How we handle your personal data.

AI Twin Ltd is a private limited company registered in Scotland (company number SC866947) and is the data controller for personal data collected through ai-twin.co.uk.

You can contact us about anything in this notice by email at hello@ai-twin.co.uk.

If you join our waitlist, we collect: your name, your email address, your country (as you select it on the form), and a record of whether you opted in to receive product updates from us by email.

If you contact us by email, we hold a copy of that correspondence for as long as the matter is open and for a reasonable period after it is resolved.

We do not collect special category data through the website. We do not collect children's data; the service is for adults only.

If you visit the website without interacting with any form, our analytics provider (Plausible) records aggregate, non-identifying information about your visit to help us understand how the site is used. This does not identify you personally.

We process your name, email, and country under the lawful basis of consent (UK GDPR Article 6(1)(a)) for the specific purpose of contacting you about AI Twin's launch and product updates if you opted in.

We process correspondence you send us under the lawful basis of legitimate interests (UK GDPR Article 6(1)(f)) for the purpose of responding to your message and keeping a reasonable record of business communication.

We process aggregate analytics under the lawful basis of legitimate interests (UK GDPR Article 6(1)(f)) for the purpose of understanding website performance. This processing involves no identification of individual visitors.

Waitlist data is held until you ask us to remove it or for two years after the AI Twin product launches, whichever is shorter. After that, we delete or anonymise it.

Email correspondence is held for two years after the matter is resolved, then deleted.

Aggregate analytics is retained by our processor (Plausible) for a maximum of 24 months.

If you withdraw consent at any point, we delete the relevant data within 30 days of your request, except where we are required to retain it for a legal obligation.

We do not sell, rent, or license your personal data to anyone.

We share your data only with the following service providers, each of whom acts as our data processor under written contract:

• Email service: Brevo (Sendinblue SAS, Paris, France). Used to send waitlist communications. Data is held in the European Union.
• Database hosting: Supabase. Used to store waitlist and contact records. Data is held in the European Union.
• Website hosting: Cloudflare and Lovable. Used to serve the website itself.
• Analytics: Plausible (Plausible Insights OÜ, Estonia). Privacy-friendly aggregate analytics.
• LLM provider for product features (not the website): Anthropic via the European Union region.

Our full, public list of every sub-processor we use, with regions and DPA status, is at /sub-processors.

We disclose personal data outside of these processors only when required by law.

Your personal data is held in the European Union. We do not routinely transfer personal data outside the EU or UK.

Where we use service providers that may process data outside these regions, transfers take place under appropriate safeguards as required by UK GDPR, including standard contractual clauses or under adequacy decisions where they apply.

Under UK GDPR you have the following rights regarding your personal data:

• The right to be informed about how we process your data (this notice).
• The right of access. You can ask us for a copy of all personal data we hold about you.
• The right to rectification. You can ask us to correct data that is inaccurate or incomplete.
• The right to erasure. You can ask us to delete your data, subject to limited exceptions.
• The right to restriction. You can ask us to limit how we use your data while a question about it is resolved.
• The right to data portability. You can ask us to provide your data in a structured, machine-readable format.
• The right to object. You can object to processing based on legitimate interests.
• The right to withdraw consent. Where we process your data on the basis of consent, you can withdraw that consent at any time.
• The right not to be subject to automated decision-making with significant effects on you.

To exercise any of these rights, email us at hello@ai-twin.co.uk. We respond within one month, with the option to extend by two further months for complex requests. We will tell you if we need an extension.

If you have a concern about how we are handling your personal data, please tell us first by emailing hello@ai-twin.co.uk. We acknowledge complaints within 30 days and respond without undue delay.

If you remain dissatisfied, you have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator. Their contact details are at ico.org.uk.

We update this notice when our processing changes or when UK data protection law changes in ways that affect how we hold your data. The last-updated date at the top of this page reflects the most recent change.

For material changes (e.g. a new category of data we collect, a new processor we use, or a change in lawful basis), we will email everyone on our waitlist before the change takes effect.