Privacy PolicyAt Twin Tone Inc. ("Twin Tone," "we," "us," or "our"), the privacy of our users and visitors is very important to us. This Privacy Policy describes the types of personal information we collect when you use our platform, websites, and services, and how we use, share, and protect that information.
In this Privacy Policy, "Services" means our AI-powered livestreaming platform available at live.twintone.ai and www.twintone.ai (collectively, the "Site"), including AI stream host configuration, product catalog integration, multi-platform broadcasting, analytics, and related features. "Brand" means a business or organization that subscribes to and uses the Services. "Personal Information" means information that identifies, relates to, describes, or can reasonably be linked to an identified or identifiable natural person. Business contact information (such as a company name, work email, or billing address) is collected and processed as account data but is not treated as Personal Information except where required by applicable law. By accessing or using the Services, you accept this Privacy Policy. If you do not agree with these terms, please do not use the Services.
1. Information We Collect
We collect the following categories of information:
Account Information. When you create an account, we collect your name, email address, and authentication credentials. If you invite team members, we collect their names and email addresses as well.
Brand Profile Information. When you configure your AI stream host, we collect brand assets you provide, including your brand name, logo, tagline, website URL, brand colors, and product catalog data synced from connected e-commerce platforms (such as Shopify).
E-Commerce Integration Data. When you connect a Shopify store (or other supported e-commerce platform) via OAuth, we receive an access token and read product data including product titles, descriptions, images, pricing, variants, and inventory quantities. We use read-only API scopes and do not modify your store data without your explicit action. Access tokens are encrypted at the application layer using AES-256-GCM before database storage.
Platform Connection Data. When you connect social media platforms (YouTube, TikTok, Facebook, Instagram, Kick) via our integration partner (Composio), we receive connection status and account identifiers. We do not store your social media passwords. OAuth tokens for these platforms are managed by Composio and are subject to their respective privacy policies.
Stream and Usage Data. We collect information about your use of the Services, including stream configurations, broadcast schedules, AI host scripts, and API calls made through our API. We log stream lifecycle events (start, stop, health checks) for operational monitoring. During a live stream, the AI Stream Host generates chat responses based on viewer messages received from the Connected Platform's API. These chat interactions are processed in real time by our AI models to generate responses; raw chat messages may be temporarily stored for the duration of the stream for moderation and quality purposes, and are deleted within 90 days. We do not collect or store identifiable viewer information directly; viewer data originates from and remains primarily on the Connected Platform. The Brand is the controller of viewer and chat data originating from its Connected Platform accounts; Twin Tone acts as a processor on the Brand's behalf for stream-related processing. Twin Tone acts as a controller for its own purposes including security, fraud prevention, service-level analytics, and product improvement, using only de-identified or aggregate data for those independent purposes. Brands are responsible for complying with data-subject requests from viewers on their Connected Platform accounts.
Payment Information. Subscription payments are processed by Stripe. We do not store full credit card numbers. Stripe handles all payment card data in accordance with PCI-DSS standards. We retain billing records, invoice history, and subscription status.
Analytics Events. We collect analytics events related to stream performance, viewer engagement, product clicks, and conversion metrics to provide you with insights and improve our Services.
Usage Logs and Device Information. We automatically collect IP addresses, browser type, device identifiers, access times, and pages visited using cookies and similar technologies (see "Cookies" below).
2. How We Use Your Information
We use your Personal Information to:
• Provide, operate, and maintain the Services, including AI stream host configuration, multi-platform broadcasting, and product catalog synchronization;
• Process subscription payments and manage your account;
• Generate AI stream host scripts and responses based on your brand profile and product data;
• Broadcast live streams to your connected social media platforms;
• Provide analytics, performance metrics, and reporting on your streams;
• Communicate with you about your account, service updates, and support requests;
• Monitor and improve the quality, safety, and reliability of the Services;
• Detect, prevent, and address fraud, abuse, and technical issues;
• Comply with applicable legal obligations.
We do not sell your Personal Information to third parties.
3. How We Share Your Information
We may share your information with:
Service Providers and Processors. We use third-party providers to deliver the Services. The following act as processors or service providers processing data on our behalf under contractual obligations: Stripe (payment processing), Supabase (database and authentication), Google Cloud Platform (AI model inference and infrastructure), LiveKit (real-time video infrastructure), Tavus (AI avatar rendering), Composio (social platform connections), and Vercel (web hosting). When you disconnect an e-commerce or social platform, we delete the associated OAuth token from our database within 30 days, except where retention is required for legal compliance. Composio may retain its own copies of OAuth tokens subject to Composio's retention policy.
