Your data, on your terms. We handle the information you trust us with carefully — using it only to operate the Services, never selling it, and giving you direct control over recording, retention and deletion.
1. Introduction
This Privacy Policy explains how Twiching General Trading (“Twiching”, “we”, “our”, “us”) collects, uses, stores, shares and protects personal data when you use our website, dashboard, APIs and communications services (collectively, the “Services”).
We act as a data controller for the information we collect directly from you (account, billing, marketing) and as a data processor for the call, message and customer data you route through our platform on behalf of your end users.
2. Information we collect
We collect the following categories of personal data:
- Account data — name, work email, company, password hash, phone number, timezone.
- Billing data — billing address, tax ID, payment-method tokens (we never store full card numbers — tokenised by our PCI-DSS certified payment processor).
- Communications metadata — call detail records (CDRs), SMS / MMS metadata, message size, timestamps, originating and destination numbers, route taken, duration and disposition. Message content is processed only as required to deliver the service.
- Voice content & transcripts — only when you explicitly enable call recording or AI transcription. Recordings remain your data.
- Usage & device data — IP address, browser type, pages viewed, dashboard actions, API endpoints called, errors encountered.
- Support data — chat transcripts, support tickets, screen recordings you choose to share.
3. How we use information
We use personal data only for the following purposes:
- To provision, operate and improve the Services and your dashboard experience.
- To route calls and messages, including across third-party carrier networks.
- To bill you and process refunds, and to detect fraudulent or abusive usage.
- To send service notices, security alerts, regulatory notifications and (with separate opt-in) product updates.
- To comply with applicable law, including lawful intercept, STIR/SHAKEN attestation and traceback obligations.
- To enforce our Terms and Conditions and Acceptable Use Policy.
4. Legal basis (GDPR)
For users in the European Economic Area, United Kingdom and Switzerland, our legal bases for processing are:
- Contractual necessity — to provide the Services you have signed up for.
- Legitimate interest — to secure our platform, prevent fraud, improve our products and communicate transactional information.
- Consent — for marketing communications, optional features such as call recording, and non-essential cookies.
- Legal obligation — to meet tax, accounting, telecoms and lawful-intercept requirements.
6. Data retention
We keep personal data only as long as needed for the purposes set out above:
- Account data — for the life of your account, plus 90 days post-termination.
- Billing records — 7 years (to meet tax / accounting obligations).
- Call detail records — 12 months by default, configurable by Enterprise customers.
- Call recordings & transcripts — retention policy fully under your control.
- Marketing data — until you unsubscribe, then deleted within 30 days.
7. Security
We apply industry-standard technical and organisational measures to protect personal data, including:
- TLS 1.3 in transit; AES-256 at rest.
- SRTP for media; signed SIP for signalling.
- SOC 2 Type II controls; ISO 27001 alignment.
- Role-based access, MFA-required for admin consoles, full audit logging.
- Quarterly third-party penetration tests; public security disclosure programme.
Report a vulnerability to security@twiching.ai — we respond to verified reports within 24 hours.
8. Your rights
Subject to applicable law, you have the right to access, correct, port, delete or restrict processing of your personal data, to object to legitimate-interest processing, and to withdraw consent at any time. EU/UK users may lodge a complaint with their local supervisory authority.
California residents have additional rights under the CCPA / CPRA, including the right to know what categories of personal information we collect and to opt out of any “sale” or “share” — we do neither.
To exercise any of these rights, email info@twiching.ai. We respond within 30 days.
10. International data transfers
Twiching is headquartered in Singapore. We process data in Singapore, the European Union and the United States, depending on where you and your end users are located. Where data leaves the EU/UK we rely on the European Commission’s Standard Contractual Clauses and equivalent UK addendum, plus supplementary technical measures (encryption, key separation, pseudonymisation).
A signed Data Processing Addendum (DPA) is available on request from info@twiching.ai.
11. Children's privacy
The Services are not directed to individuals under 16 and we do not knowingly collect data from them. If you believe a child has provided us personal data, please contact info@twiching.ai and we will delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. Material changes will be announced via email and posted on this page at least 30 days before they take effect. Your continued use of the Services after the effective date constitutes acceptance of the revised policy.
13. Contact
Questions about this Privacy Policy can be directed to:
Twiching General Trading — Data Protection Office
1 Tampines North Drive 1, T-Space, Singapore 528559