Last updated 10 August 2026
TwinTone Privacy Policy
Effective date: 10 August 2026
TwinTone ("TwinTone", "we", "us", or "our") operates an AI live-streaming platform that lets brands and businesses deploy AI avatars that present products, engage viewers, and answer chat in real time. This Privacy Policy explains what information we collect through our website at www.twintone.ai and our application at live.twintone.ai (together, the "Service"), how we use it, who we share it with, and the choices you have.
TwinTone is based in New Zealand and processes personal information in accordance with the New Zealand Privacy Act 2020 and, where applicable, the EU General Data Protection Regulation (GDPR) and other privacy laws.
1. Information we collect
Information you provide to us
- Account information. When you create an account, we collect your email address and, if you choose password-based sign-in, a securely hashed password. If you sign in with Google, we receive the email address and basic profile information associated with your Google account.
- Brand and business information. Your brand name, website URL, and any other details you provide about your business.
- Billing information. Billing details such as your billing address and payment history. Payments are processed by Stripe; we do not store full payment card numbers.
Information we collect from connected services
- Product catalog. When you connect a store (for example via Shopify), we receive product information such as names, descriptions, prices, images, and inventory data so your AI host can present and answer questions about your products.
- Integration credentials. When you connect third-party integrations (for example Composio or TikTok Shop), we store the API keys and credentials needed to operate those integrations on your behalf.
- Chat and stream data. Chat messages sent during your live streams, together with stream metadata such as start/end times, viewer counts, and transcripts. We process chat messages to power your AI host's real-time responses and moderation.
Information we collect automatically
- Usage and technical data. When you use the Service, we log IP addresses, browser and device information, pages visited, and how you interact with the Service (including API usage) to operate, secure, and improve it.
- Cookies and similar technologies. See Section 6 below.
2. How we use your information
We use the information we collect to:
- create and manage your account and authenticate you;
- operate the Service, including generating AI avatar content, running live streams, and powering real-time chat responses;
- present and recommend products from your connected catalog;
- process payments and manage subscriptions;
- provide customer support and respond to requests;
- monitor, secure, and protect the Service (including moderation of chat content and abuse prevention);
- analyse usage and improve the Service; and
- comply with legal obligations and enforce our Terms of Service.
We do not sell personal information, and we do not use your data to train models for other customers.
3. AI processing
Chat messages, product catalog data, and brand content you provide are processed by AI systems — including third-party model providers acting on our behalf — to generate your AI host's scripts, voice, and responses. AI-generated content is produced automatically and may occasionally be inaccurate; you are responsible for supervising your streams as set out in our Terms of Service.
4. How we share information
We share personal information only as needed to operate the Service:
| Provider | What they process | Purpose |
|---|---|---|
| Supabase | Account data and database records (hosted in us-east-1) | Authentication and database |
| Email and basic profile (only if you sign in with Google) | OAuth sign-in | |
| Stripe | Billing information and payment data | Payment processing |
| Shopify | Product catalog data | Product sync (if you connect a store) |
| Composio | Integration credentials and integration calls | Platform integrations (e.g., TikTok Shop) |
| LiveKit | Stream audio, video, and chat | Real-time streaming |
| ElevenLabs / Fish Speech | Generated text (for voice synthesis) | Text-to-speech |
| Vercel | Application hosting and logs | Hosting |
We also disclose information where required by law, to protect our rights or the safety of users, or in connection with a merger, sale, or acquisition. We do not sell personal information.
5. Data retention and deletion
We retain personal information only as long as needed for the purposes described in this policy:
- Account and billing data: for as long as your account is active and for a reasonable period afterwards to comply with legal, tax, and accounting obligations.
- Chat, stream, and transcript data: for the period needed to operate your streams and for audit and analytics purposes (typically up to twelve months).
- Integration credentials and API keys: until you disconnect the integration or close your account.
When you close your account, we delete or de-identify your personal information unless we are required to keep it by law. You can request deletion at any time — see Section 7.
6. Cookies
We use cookies and similar technologies to make the Service work and to understand how it is used:
- Essential cookies: required for sign-in, session management, and security.
- Analytics cookies: help us understand how visitors use our website and app so we can improve them.
- Third-party services (such as Google, Stripe, and Shopify) may set their own cookies when you interact with them.
We do not use advertising or cross-site tracking cookies. You can control cookies through your browser settings, but disabling essential cookies may prevent the Service from working correctly.
7. Your rights
Subject to applicable law, you have the right to:
- access the personal information we hold about you;
- correct inaccurate or incomplete information;
- delete your personal information;
- object to or restrict certain processing;
- portability — receive a copy of your data in a structured format; and
- withdraw consent at any time where processing is based on consent.
To exercise these rights, email legal@twintone.ai. We will respond within a reasonable timeframe (typically within 30 days). You may also complain to the New Zealand Privacy Commissioner or your local data protection authority.
8. Data security
We use encryption in transit and at rest, access controls, and other reasonable safeguards to protect your information. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. In the event of a breach, we will notify affected users and regulators as required by law.
9. Children
The Service is intended for businesses and for individuals aged 18 or over. We do not knowingly collect personal information from children under 18. If you believe a child has provided us personal information, contact legal@twintone.ai.
10. International data transfers
TwinTone is based in New Zealand. Our service providers store and process data in the United States and other countries. Where we transfer personal information across borders, we rely on appropriate safeguards and take steps to ensure your information is protected.
11. Changes to this policy
We may update this Privacy Policy from time to time. We will post the updated policy at www.twintone.ai/privacy-policy with a new effective date and, for material changes, notify you by email or in-app notice.
12. Contact
Questions or requests regarding this policy or your personal information: legal@twintone.ai
TwinTone, New Zealand