Privacy Notice

Effective date: 2 September 2026. Controller. SMARTEDTECH SL, CIF B66970831, Carrer Agricultura 16 1º 9ª, 08320 El Masnou, Barcelona, Spain. privacy@twinory.net. What we process. To operate TwinOry we process: the e-mail address you give to sign in; a one-way hash of the one-time code (never the code in our database); session tokens as hashes; age bracket; self-selected role; Ask Cards and related structured interactions you create; follows you create (your user id and the AI Twin id); consent records (document, version, hash, time); notification preferences (push and e-mail default off); technical logs needed to run and secure the service (including IP and user-agent as received by our hosts). We do not sell personal data. We do not use follows or attention as money. Purposes and bases. (a) Account and security (OTP, session, abuse prevention) — contract and legitimate interests. (b) Providing the features you use (asks, follows, vault when built) — contract. (c) Recording what you accepted — legal obligation and contract. (d) Age gate — legal obligation and legitimate interests. (e) Optional notifications only if you turn them on — consent. Processors. Database: Supabase. Web hosting: Vercel. Application server: Railway. Transactional e-mail: Resend, from `TwinOry <noreply@twinory.net>`. Source hosting: GitHub (product personal data is not stored in the repository). Some processors may process data outside the EEA; the transfer tool (including SCCs / DPA) is an owner/counsel item and is not asserted here as already signed. Retention. OTP challenges: about 10 minutes. Sessions: 30 days unless you end them sooner. Account and content: until you request erasure, subject to legal holds and records we must keep (including append-only audit and consent lines). Logs: as needed for security, then deleted or aggregated. Your rights. Access, rectification, erasure, restriction, portability, objection, and withdrawal of consent where consent is the basis. Export and erasure requests are product actions; erasure may be recorded before it is executed, and legal holds are named where they apply. You may complain to the Agencia Española de Protección de Datos (AEPD) or to your local EU authority. Children. The service is not for under-16s. Contact. privacy@twinory.net; legal@twinory.net.