How we handle your personal data.

AI Twin Ltd is a private limited company registered in Scotland (company number SC866947) and is the data controller for personal data collected through ai-twin.co.uk.

You can contact us about anything in this notice by email at hello@ai-twin.co.uk.

If you join our newsletter, we collect your email address and which language edition of the site you used. That is all. We do not ask for your name.

We previously ran a waitlist. If you joined it, we still hold what you gave us then: your name, your email address, the country you selected, and whether you opted in to product updates. We have not added those records to the newsletter. We will use them only to tell you when sign-in opens, which is what you signed up for. You can ask us to delete them at any time.

If you contact us by email, we hold a copy of that correspondence for as long as the matter is open and for a reasonable period after it is resolved.

We do not collect special category data through the website. We do not collect children's data; the service is for adults only.

If you visit the website without interacting with any form, our analytics provider (Plausible) records aggregate, non-identifying information about your visit to help us understand how the site is used. This does not identify you personally.

Alongside what you type, our forms record a little technical detail, and we would rather set it out than leave it implied. The newsletter form, the feedback form, the support form and the build-support form record the user-agent string your browser sends. The build-support form also records the page you arrived from. The feedback form and the language vote also record the country your connection appears to be in, which our network provider derives from your IP address. Your IP address itself is not stored. The newsletter form records which language edition of the site you used. If you leave an email with the language vote, that creates a newsletter entry, and the newsletter detail applies to it.

The language vote itself records no browser detail and nothing that identifies you: the languages you picked, anything you typed in the missing-language box, the country, and the date.

We keep this to spot abuse of the forms and to understand where interest is coming from. To stop the forms being abused, we hold a one-way hash of your IP address against each form for up to 24 hours, then delete it. The address itself is not stored.

We process your name, email, and country under the lawful basis of consent (UK GDPR Article 6(1)(a)) for the specific purpose of contacting you about AI Twin's launch and product updates if you opted in.

We process correspondence you send us under the lawful basis of legitimate interests (UK GDPR Article 6(1)(f)) for the purpose of responding to your message and keeping a reasonable record of business communication.

We process aggregate analytics under the lawful basis of legitimate interests (UK GDPR Article 6(1)(f)) for the purpose of understanding website performance. This processing involves no identification of individual visitors.

Waitlist data is held until you ask us to remove it or for two years after the AI Twin product launches, whichever is shorter. After that, we delete or anonymise it.

Email correspondence is held for two years after the matter is resolved, then deleted.

Aggregate analytics is retained by our processor (Plausible) for a maximum of 24 months.

If you withdraw consent at any point, we delete the relevant data within 30 days of your request, except where we are required to retain it for a legal obligation.

We do not sell, rent, or license your personal data to anyone.

We share your data only with the following service providers, each of whom acts as our data processor under written contract:

• Email service: Brevo (Sendinblue SAS, Paris, France). Used to send waitlist communications. Data is held in the European Union.
• Database hosting: Supabase. Used to store waitlist and contact records. Data is held in the European Union.
• Website hosting: Cloudflare and Lovable. Used to serve the website itself.
• Analytics: Plausible (Plausible Insights OÜ, Estonia). Privacy-friendly aggregate analytics.
• LLM provider for product features (not the website): Anthropic via the European Union region.

Our full, public list of every sub-processor we use, with regions and DPA status, is at /sub-processors.

The on-device demo on our homepage downloads an embedding model (about 22MB) from Hugging Face and the supporting runtime from a public content delivery network (jsDelivr) on first use. These downloads transfer public, static files to your browser. No personal data is sent in either direction. See /sub-processors for the detail.

We disclose personal data outside of these processors only when required by law.

Your personal data is held in the European Union. We do not routinely transfer personal data outside the EU or UK.

Where we use service providers that may process data outside these regions, transfers take place under appropriate safeguards as required by UK GDPR, including standard contractual clauses or under adequacy decisions where they apply.

Under UK GDPR you have the following rights regarding your personal data:

• The right to be informed about how we process your data (this notice).
• The right of access. You can ask us for a copy of all personal data we hold about you.
• The right to rectification. You can ask us to correct data that is inaccurate or incomplete.
• The right to erasure. You can ask us to delete your data, subject to limited exceptions.
• The right to restriction. You can ask us to limit how we use your data while a question about it is resolved.
• The right to data portability. You can ask us to provide your data in a structured, machine-readable format.
• The right to object. You can object to processing based on legitimate interests.
• The right to withdraw consent. Where we process your data on the basis of consent, you can withdraw that consent at any time.
• The right not to be subject to automated decision-making with significant effects on you.

To exercise any of these rights, email us at hello@ai-twin.co.uk. We respond within one month, with the option to extend by two further months for complex requests. We will tell you if we need an extension.

If you have a concern about how we are handling your personal data, please tell us first by emailing hello@ai-twin.co.uk. We acknowledge complaints within 30 days and respond without undue delay.

If you remain dissatisfied, you have the right to complain to the Information Commissioner's Office (ICO), the UK's data protection regulator. Their contact details are at ico.org.uk.

We update this notice when our processing changes or when UK data protection law changes in ways that affect how we hold your data. The last-updated date at the top of this page reflects the most recent change.

For material changes (e.g. a new category of data we collect, a new processor we use, or a change in lawful basis), we will email everyone on our waitlist before the change takes effect.