Google Analytics (Independent Controller). We use Google Analytics on our marketing Site to understand visitor behavior. Google Analytics is operated by Google as an independent controller for its own purposes, including improving Google's services. Google collects IP addresses, device identifiers, and browsing data subject to Google's privacy policy. We configure Google Analytics in a privacy-conscious manner and do not enable advertising features. For EEA/UK visitors, we use Google Consent Mode to adjust tracking based on consent signals. You may opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on.
Connected Platforms. When you broadcast a stream, your AI stream host's output (video, audio, chat messages) is transmitted to the social media platforms you have connected (YouTube, TikTok, Facebook, Instagram, Kick). These platforms process viewer data and stream content under their own terms of service and privacy policies.
Legal Compliance. We may disclose information when required by law, court order, or governmental authority, or to protect the rights, property, or safety of Twin Tone, our users, or others.
Business Transfers. In the event of a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction, subject to the protections of this Privacy Policy.
4. Data Storage and Security
Your data is stored on Supabase (PostgreSQL) hosted in the United States (us-east-1), with infrastructure on Google Cloud Platform and Vercel. Data is encrypted in transit using TLS and at rest using provider-managed encryption. OAuth tokens for e-commerce platforms are additionally encrypted at the application layer using AES-256-GCM before being stored in the database. Access to production systems is logged and restricted to authorized personnel. While we follow industry-standard security practices, no method of transmission or storage is 100% secure, and we cannot guarantee absolute security.
5. AI Processing and Your Brand Data
The Services use AI models (including large language models) to generate stream host scripts, chat responses, and product descriptions based on your brand profile and product catalog. Your brand data (product names, descriptions, images, pricing) is processed by these models to produce contextually relevant stream content. We do not use your brand data to train AI models for use by other customers. Your product catalog data is used solely to generate content for your streams and is not shared across customer accounts.
6. Cookies and Tracking Technologies
We use cookies and similar technologies to maintain authentication sessions, remember preferences, and collect usage analytics. We use Google Analytics on our marketing Site. Google Analytics collects IP addresses, device identifiers, and browsing data. Google operates as an independent controller for its own purposes in addition to processing data on our behalf. For EEA/UK visitors, we use Google Consent Mode so that analytics tracking adjusts based on consent signals from the visitor's browser or cookie preferences. You can control cookies through your browser settings and may opt out of Google Analytics by installing the Google Analytics Opt-out Browser Add-on. Disabling cookies may limit some functionality of the Services. We do not use cookies for cross-context behavioral advertising.
7. Your Rights
Depending on your jurisdiction, you may have the right to:
• Access the Personal Information we hold about you;
• Request correction of inaccurate Personal Information;
• Request deletion of your Personal Information (subject to legal retention requirements);
• Export your data in a portable format;
• Object to or restrict certain processing of your data;
• Withdraw consent for processing that relies on consent.
To exercise any of these rights, contact us at privacy@twintone.ai. We will respond within 30 days. We may need to verify your identity before processing your request.
8. Data Retention
We retain your Personal Information for as long as your account is active. Upon account deletion, we remove your account information and brand profile data from our primary database within 30 days. Raw stream chat messages temporarily stored during live streams are deleted within 90 days. Raw analytics events (including IP addresses and device identifiers) are retained for 12 months, after which they are aggregated and de-identified by removing direct identifiers and hashing IP addresses. Aggregated, de-identified analytics data may be retained indefinitely as it can no longer be linked to you. OAuth tokens for disconnected platforms are deleted from our database within 30 days of disconnection. Deletion requests are propagated to our primary database (Supabase); data retained by third-party processors (GCP, Vercel, LiveKit, Tavus, Composio) is subject to their respective retention and deletion policies, and we will instruct them to delete data upon your request. Backups of our primary database may retain deleted data for up to 30 additional days before permanent removal. Where retention is required for legal compliance, dispute resolution, or to enforce our agreements, we may retain data beyond these periods as permitted by applicable law.
