1. Scope and Responsibilities

We determine how personal information is processed for our own account administration, billing, support, security, and business activities. For personal information an organizational customer supplies in its workspace, our role may be that of a processor or service provider acting on the customer’s instructions under the applicable agreement. The role depends on the actual processing and agreement; this Policy does not replace a data processing agreement.

If you use an organization’s workspace, its administrators may manage your access and information available within that workspace. For requests involving information controlled by that organization, contact its administrator. We can help route requests as appropriate.

Third-party platforms have their own privacy policies governing their independent processing. This Policy governs BuyerTwin’s processing and does not replace those policies.

2. Information We Collect

Account, Contact, and Support Information

We collect names, email addresses, usernames or account identifiers, account preferences, and information you provide when registering, contacting support, or communicating with us. Where password-based authentication is offered, authentication information is handled through the applicable sign-in system. Do not send passwords or authentication secrets in support messages or plugin tool inputs.

Billing and Transactions

We use Stripe to process subscription and purchase payments. Payment details submitted through Stripe’s payment flow are processed by Stripe under its Privacy Policy. BuyerTwin processes billing and subscription information needed to administer purchases and access to paid Services, including transaction and account records supplied through the payment flow. Card handling by Stripe does not by itself mean BuyerTwin stores your full card number or card security code.

Customer Content and Service Results

We process documents, research, notes, prompts, messaging, website or sales materials, buyer models, and other information that you submit or authorize us to access. We also process analysis results and updates generated or saved through your use of the Services. These materials may contain personal information if you include information about identifiable people.

Content shared within a workspace may be accessible to members with appropriate permissions. Do not provide personal information that you are not authorized to share. Plugin tools are not intended to receive full payment-card data, passwords, API keys, one-time codes, government identifiers, or protected health information.

Technical and Usage Information

The Services process technical and usage information for operation, troubleshooting, security, and service analysis. This may include IP addresses, browser and operating-system information, request timestamps, feature activity, error records, and device characteristics. Such information may identify or be linked to a person; it is not automatically anonymous.

Sources Other Than You

When you choose Google sign-in, we receive account information from Google as described in Section 8. We may also receive information that your organization or an authorized workspace member submits about you, and information exchanged through connections you authorize.

Research used to build modeled buyer profiles does not, by itself, establish that we collect additional personal information about our registered users. Where submitted research contains identifiable real people’s information, it is processed as customer content for the requested service under the applicable customer instructions and agreement.

3. How We Use Information

• Create accounts, authenticate users, and administer workspace permissions.
• Provide buyer modeling, content analysis, alignment scoring, simulated conversations, and recommendations requested by users.
• Retrieve relevant information and save authorized changes through supported integrations.
• Process subscriptions and transactions and send account, billing, and service notices.
• Respond to support inquiries and product feedback.
• Diagnose errors, maintain security, detect misuse, and enforce our agreements.
• Understand service usage and improve functionality, subject to the private-content limits below.
• Send marketing communications where permitted and consistent with your preferences.
• Comply with legal obligations and respond to lawful requests.

Marketing emails include an unsubscribe mechanism, and you may also contact us to opt out. Necessary service messages may continue after you unsubscribe from marketing. We do not treat acceptance of the Terms as blanket consent to optional tracking or marketing.

4. Legal Bases for Processing

Where EU or UK data protection law applies, we rely on a lawful basis appropriate to the activity:

You may withdraw consent through the relevant available controls or by contacting us. Withdrawal does not affect processing lawfully undertaken beforehand or processing supported by another applicable basis. For Canadian users, we obtain the consent required by applicable law or rely on a permitted legal exception. We do not claim every lawful basis applies to every activity.

Where we act on a customer’s instructions, that customer is responsible for establishing the applicable legal basis for the processing it controls.

5. Recipients and Disclosures

Personal information may be disclosed as needed for the purposes described in this Policy to:

• Authorized workspace users and administrators: information available under the workspace’s permissions.
• Authentication providers: account sign-in and access information.
• Payment processors: payment, subscription, and transaction information.
• Hosting, storage, and infrastructure providers: information needed to host and operate the Services.
• AI service providers: content needed to perform the relevant AI feature.
• User-authorized connected platforms: task-specific inputs, results, or updates exchanged through your connection.
• Support, communications, analytics, or monitoring providers: only the information needed for the applicable service actually used.
• Professional advisers or authorities: when needed to comply with law, establish or defend legal claims, or protect lawful interests.

Information may also be disclosed in connection with a merger, financing, acquisition, or transfer of relevant business assets, subject to applicable law and appropriate protection of the information.

6. Private Workspace Content

Private workspace content is not a public post. BuyerTwin uses it to provide and secure the Services and perform requests authorized by you or your organization. Access is limited to authorized workspace members and personnel or providers who need it for those purposes, subject to applicable obligations.

We do not sell private Customer Content, use it for advertising, disclose it to unrelated customers, or use it for general-purpose AI model training. Requested analysis, simulated buyer conversations, and authorized buyer-model updates are service processing and do not, by themselves, constitute general-purpose model training.

