Data protection

This is the formal notice: who is responsible for your data, what is processed and why, on what legal ground, who receives it, how long it stays, and what you can ask of us. It is the disclosure that Turkey's data protection law (KVKK, Article 10) and the EU's GDPR (Articles 13 and 14) require, in plain words. The privacy page says the same things in a friendlier order.

Who is responsible

The data controller is itwin.co, Istanbul, Turkey. For anything about your data, write to hello@itwin.co.

What is processed, and why

Each item below says what we hold, what it is for, and the legal ground. The grounds come from KVKK Article 5 and GDPR Article 6: the contract with you, a legal obligation, our legitimate interest, or your consent.

Your account

Your email address or phone number, your name and email address from Google or Apple if you sign in with them, a one-way fingerprint of the phone number, sign-in codes (hashed), session identifiers, and a record of when you accepted the terms, with a hash of the address you accepted from.

For signing you in, keeping the account safe, reaching you about it, and showing that you agreed. Ground: the contract with you; for the record of consent, our legal obligation.

Your profile and your twin

Your first and last name, birth year, country, username, photo, tagline, answers, About sections, links and settings. For a business, its name, kind, logo and the items it lists.

This is the product. Your page and your twin's answers are made from it. Your birth year is used once, to check that you are 18 or over. Ground: the contract with you; for the age check, our legal obligation and our legitimate interest in keeping minors off.

Chats

Messages visitors send to your twin and the twin's replies, with email addresses, phone numbers and handles removed; the visitor's name when they chose to chat as themselves; a session identifier; and the list of questions your twin could not answer.

For answering, for letting the owner read what their twin was asked, and for safety. Ground: for the visitor, performing the service they asked for; for the owner, the contract. Keeping chats for 30 days rests on our legitimate interest in safety and in letting owners see what their twin says in their name.

Memory notes

A short note a twin keeps about a visitor who asked it to, or who is connected with the owner. Written from what the visitor said, readable and deletable by both sides.

Ground: the visitor's consent, which they can withdraw at any time by deleting the note or turning memory off.

Connections and contact fingerprints

Who is connected with whom, requests sent and received, and when. When you import contacts, the fingerprints of the numbers, which are compared and then discarded.

For finding and connecting with people you know. Ground: the contract with you. Fingerprints are processed only when you choose to import, and the result is shown to you alone.

Technical logs

The time, the page, the outcome, and a key derived from your network address that changes every day, so limits can apply without the address being kept. Request logs at the hosting provider for a short window.

For keeping the service running and stopping abuse. Ground: our legitimate interest.

Messages you send us

When you use the contact form, write to us, or report a twin: your name, your email address and what you wrote.

For answering you and acting on reports. Ground: our legitimate interest in answering, and for reports, our legal obligation to act on them.

Where it comes from

Almost all of it comes from you. Chats come from visitors. Connection requests come from other owners. Contact fingerprints are made on your own device. A visitor's name reaches an owner's chat list because the visitor chose to chat as themselves. Nothing comes from data brokers or from public sources, and your twin learns nothing from the web.

Automated decisions

No decision with a legal or similar effect on you is made automatically. The twin is an AI that writes answers from a page; it does not score, rank or profile anyone. The only automated steps are limits (how many messages, how many codes) and a check that a visitor is a person before an anonymous chat.

Who receives it

Service providers under contract. Hosting and the database, the file store and its delivery network, the model provider that generates the twin's answers, the email and messaging services that deliver sign-in codes and mail, and the service that runs the human check. Each receives only what its part of the work needs, under a contract that forbids any other use.

Other people. Visitors see your page. An owner sees the chats their twin had, with the name of a visitor who chose to be named. Connected people see each other's names and twins.

Authorities. When the law requires it.

We do not sell personal data, and we never hand it to advertisers.

International transfers

itwin.co is in Turkey. Some of the providers above run in the European Union and in the United States, so some data leaves the country where you are. Transfers from Turkey rest on the grounds KVKK Article 9 allows. Transfers out of the EU rest on the safeguards GDPR Chapter V allows: standard contractual clauses with the provider, or a certification the EU recognises. Write to us for the safeguard that covers a given provider.

How long it stays

• A chat and its messages: 30 days from the last message. The owner can delete it sooner.
• The working context of a conversation: 2 hours.
• A memory note: until it is deleted by either side, a connection ends, an account is deleted, or a year passes without a visit.
• A sign-in code: 10 minutes. A sign-in session: 30 days.
• The record that you accepted the terms: as long as your account exists.
• Technical logs: a short window, measured in days.
• Messages to us and reports: as long as it takes to deal with them, and up to a year after, in case the matter comes back.
• Your account, profile and twin: until you delete them. Then they are gone from the live database at once and from backups within thirty days.

Your rights

Under KVKK Article 11 and GDPR Articles 15 to 22, you can:

• know whether we hold data about you, and get a copy;
• have it corrected;
• have it deleted;
• receive it in a file you can take elsewhere;
• object to processing that rests on our legitimate interest, or ask us to restrict it;
• withdraw consent where consent is the ground, such as a memory note, at any time;
• know who it has been passed to;
• complain to a data protection authority. In Turkey that is the Personal Data Protection Board (Kişisel Verileri Koruma Kurulu). In the EU it is the authority of the country you live in.

Most of this you can do yourself. Your answers, sections, photos and settings are editable in your twin. Export gives you a file of everything. Delete removes the account and everything in it, with no undo. For anything else, write to hello@itwin.co. We answer within 30 days, free of charge. We may ask you to sign in, so that we answer the right person.

Giving us your data is not required by law. Without an email address or a phone number there is no account, and without the answers there is no twin. Everything beyond that is optional.

Children

You must be 18 or over to make a twin. The site is not aimed at children, and we do not knowingly keep data about anyone under 18, apart from what a chat leaves behind, which goes within 30 days. If you think someone under 18 has made an account, write to us and it will be removed.

Changes

When this notice changes, the new version appears here with the date it took effect. If a change affects you, we try to tell you by email as well.