Introduction
TwinCloudsAI ("we," "us," or "our") operates the TwinCloudsAI platform at https://twincloudsai.com. This Privacy Policy describes how we collect, use, disclose, and protect your personal data when you use our Service.
It sets out your rights under the General Data Protection Regulation ("GDPR"), the California Consumer Privacy Act ("CCPA"),India's Digital Personal Data Protection Act 2023 ("DPDP Act") and the Information Technology Act 2000, and other applicable data protection laws. By using the Service, you consent to the processing of your personal data as described in this Policy.
Data Controller
TwinCloudsAI acts as the data controller for personal data collected directly from you. Where we process personal data on behalf of our business customers, we act as a data processor under the terms of our Data Processing Agreement.
Personal Data We Collect
Data You Provide
| Category | Examples |
|---|---|
| Account data | Name, email address, password (hashed), billing address, company name |
| Payment information | Processed by PayPal — we do not store full card or bank details |
| Social media credentials | OAuth tokens for Meta (Facebook & Instagram) — not your passwords |
| User content | Posts, images, and materials you create or schedule |
| AI Marketing Studio Brand Kit data | Business name, website URL, contact email, brand voice, uploaded logo, brand colors, heading/body font selections, and any product photos you upload for Product Photo Studio |
| Communications | Support tickets, feedback, and messages to us |
Data We Collect Automatically
| Category | Details |
|---|---|
| Log data | IP address, browser type, device, OS, pages visited, timestamps |
| Usage data | Features used, actions taken, session duration |
| Cookies | See our Cookie Policy for full details |
Data from Third Parties
We receive social media analytics and profile data via the official Meta Graph API when you connect your Facebook or Instagram account. Specifically, we retrieve the following data elements from Meta's platforms:
| Meta Data Element | Purpose |
|---|---|
| Impressions | Displayed on your Analytics dashboard |
| Reach | Displayed on your Analytics dashboard |
| Engagement (likes, comments) | Displayed on your Analytics dashboard |
| Follower count | Displayed on your Analytics dashboard |
| Page ID / Instagram Business Account ID | Required to make API calls on your behalf |
This data is sourced from Meta Platforms, Inc. It is retrieved only when you have actively connected your account and is used solely to display analytics within your Twin-Clouds dashboard. We are not affiliated with Meta. You can disconnect your Meta account at any time via Settings, after which we stop retrieving this data. We also receive payment verification data from PayPal. We do not purchase or obtain data from data brokers.
Legal Bases for Processing (GDPR)
| Legal Basis | When We Rely on It |
|---|---|
| Contractual necessity | To provide the Service you have subscribed to |
| Legitimate interests | Improving the Service, fraud prevention, security monitoring |
| Legal obligation | Compliance with applicable laws and regulations |
| Consent | Marketing communications and certain analytics (withdrawable at any time) |
How We Use Your Personal Data
- To create and manage your account and deliver the Service
- To process payments and manage subscriptions via PayPal
- To connect to Facebook and Instagram on your behalf via the Meta Graph API
- To generate AI-assisted content as requested by you
- To send transactional communications (account confirmations, invoices, support responses)
- To send marketing communications (with your consent where required)
- To analyse and improve the Service
- To detect, prevent, and respond to fraud, abuse, and security incidents
- To comply with legal obligations and enforce our Terms
We do not sell your personal data to third parties. We do not use your data to train AI models without your express consent.
Sharing and Disclosure of Personal Data
| Recipient | Purpose | Safeguard |
|---|---|---|
| Google Firebase | Hosting, database, authentication, storage | Data Processing Agreement, SOC 2 |
| PayPal | Payment processing | PCI-DSS compliant |
| Meta (Facebook/Instagram) | Publishing content per your instructions | Meta Platform Terms |
| Formspree, Inc. (United States) | Contact form message delivery — processes your name, email address, and message content submitted via our Contact page | Formspree Privacy Policy; data processed in the United States |
| Google (Gemini API) | AI content generation in AI Marketing Studio — your topic/prompt, Brand Kit details, and any uploaded product photos are sent to Google's Gemini API to generate social media content, campaigns, carousels, and product photo scenes | Google Cloud Data Processing Addendum |
| Legal authorities | Compliance with law, court orders | Only when legally required |
| Business successors | Merger, acquisition, or asset sale | Prior notice provided |
International Data Transfers
Your personal data may be processed in countries outside your country of residence, including via Google Firebase infrastructure (United States) and Formspree, Inc. (United States). Where we transfer data from the European Economic Area, we rely on Standard Contractual Clauses (SCCs) approved by the European Commission.