If you intentionally share content through a connected platform or another sharing feature, the selected recipients may receive it. Third-party platforms process their copies under their own terms and settings. We do not promise that every platform has identical retention or training practices.

7. AI Processing and Connected Platforms

BuyerTwin AI Features

AI features process your submitted materials and relevant buyer context to generate insights, research-supported models, simulated buyer responses, text analysis, and recommendations. Personal information contained in those materials may be processed as part of the request. AI platform providers acting for BuyerTwin may receive the inputs needed for the feature and produce results. Which provider processes a request depends on the feature and configuration. You may contact support for information about the providers relevant to your use; a platform being compatible with BuyerTwin does not mean every request is sent to that platform.

ChatGPT and Other Authorized Integrations

When you connect BuyerTwin to ChatGPT or another supported platform, BuyerTwin may receive task-specific inputs sent through tool calls, connection information needed to identify the authorized account, and content you authorize the integration to process. It may return relevant buyer intelligence, workspace information, analysis results, or status information to that platform.

If you authorize an update, relevant content may be saved to your BuyerTwin workspace. Access remains subject to account permissions. A connection does not mean that BuyerTwin receives your entire conversation history; the actual data received depends on tool inputs and the actions you authorize.

Information returned to ChatGPT is processed by OpenAI as part of your use of that platform and under its applicable terms, privacy practices, and account settings. BuyerTwin’s backend AI processing and your use of a connected AI platform are distinct data flows.

You can stop future access through a connection by revoking it using available BuyerTwin or connected-platform controls, or contact support for assistance. Disconnection does not automatically delete information already saved by BuyerTwin or the connected platform. Contact the relevant provider to exercise rights over its copies.

You may decline to submit optional content or stop using features that require AI processing. Some AI features cannot operate without processing the relevant inputs. Contact support to request applicable deletion or restriction; this is not a promise that all AI features can continue after their necessary processing stops.

8. Google Sign-In and Authentication

If you choose Google registration or sign-in, we receive account information, such as your name, email address, and account identifier, made available through that authorized sign-in flow to authenticate you and manage your account. The information received depends on the permissions and configuration of the sign-in flow. Google sign-in does not, by itself, give BuyerTwin access to Gmail, Drive, Calendar, contacts, friends lists, or unrelated Google account content.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its applicable Limited Use requirements.

9. Cookies, Analytics, and Advertising

We use cookies and similar technologies for functions such as authentication, security, preferences, and service operation. Technical usage information may also be processed to understand and improve the Services. Browser settings can block or remove cookies, although blocking necessary cookies may prevent some features from working. You can contact us for information about the technologies used and to communicate applicable tracking preferences. Where consent is required for a particular technology, it must be obtained before that technology is used.

The restrictions on private workspace content in Section 6 apply separately from public website technical information. We do not use private workspace documents or buyer notes to personalize advertising.

10. Retention and Deletion

We retain personal information only for as long as necessary for its processing purpose, subject to applicable legal requirements and customer agreements. Active account data, workspace content, diagnostic logs, backups, and billing records may have different retention periods. Account closure does not necessarily require immediate erasure of every legal record or backup copy.

When information is no longer needed, it will be deleted or anonymized, subject to applicable requirements. We may retain information for legal compliance, documented disputes, fraud prevention, or security investigations when necessary and lawful. Deletion requests concerning connected-platform copies must also be addressed to that platform.

11. Security

We use technical and organizational safeguards designed to protect personal information processed through the Services. No system or transmission method can be guaranteed completely secure. This Policy does not claim a particular certification or security guarantee. Protect your credentials and contact us promptly if you suspect unauthorized access.

12. Eligible Minors and Parental Consent

The Services are available to users aged 13 or older, or any higher minimum age required by applicable law. Users under 18, or under the age of majority in their jurisdiction, may use the Services only with the consent and supervision of a parent or legal guardian who agrees to the Terms on their behalf. Connected third-party platforms may impose additional requirements.

Personal information of eligible minors may be processed to provide the features they use, subject to applicable protections and required consent. Permission to use the Services is separate from any consent required for processing personal information; parental agreement to the Terms alone does not replace applicable privacy-consent requirements. Where required, we obtain and document appropriate consent before processing. We may request proportionate information to verify eligibility, parental authority, and consent. Contact support to arrange consent, withdraw it, or ask about an eligible minor’s use.

The Services are not intended for children below the applicable minimum age. If we learn that information was collected from a user who does not meet that age requirement or lacks required consent, we will restrict the account and take appropriate steps to delete the information, subject to applicable law. Parents, guardians, and eligible users may contact support with questions or applicable access, correction, or deletion requests.

13. Your Choices and Privacy Rights

Depending on applicable law, you may have rights to:

• Know whether we process your personal information and obtain information about its sources, purposes, and recipients.
• Access your information and receive a copy in an applicable portable format.
• Correct inaccurate information or request deletion.
• Restrict or object to certain processing and withdraw consent where we rely on it.
• Opt out of applicable sale, sharing, targeted advertising, or profiling used for legally or similarly significant decisions.
• Limit certain uses or disclosures of sensitive personal information where that right applies.
• Challenge a denial of a request or complain to a competent supervisory authority.

