Privacy Policy

1. Who is responsible for your data

TWINDLE PRIVATE LIMITED ("Twindle", "we", "us") is the data controller.

88 Borewell Road, Opposite to Post Office
Bangalore South, Karnataka, 560066, India

Contact and Grievance Officer: contact@twindle.app

Any privacy question, request, or complaint — including complaints under the Digital Personal Data Protection Act, 2023 — can be sent to that address.

2. Scope

This policy covers the data we collect when you apply to become a creator or studio on Twindle — signing up, verifying your email, and completing onboarding. It does not cover published content or payments, which are not yet part of the service.

Twindle is accessible from anywhere in the world. Our company is based in India, and the personal data you enter during onboarding is stored in the European Union (see section 6). Some technical data, such as your IP address, is processed automatically wherever you connect from, to operate and secure the service (see section 3.6).

3. What we collect, and why

3.1 Everyone — account creation

3.2 Individual creators — onboarding profile

Full name, date of birth, location, languages, social links, bio, and an optional reference code.

• Why: to assess your application, and to confirm you are 18 or over.
• Legal basis: performance of a contract (Art. 6(1)(b)); the date of birth is also processed to meet our legal obligation not to onboard minors (Art. 6(1)(c)).

3.3 Studios — onboarding profile

Studio name, website, location, languages, social links, and the name, role, and email address of a contact person.

• Why: to assess the application and to have a named person to correspond with.
• Legal basis: performance of a contract, and our legitimate interest in maintaining a working contact for business accounts (Art. 6(1)(f)).
• See section 4 for how we handle the contact person's data specifically.

3.4 Proposed work — metadata only

Title, summary, genres, tags, and episode count.

• Why: to assess whether your proposed work is a fit for the platform.
• Legal basis: performance of a contract (Art. 6(1)(b)).

3.5 Acceptance record

At the moment you submit your profile, we record your user-agent string, a timestamp, and the version numbers of the Terms and this Privacy Policy shown to you.

• Why: to keep provable evidence of what you were shown and what you accepted.
• Legal basis: legal obligation and our legitimate interest in evidencing consent and contract acceptance (Art. 6(1)(c) and 6(1)(f)).
• This record is append-only: it cannot be edited or deleted through the application, and our account-deletion process deliberately preserves it.

3.6 Technical and security data — including your IP address

Because Twindle is reachable globally and log-in runs on a hosted authentication provider, some technical data is collected automatically when you interact with the service:

Your IP address is processed and held by Appwrite Cloud in Frankfurt, European Union as part of authentication and security logging. We use it only to run and protect the service.

To be clear about what we do not do with it: we do not use your IP address for advertising or to build a profile of you, we do not use advertising or tracking cookies, and we do not make automated decisions that produce legal effects about you. We do not store your IP address in your onboarding profile or your acceptance record — it is processed by our provider for security and operational purposes as described above.

4. If someone else gave us your details

If you are a studio contact person, we may hold your name, role, and email address even though you never visited our site. A studio gave us those details when applying for an account.

• Source: the studio that named you.
• What we hold: your name, your role at that studio, and your work email address.
• Why: so we have a named point of contact for that studio's account.
• Legal basis: our legitimate interest, and the studio's, in administering a business account (Art. 6(1)(f)).
• Your rights: identical to everyone else's — see section 9. You can object to this processing or ask us to erase your details at contact@twindle.app, and we are not obliged to keep an account contact who does not wish to be one.

This notice is provided under Article 14 of the GDPR. The studio that named you is responsible for telling you it has shared your details.

5. Emails we send you

• One-time passcode — sent every time you log in.
• "Profile under review" confirmation — sent after you submit. This email contains a full copy of the profile you submitted, including the personal details listed above. Please bear that in mind when choosing which inbox to register with, and if you forward it.
• Internal notifications to our review teams, which include your submitted profile.

We do not send marketing email from this service.

6. Where your data is stored, and who processes it

Your onboarding profile data is stored in the European Union. Our company is in India. Twindle serves users globally, so personal data — and technical data such as your IP address — is accessed from, and transferred to, India by our staff for the purposes described above.

We do not sell your personal data, and we do not share it with third parties other than the processors listed above, except where we are legally required to.

7. How long we keep it

When you delete your account, we erase your profile, your onboarding status, and everything you submitted.

We deliberately retain the record of your acceptance of the Terms and this Privacy Policy — the version numbers, timestamp, and user-agent — even after deletion. We do this to preserve evidence of what was agreed and when, as permitted by GDPR Article 17(3)(e) (establishment, exercise, or defence of legal claims). This record does not contain your profile data.

We also keep a small deletion audit record — your user ID, a one-way hashed (non-reversible) form of your email, and the date of deletion. This lets us evidence that erasure was carried out. It does not contain your email address or profile data. Legal basis: our legitimate interest in demonstrating compliance (Art. 6(1)(f)), retained under Art. 17(3)(e).

8. Deleting your account

Email contact@twindle.app and ask us to delete your account. An administrator will action it, and automated cleanup follows. We will respond within 30 days.

Subject to section 7, this erases your data from our systems.

9. Your rights

You may ask us to:

• access the personal data we hold about you;
• correct it if it is wrong or incomplete;
• erase it (subject to the consent-record exception in section 7);
• restrict or object to our processing of it;
• port it to you or another controller in a machine-readable format;
• withdraw consent, where we relied on consent — this does not affect processing carried out before withdrawal.

Send any request to contact@twindle.app. We respond within 30 days. We do not charge for this.

If you are in the EU or UK, you also have the right to complain to your national data protection supervisory authority.

10. India — Digital Personal Data Protection Act, 2023

If you are in India, the following apply in addition to the above.

• Grievance Officer. Complaints go to contact@twindle.app, and we respond within 30 days. If you are not satisfied with our response, you may escalate to the Data Protection Board of India.
• Your rights as a Data Principal. Access to a summary of your data and its processing, correction, completion, updating, erasure, and grievance redressal — exercised at the same address.
• Right to nominate. You may nominate another individual to exercise your rights on your behalf in the event of your death or incapacity. Email us to record a nomination.
• Notice. This document is the itemised, plain-language notice required at the point of collection. It is shown to you before you provide your email address.
• Children's data. Twindle is an 18+ platform. We do not knowingly collect personal data from anyone under 18, and applications from individuals under 18 are rejected at sign-up on the basis of the date of birth provided. Because of this, we do not process children's data and no verifiable parental consent regime applies. If you believe someone under 18 has registered, tell us at contact@twindle.app and we will delete the account.

11. Security

Data is held on Appwrite Cloud infrastructure in the EU. Access is limited to staff who need it for review and support. We use passwordless one-time-passcode authentication rather than storing passwords. No system is perfectly secure, and we cannot guarantee absolute security.

12. Changes to this policy

We may update this policy. Each version carries an effective date, shown at the top of this document, and prior versions are archived and retrievable — never overwritten. The version in force at the time you were shown this notice is recorded alongside your account.

Material changes will be brought to your attention before they take effect.

13. Contact