Enterprise Privacy Policy

Last updated: June 22, 2026

At Tweelin Inc. (“Tweelin,” “we,” “us,” or “our”), we are committed to protecting your organization’s data and supporting compliance with applicable privacy and data-protection laws. As an enterprise SaaS provider, we design our services to support security, transparency, data minimization, and user control.

This Enterprise Privacy Policy explains how Tweelin collects, uses, processes, discloses, retains, and protects personal data when customers and authorized users access or use Tweelin’s enterprise services, including Tweelin for Microsoft Teams, the Tweelin Telemetry Agent, mobile applications, integrations, and related services.

Where Tweelin processes personal data on behalf of an enterprise customer, Tweelin generally acts as a processor or service provider, and the customer acts as the controller or business. Where Tweelin processes personal data for its own account administration, security, compliance, support, billing, or business purposes, Tweelin may act as a controller.

1. Data Categories We Collect

We collect and process only the personal data reasonably necessary to provide, secure, support, and improve the Tweelin service.

Personal and account data

This may include:

• • • Name
    • Business email address
    • Business phone number, if provided
    • Organization name
    • Job title or role, if provided
    • Account, authentication, and access-control information

Service usage and technical data

This may include:

• • • IP address
    • Browser type
    • Operating system
    • Device and application information
    • Log data
    • Session information
    • Usage events
    • Activity logs
    • Diagnostic and security logs

Availability and telemetry data

Tweelin may process limited telemetry snapshots and availability-related signals to determine whether users may be available for timely collaboration. Tweelin uses this data to enable core service functionality and does not use telemetry snapshots to create unnecessary detailed historical activity profiles.

Integration data

When customers enable third-party integrations, Tweelin may process data received from connected services such as Microsoft Graph, Microsoft Teams, Google Calendar, identity providers, or other enterprise systems. This may include basic user, calendar, identity, meeting, and availability-related information needed to provide the service.

2. How We Use Personal Data

Tweelin uses personal data for the following purposes:

• • • Service delivery: to provide, operate, maintain, and improve the Tweelin service.
    • Account management: to manage user registration, authentication, authorization, and access control.
    • Availability and collaboration features: to identify appropriate moments and channels for timely collaboration.
    • Customer support: to respond to support requests and resolve technical issues.
    • Security: to protect users, customers, systems, and data from unauthorized access, abuse, fraud, or security threats.
    • Analytics and service improvement: to understand usage patterns, troubleshoot issues, and improve performance, reliability, and functionality.
    • Administrative communications: to send service notices, security updates, and other non-marketing communications.
    • Compliance: to comply with legal, regulatory, contractual, audit, tax, and security obligations.
    • Optional marketing: to send product updates, newsletters, event invitations, or promotional communications where permitted by law and, where required, with consent.

3. Lawful Bases for Processing

Where Tweelin acts as a controller and the GDPR or UK GDPR applies, we process personal data under the following lawful bases:

• • • Performance of a contract: to deliver, manage, support, and administer the Tweelin service and user accounts.
    • Legitimate interests: to secure our platform, prevent abuse, troubleshoot issues, analyze and improve the service, support enterprise customers, and communicate about relevant service matters, balanced against the rights and interests of individuals.
    • Consent: for optional marketing communications, non-essential cookies, or other processing activities where consent is required. You may withdraw consent at any time.
    • Legal obligation: to comply with applicable laws, tax obligations, accounting requirements, legal processes, regulatory requests, and lawful government requests.

Where Tweelin acts as a processor or service provider on behalf of an enterprise customer, the customer is responsible for identifying the lawful basis for processing personal data, and Tweelin processes the data according to the customer’s instructions and applicable agreements.

4. Data Processing Lifecycle

Collection

Data is collected through direct user input, customer configuration, telemetry snapshots, system logs, and third-party integrations authorized by customers or users.

Processing

Data is processed to provide the Tweelin service, including availability assessment, collaboration routing, account management, system security, support, analytics, and compliance.

Storage

Tweelin stores data using secure cloud infrastructure, including AWS services such as Lambda, DynamoDB, NeptuneDB, and related infrastructure services. Data may be stored in AWS regions such as US East (N. Virginia) or other regions based on customer requirements and contractual commitments.

Access control

Access to personal data is limited to authorized personnel and service providers with a business need to access the data. Tweelin uses access controls such as role-based access control, IAM policies, and multi-factor authentication.

Retention and deletion

Tweelin retains personal data only for as long as necessary for the purposes described in this policy, unless a longer retention period is required or permitted by law, contract, audit, security, or legitimate business needs.

Unless otherwise agreed with a customer:

• • • Account data is retained for the life of the account and for up to 90 days after account closure.
    • Activity, security, diagnostic, and telemetry logs are retained for up to 12 months.
    • User-initiated deletion requests are completed within 30 days, unless retention is required by law, security, fraud prevention, dispute resolution, backup integrity, or contractual obligation.
    • Data that is no longer required is deleted, anonymized, or aggregated.

Backup copies may persist for a limited period according to Tweelin’s backup and disaster-recovery practices, after which they are overwritten or deleted according to standard retention schedules.

5. Data Sharing and Subprocessors

Tweelin does not sell personal data.

We may share personal data with trusted service providers, subprocessors, and partners only as necessary to provide, secure, maintain, support, and improve the service.