Shopify Store Data. When a merchant uninstalls the TwinTone app from their Shopify store, or when Shopify sends a shop redaction request, we delete all store data (OAuth tokens, product catalog data, store connection records) from our database within 48 hours. When a merchant requests deletion of customer data through Shopify's privacy webhooks (customers/redact), we purge any associated customer data within 30 days. When a merchant requests customer data through Shopify's data request webhook (customers/data_request), we provide a report of stored data within 30 days. These timeframes comply with Shopify's App Store requirements and supersede the general retention periods above for Shopify-sourced data.
9. International Data Transfers
If you access the Services from outside the United States, your data will be processed and stored in the United States. By using the Services, you consent to the transfer of your data to the United States and to its processing there. We take steps to ensure appropriate safeguards are in place for international data transfers, including with service providers who offer Standard Contractual Clauses or equivalent protections where applicable.
10. Children's Privacy
The Services are intended for business use and are not directed to individuals under 18 years of age. We do not knowingly collect Personal Information from children. If you believe a child has provided Personal Information, contact us immediately and we will take steps to delete it.
11. Your California Privacy Rights
If you are a California resident, you may have rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA), including the right to know what Personal Information is collected, the right to delete, the right to correct, and the right to opt out of the sale or sharing of Personal Information. We do not sell your Personal Information. We share Personal Information with service providers and processors (Stripe, Supabase, Google Cloud Platform, LiveKit, Tavus, Composio, Vercel) under contractual obligations that restrict their use of the data to providing services on our behalf. These disclosures qualify as exemptions under the CCPA/CPRA service-provider exception and do not constitute "sale" or "sharing." Google Analytics operates as an independent controller and may use data for its own purposes; we do not control Google's independent processing. No opt-out mechanism is required on our part because we do not engage in covered sale or sharing. You may opt out of Google Analytics directly via Google's tools. To exercise your rights, contact us at privacy@twintone.ai.
12. European Union and UK Privacy Rights
If you are located in the European Economic Area (EEA) or the United Kingdom, you have rights under the General Data Protection Regulation (GDPR), including the right to access, rectify, erase, restrict processing, data portability, and object to processing. You also have the right to withdraw consent at any time. To exercise these rights, contact us at privacy@twintone.ai. You may lodge a complaint with your local data protection authority.
Controller and Processor Roles by Activity. Twin Tone acts as a data controller for: account management, billing, security monitoring, fraud prevention, service-level analytics, and product improvement (using de-identified or aggregate data). The Brand acts as a data controller for viewer data, chat interactions, and analytics data originating from its Connected Platform accounts. Twin Tone acts as a processor on the Brand's behalf for stream-related processing (AI host generation, chat response, broadcasting). A Data Processing Addendum (DPA) is available to all customers upon request; enterprise customers receive a DPA as part of their agreement.
Lawful Bases for Processing. We rely on the following lawful bases under the GDPR: (a) performance of a contract — processing your account data, brand profile, product catalog, and stream configurations to provide the Services; (b) legal obligation — retaining billing records, complying with regulatory requests, and maintaining security logs; (c) legitimate interests — monitoring service quality, preventing fraud, and improving our platform using de-identified data (subject to your right to object); (d) consent — for Google Analytics tracking and any optional features that require it. Connecting a social platform is part of contract performance and does not require separate consent. You may withdraw consent for Google Analytics and optional features at any time without affecting the lawfulness of processing already carried out.
International Transfers. Your data is processed and stored in the United States. For transfers from the EEA/UK, we rely on Standard Contractual Clauses (SCCs) or equivalent transfer mechanisms with our service providers. By using the Services, you acknowledge that your data may be transferred to the United States under these safeguards.
Data Protection Contact. For GDPR-related inquiries or to exercise your rights, contact our Privacy Officer at privacy@twintone.ai. We have not appointed an EU/UK Article 27 representative; EEA/UK residents may contact us directly or through their supervisory authority.
13. Do Not Track
We do not currently respond to "Do Not Track" signals as no universal standard has been established. We monitor industry developments and may implement a response in the future.
14. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. We will notify you of material changes by posting the updated policy on the Site and, where appropriate, by email. Your continued use of the Services after the effective date constitutes acceptance of the updated Privacy Policy. We encourage you to review this page periodically.
15. Contact Us
If you have questions or concerns about this Privacy Policy or our data practices, contact us at:
Twin Tone Inc.
1111b South Governors Avenue, Dover, Delaware, USA 19904
privacy@twintone.ai