India (DPDP Act 2023): TwinCloudsAI is developed under Indian legal guidance. For users in India, we process personal data in accordance with India's Digital Personal Data Protection Act, 2023 and the Information Technology Act, 2000 and its applicable Rules (including the IT (Reasonable Security Practices and Procedures and Sensitive Personal Data or Information) Rules, 2011). You have the right to access, correct, and erase your personal data and to withdraw consent at any time by contacting privacy@twincloudsai.com. Cross-border transfers of Indian users' data to the United States (Google Firebase, Formspree, Google Gemini API) are made to countries notified as approved or on the basis of contractual protections.
California (CCPA/CPRA): California residents have the right to know, delete, and opt out of the sale of personal information. We do not sell personal data. To exercise your rights, contact privacy@twincloudsai.com.
Data Retention
| Data Type | Retention Period |
|---|---|
| Account & profile data | Duration of subscription + 90 days after closure |
| OAuth tokens (Meta) | Active while connected; deleted from our system immediately on disconnection |
| Meta analytics data (impressions, reach, engagement, followers) | Retained for up to 90 days for dashboard display; deleted on account closure or disconnection |
| Scheduled & published content | Active subscription + 90 days after closure |
| AI-generated content drafts | 90 days after generation or until deleted |
| AI Marketing Studio Brand Kit & generated assets (product photos, carousels, campaigns) | Active while your account is open; deleted within 90 days of account closure |
| System logs & IP addresses | 12 months, then deleted or anonymised |
| Billing & financial records | 7 years (tax & financial compliance) |
| Support communications | 3 years after ticket closure |
Your Rights
Depending on your jurisdiction, you have the following rights regarding your personal data:
Right of Access
Obtain a copy of the personal data we hold about you.
Right to Rectification
Correct inaccurate or incomplete personal data.
Right to Erasure
Request deletion of your personal data ("right to be forgotten").
Right to Restriction
Restrict certain processing activities for your data.
Data Portability
Receive your data in a machine-readable format.
Right to Object
Object to processing based on legitimate interests or for direct marketing.
CCPA rights include: right to know, right to delete, right to opt-out of sale, and right to non-discrimination. Malaysia PDPA rights include access and correction to personal data.
Security
Our Service runs on Google Firebase infrastructure. Google manages encryption of data at rest and enforces TLS encryption in transit as part of their platform — these are Google's security measures, not independently implemented by us. We implement appropriate technical and organisational measures proportionate to the risk.
OAuth 2.0 access tokens for Meta (Facebook and Instagram) connections are encrypted with AES-256 and stored securely in Firebase Firestore. Tokens are decrypted only server-side within our Cloud Functions and are never exposed to the browser or client-side code.
No system is completely secure. While we take security seriously, we cannot guarantee absolute protection of data transmitted over the Internet.
Meta Data Deletion: When you disconnect your Facebook or Instagram account from Twin-Clouds, your OAuth token is removed from our system. If you subsequently delete the Twin-Clouds app from your Meta account settings, Meta may send a data deletion request to our system. You may also submit a manual data deletion request to privacy@twincloudsai.com.
Children's Privacy
The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal data from children. If we become aware that we have inadvertently collected data from a minor, we will take steps to delete it promptly.
Changes to This Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by email or by a prominent notice on our website at least 14 days before they take effect. Your continued use of the Service after the effective date constitutes acceptance of the updated Policy.
AI Marketing Studio
AI Marketing Studio collects Brand Kit data you provide (business name, website, contact email, brand voice, logo, brand colors, and typography preferences) to personalise the content, campaigns, carousels, and product photo scenes it generates on your behalf. If you use Product Photo Studio, the product photos you upload are sent to Google's Gemini API solely to generate the requested marketing scene, as described in Section 6 (Sharing and Disclosure). Selecting a Template only records which template you used to help pre-fill an AI Studio prompt; it does not share any additional personal data. Content you save is stored in your Asset Library as part of your account data, described in Section 8 (Data Retention).
We also maintain a record of your monthly credit allowance and remaining credit balance for AI Marketing Studio, tied to your subscription plan, solely to enforce usage limits associated with your plan. This usage data is not shared with third parties except as necessary to process your subscription payment via PayPal.
Contact
For all privacy and data protection enquiries, please contact our privacy team. We are committed to responding within the required legal timeframes.
Privacy or Data Rights Request?
Our privacy team responds within 30 days of receipt.