These rights may have exceptions or limitations under applicable law. We will not unlawfully discriminate against you for exercising them. Buyer modeling and alignment scoring do not by themselves establish automated decision-making about a particular individual. Any actual processing involving such decisions must be separately disclosed and reviewed.

To make a request, use our privacy request form or email [email protected]. We may request proportionate information to verify identity or authority. Do not submit passwords, full card details, or identity documents unless a secure and appropriate verification process specifically requires them.

An authorized agent may submit requests where permitted by law. We may verify the agent’s authority and, where permitted, your identity. We respond within the time required by applicable law and explain any permitted extension or denial. Where an appeal right applies, email support with your request reference and reason for appeal; we will explain the outcome and applicable escalation options.

Account and Integration Choices

Use available account settings to update information or contact support. Revoking an integration prevents future access through that connection; subscription cancellation ends renewal; deletion requires a separate request. We may need instructions from the organization controlling a workspace to act on its content.

Marketing and Consent

Use the unsubscribe link in a marketing email or contact support to stop marketing communications. Service-related notices may continue. Consent can be withdrawn through the applicable available control or by contacting support, without affecting processing lawfully performed before withdrawal.

14. Do-Not-Track and Global Privacy Control

Legacy browser Do-Not-Track settings and Global Privacy Control (GPC) are distinct signals. A browser setting does not necessarily control all information processing needed for account authentication or service operation. You may contact us to communicate an applicable privacy choice or ask how a signal is handled. Any legally required opt-out preference signal will be handled in accordance with applicable law; this statement does not represent that every browser signal disables all cookies or all processing.

15. United States Privacy Disclosures

Residents of California, Colorado, Connecticut, Delaware, Florida, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, Virginia, and other jurisdictions may have rights under applicable state law. Availability depends on the law, its scope, and the processing involved; listing a state does not mean every law applies to every activity.

Categories and the Preceding Twelve Months

The categories relevant to our account and service processing include identifiers, contact and billing information, commercial information such as subscription records, and internet or network activity such as technical logs. Depending on what you submit, customer materials may also contain professional information or other personal information. Illustrative categories do not mean every item in a category is collected. Sources, purposes, recipients, and retention are described in Sections 2–5 and 10. You may request information about the categories actually processed about you, including during the preceding twelve months, using Section 13.

Sale, Sharing, and Sensitive Information

We do not sell private workspace content or use it for advertising, as described in Section 6. We disclose personal information to recipients for the service purposes described in Section 5. These disclosures are distinct from selling personal information or sharing it for cross-context behavioral advertising. Where applicable, you may request information about disclosures and exercise sale, sharing, targeted-advertising, or sensitive-information rights through Section 13.

Where applicable, state rights may include lists of recipient categories or specific third parties, information about profiling, and restrictions on sensitive information. Exercise applicable rights using Section 13. We will provide information and remedies required by the law that applies to your request.

California Shine the Light

California Civil Code Section 1798.83 may allow California residents to request information about certain disclosures for third parties’ direct marketing purposes. Send a written request to the contact information below.

16. International Processing and Regional Rights

BuyerTwin is based in the United States. Personal information may be processed in the United States and other countries where our providers or authorized connected platforms operate. Those countries may have different data-protection laws. Contact us for information about the locations and safeguards relevant to your use. Where applicable law requires transfer safeguards, we use an appropriate legal mechanism for the processing we control, such as applicable contractual safeguards or another legally recognized transfer mechanism. Use of the Services alone does not replace legally required safeguards.

EEA, United Kingdom, and Switzerland

Where applicable, you may exercise access, correction, erasure, portability, restriction, objection, consent-withdrawal, and automated-decision rights. You may complain to your local data protection authority, the UK Information Commissioner’s Office, or the Swiss Federal Data Protection and Information Commissioner, as applicable. You may also contact us to seek resolution without losing your right to complain to an authority.

Canada and Quebec

Where applicable, you may request access or correction, withdraw consent subject to legal limits, and exercise other applicable rights, including portability or information about automated processing where provided by law. Contact support to make a request or privacy complaint. We will explain any applicable limits and complaint escalation process.

Australia, New Zealand, and South Africa

Where their laws apply, residents may request applicable access or correction and may complain to the Office of the Australian Information Commissioner, the New Zealand Privacy Commissioner, or South Africa’s Information Regulator, as appropriate.

Withholding information necessary for authentication, service delivery, billing, or security may prevent us from providing the relevant feature. Optional choices will be distinguished from information necessary for a requested service.

17. Policy Updates

We may update this Policy to reflect changes to the Services, data practices, or legal requirements. The effective date will identify the applicable version. We will provide notice of material changes as appropriate and obtain additional consent where required. A policy update does not retroactively authorize incompatible use of previously collected information.

18. Contact and Request Procedures

For privacy questions, complaints, or rights requests, use our privacy request form or contact:

Please identify the account or workspace involved and describe your request. We will use verification information only as needed to assess identity, authority, and the request. If another organization controls the information, we will explain the appropriate route. We will respond, provide status or permitted extensions, and handle appeals in accordance with applicable law.