Privacy Policy

This Privacy Policy explains how TwinCrew (“TwinCrew,” “we,” “us”) collects, uses, shares, and protects information when you use our website at twincrewlabs.com and our application (the “Service”). TwinCrew generates AI customer personas from data you connect and provides an AI team that acts on those personas. By using the Service, you agree to this Policy.

Information we collect

We collect the following categories of information:

• Account information. When you sign up, our authentication provider (Clerk) collects your name, email address, and organization details so we can create and secure your account.
• Data from sources you connect. When you connect a data source, we access the data you authorize — for example analytics and audience data (Google Analytics 4, Google Tag Manager), CRM contacts, companies, and deals (HubSpot, Salesforce), orders and customers (Shopify), email engagement (Klaviyo), revenue signals (Stripe), audience and content data (YouTube), and competitive traffic estimates (Similarweb). We request read-only access wherever the provider offers it.
• Content you create. Personas, projects, chat messages, briefs, surveys, and other content you generate or upload (including CSV files) within the Service.
• Usage and device data. Log data, IP address, browser type, and how you interact with the Service, used to operate, secure, and improve it.
• Payment information. If you subscribe to a paid plan, our payment processor (Stripe) handles your payment details. We do not store full card numbers.

How we use information

• To generate, enrich, and update customer personas and power the AI crew (user stories, campaigns, briefs).
• To provide, maintain, secure, and improve the Service.
• To communicate with you about your account, updates, and support requests.
• To meter usage, enforce plan limits, and process payments.
• To comply with legal obligations and enforce our terms.

AI processing

To generate personas, briefs, and chat responses, we send relevant data to large language model providers — Anthropic and OpenAI — which process it solely to return results to us. We do not permit these providers to use your data to train their models. AI-generated output may be inaccurate and should be reviewed before you rely on it.

How we share information

We do not sell your personal information. We share it only with service providers who process it on our behalf to run the Service, under contracts that require them to protect it:

• Anthropic, OpenAI — AI model processing.
• Clerk — authentication and account management.
• Vercel, Railway, Neon — application hosting, backend services, and database.
• Stripe — payment processing.
• Resend — transactional email delivery.

We may also disclose information if required by law, to protect our rights or users’ safety, or in connection with a merger, acquisition, or sale of assets.

Connected integrations and access tokens

When you connect a third-party source, we store the resulting access and refresh tokens encrypted at rest. We use these tokens only to sync the data needed to build your personas. You can disconnect any source at any time from the Integrations page, which removes our stored credentials for that source.

Data retention

We retain your information for as long as your account is active or as needed to provide the Service. When you delete a data source, project, or your account, we delete the associated data within a reasonable period, except where retention is required by law.

Security

We protect your data with encryption in transit (TLS) and encryption at rest for sensitive credentials, scoped per-organization access controls, and least-privilege integration scopes. No method of transmission or storage is completely secure, but we work to protect your information using industry-standard measures.

Your rights

Depending on where you live, you may have the right to access, correct, export, or delete your personal information, and to object to or restrict certain processing (including under the GDPR and CCPA). To exercise these rights, contact us at privacy@twincrewlabs.com. You may also disconnect integrations and delete content directly within the Service.

International transfers

We operate in and use service providers located in the United States and other countries. Where we transfer data internationally, we rely on appropriate safeguards for that transfer.

Children’s privacy

The Service is not directed to children under 16, and we do not knowingly collect their personal information.

Changes to this Policy

We may update this Policy from time to time. When we make material changes, we will update the “Last updated” date above and, where appropriate, notify you.

Contact us

Questions about this Policy or your data? Email us at privacy@twincrewlabs.com.