your server is stopped, and 30 days later the disk is destroyed together with its encryption key. Deleting your account destroys it immediately. Encrypted backups rotate out within 30 days. Billing records are kept for the periods required by law.
7. Your rights
You can request access, correction, deletion, information about recipients and data portability, and you can object to processing, by writing to support@twains.ai. You can also export all your data and delete your account from the panel.