Subprocessors and vendors

Tweelin’s key subprocessors and vendors may include:

• • • Amazon Web Services (AWS) for cloud infrastructure
    • Microsoft for identity, Microsoft Teams, calendar, and Microsoft Graph integrations
    • Google for calendar integrations and analytics-related services, where applicable
    • Email, support, analytics, security, and operational vendors used to operate the business

Tweelin requires subprocessors to protect personal data through contractual commitments and appropriate security and privacy measures. A current subprocessor list may be made available to enterprise customers upon request or through applicable customer agreements.

Data sharing scenarios

Tweelin may disclose personal data:

• • • To service providers and subprocessors that support our services
    • To enterprise customers and administrators as needed to provide and manage the service
    • To comply with applicable law, legal process, or lawful government requests
    • To protect the rights, safety, and security of Tweelin, our customers, users, and systems
    • In connection with a merger, acquisition, financing, reorganization, or sale of assets, subject to appropriate notice and safeguards where required

6. Data Security Measures

Tweelin implements technical and organizational measures designed to protect personal data, including:

• • • Encryption in transit using TLS
    • Encryption at rest using AWS KMS or equivalent controls
    • Role-based access controls
    • IAM policies
    • Multi-factor authentication
    • Security logging and monitoring
    • Threat detection using tools such as AWS GuardDuty, CloudTrail, and CloudWatch
    • Incident response procedures
    • Vendor and subprocessor review
    • Internal access reviews
    • Security and compliance documentation for enterprise customers

No method of transmission or storage is completely secure, but Tweelin is committed to maintaining a security program designed to protect personal data against unauthorized access, disclosure, alteration, and destruction.

7. International Data Transfers and Data Residency

Tweelin is based in the United States and may process and store personal data in the United States and other jurisdictions where Tweelin or its subprocessors operate.

Where personal data is transferred internationally, Tweelin uses appropriate safeguards as required by applicable law, which may include Standard Contractual Clauses, the UK International Data Transfer Addendum, adequacy mechanisms, data-processing agreements, and other lawful transfer mechanisms.

Enterprise customers may request region-specific storage or data-residency options where available and commercially agreed.

8. Your Privacy Rights

Depending on your location and applicable law, you may have privacy rights regarding your personal data.

GDPR and UK GDPR rights

Where the GDPR or UK GDPR applies, you may have the following rights:

• • • Right of access: to request a copy of the personal data we process about you.
    • Right to rectification: to request correction of inaccurate or incomplete personal data.
    • Right to erasure: to request deletion of your personal data in certain circumstances.
    • Right to restrict processing: to ask us to limit how we use your personal data in certain circumstances.
    • Right to data portability: to receive your personal data in a structured, commonly used, machine-readable format where applicable.
    • Right to object: to object to certain processing based on legitimate interests or direct marketing.
    • Right to withdraw consent: where we rely on consent, you may withdraw it at any time without affecting the lawfulness of processing before withdrawal.
    • Rights related to automated decision-making: to exercise rights regarding decisions based solely on automated processing where applicable.

California privacy rights

If you are a California resident, you may have rights under California privacy laws, including the right to:

• • • Know what personal information we collect, use, disclose, sell, or share
    • Access personal information
    • Delete personal information
    • Correct inaccurate personal information
    • Opt out of the sale or sharing of personal information, where applicable
    • Limit the use and disclosure of sensitive personal information, where applicable
    • Not be discriminated against for exercising privacy rights

Tweelin does not sell personal data. If Tweelin uses technologies that may constitute “sharing” under California law, we will provide applicable notices and choices.

Exercising your rights

To exercise your rights, contact us at privacy@tweelin.com or through the contact details below. If you are an authorized user of an enterprise customer, we may refer your request to the customer that controls your account or process the request according to the customer’s instructions.

We may need to verify your identity before fulfilling a request. We will respond within the time required by applicable law.

9. Right to Complain

You have the right to lodge a complaint with a data-protection supervisory authority.

In the European Union, you may contact your local data-protection authority. The European Data Protection Board provides a list of EU supervisory authorities.

In the United Kingdom, you may contact the Information Commissioner’s Office (ICO). The ICO can be reached through its website or by phone at 0303 123 1113.

You may also contact our EU or UK representative listed below.

10. Enterprise Compliance Support

For enterprise customers, Tweelin may provide:

• • • Data Processing Agreements
    • Security and privacy documentation
    • Subprocessor information
    • Audit-support documentation
    • Compliance questionnaires
    • Security certifications and reports, where available and subject to appropriate confidentiality commitments

11. Changes to This Policy

We may update this Enterprise Privacy Policy from time to time to reflect changes in our services, legal requirements, or privacy practices.

If we make material changes, we will provide notice through appropriate channels, such as email, in-app notice, customer notification, or website notice. The “Last updated” date indicates when this policy was most recently revised.

12. Contact Information

If you have questions about this Enterprise Privacy Policy or wish to exercise your privacy rights, please contact us:

• • • Privacy and data-protection contact: https://tweelin.com/contact-us
    • Data Protection Officer: Tweelin Inc. has appointed a Data Protection Officer who can be contacted for any privacy or data-protection matter at https://tweelin.com/contact-us.
    • Website: Tweelin contact page
    • European Representative (GDPR Article 27): EDPO, Avenue Huart Hamoir 71, 1030 Brussels, Belgium
    • European Representative request form: EDPO Request Form
    • UK Representative: EDPO UK Ltd, 8 Northumberland Avenue, London WC2N 5BY, United Kingdom
    • UK Representative request form: EDPO UK Request Form