Enterprise Privacy Policy

Last updated: February 5, 2025

At Tweelin Inc., we are committed to protecting your organization’s data and ensuring compliance with global privacy regulations. As an ISO 27001:2022 and SOC 2 compliant SaaS provider, we prioritize data security, transparency, and user control. Our privacy practices adhere to the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA), and other relevant privacy frameworks to support enterprise organizations in meeting their regulatory obligations.

This Privacy Policy describes how we collect, use, and disclose information when you or your organization uses Tweelin services. It also outlines your privacy rights and how we safeguard your data.

1. Table of Contents

1. 1. 1. Introduction
      2. Data Categories We Collect
      3. How We Use Your Data
      4. Data Processing Lifecycle
      5. Data Sharing and Subprocessors
      6. Data Security Measures
      7. International Data Transfers and Data Residency
      8. Your Privacy Rights
      9. Enterprise Compliance Support
      10. Changes to This Policy
      11. Contact Information

2. Data Categories We Collect

We collect and process different categories of data to provide and improve our services. These include:

Personal Data

Information that can identify you, such as:

• • • Name and email address
    • Contact information (phone number, organization name)

Usage Data

Automatically collected data from service usage, such as:

• • • Device details (IP address, browser type, OS)
    • Activity logs (page visits, session duration)
    • Telemetry snapshots to determine user availability

Third-Party Data

Data obtained through integrations with third-party services (e.g., Google Calendar, Microsoft Graph API), which may include basic event details for availability assessment.

3. How We Use Your Data

We use data for the following purposes:

• • • Service Delivery: To provide, maintain, and improve Tweelin’s services.
    • Account Management: To manage user registration, authentication, and access control.
    • Communication: To send important updates and respond to inquiries.
    • Security: To monitor and secure our infrastructure against unauthorized access or attacks.
    • Analytics: To analyze service usage trends and optimize features.

We adhere to the principle of data minimization by collecting and retaining only the data necessary for these purposes.

4. Data Processing Lifecycle

Our data processing lifecycle consists of the following stages:

1. Collection:

Data is collected through direct user input, telemetry snapshots, and third-party integrations.

2. Processing:

Data is processed using secure AWS services such as Lambda, DynamoDB, and NeptuneDB. Telemetry data is used to enhance productivity features without tracking detailed historical activity.

3. Storage:

Data is encrypted at rest using AWS Key Management Service (KMS) and stored in AWS regions such as US East (N. Virginia) or other regions based on customer requirements.

4. Access Control:

Strict IAM policies and multi-factor authentication (MFA) limit data access to authorized personnel only. Access logs are continuously monitored.

5. Retention and Deletion:

Data retention is governed by default policies and customizable enterprise options. User-initiated deletions trigger automated processes that remove data within 30 days, ensuring compliance with the GDPR’s “Right to be Forgotten.”

5. Data Sharing and Subprocessors

We only share data with trusted subprocessors and partners necessary to deliver and maintain our services.

Subprocessors and Vendors

Our key subprocessors include:

• • • Amazon Web Services (AWS): Cloud infrastructure
    • Google: Analytics and calendar integrations
    • Microsoft: Calendar and identity services

All subprocessors adhere to industry-leading security and privacy standards, including SOC 2 and ISO 27001 compliance.

Data Sharing Scenarios

We may share data under the following circumstances:

• • • With service providers for infrastructure, security, and analytics.
    • As required by law (e.g., in response to legal requests).
    • During business transfers (e.g., mergers or acquisitions), with prior notice to affected users.

We do not sell personal data to third parties.

6. Data Security Measures

We implement stringent security measures to protect your data:

• • • Encryption: All data is encrypted both in transit (TLS) and at rest (AWS KMS).
    • Access Controls: Role-based access control (RBAC), IAM policies, and MFA.
    • Threat Detection: Continuous monitoring through AWS GuardDuty, CloudTrail, and CloudWatch.
    • Incident Response: Procedures are in place to detect, contain, and resolve security incidents promptly.

These practices align with the AWS Well-Architected Framework Security Pillar and are regularly audited for compliance.

7. International Data Transfers and Data Residency

We process and store data primarily in the United States but offer region-specific storage options for customers with data residency requirements.

Cross-Border Transfers

For international data transfers, we comply with applicable regulations, including Standard Contractual Clauses (SCCs) under GDPR.

Data Residency Customization

Enterprise customers may request localized data storage within specific regions (e.g., EU-based servers) to meet sovereignty requirements.

8. Your Privacy Rights

Depending on your location, you have the following rights:

Under GDPR

• • • Right to Access: Obtain a copy of your data.
    • Right to Rectification: Request corrections to your data.
    • Right to Erasure: Request deletion of your data.
    • Right to Data Portability: Receive your data in a machine-readable format.
    • Right to Object: Object to data processing under certain conditions.

Under CCPA

• • • Right to Know: Understand what data we collect and how it is used.
    • Right to Delete: Request data deletion.
    • Right to Opt-Out: Opt-out of data sales (though Tweelin does not sell data).

To exercise your rights, contact us using the details in the Contact Information section.

9. Enterprise Compliance Support

For enterprise customers, we offer:

• • • Data Processing Agreements (DPAs): Formal agreements detailing privacy and security obligations.
    • Privacy and Security Support: A dedicated team for compliance inquiries.
    • Auditing Support: Access to documentation and reports for internal compliance audits.

10. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices or regulatory requirements. Significant updates will be communicated through email and in-app notifications at least 30 days in advance.

The “Last updated” date at the top of this policy indicates when the latest changes were made.

11. Contact Information

If you have any questions or wish to exercise your privacy rights, please contact us:

• • • Website: https://tweelin.com/contact-us
    • European Representative (GDPR Article 27): EDPO, Avenue Huart Hamoir 71, 1030 Brussels, Belgium
      EDPO Request Form
    • UK Representative: EDPO UK Ltd, 8 Northumberland Avenue, London WC2N 5BY, United Kingdom
      EDPO UK Request Form