Privacy Policy

1. Who we are

This Privacy Policy explains how TWINJAM 9PEARL PRIVATE LIMITED (CIN U46901MH2026PTC466510), a private limited company incorporated in India under the Companies Act, 2013, with its registered office at Floor 4, Plot 24/26 Cecil Court, Regal Cinema, Colaba, Mumbai G.P.O., Mumbai, Maharashtra 400001, India ("TWINJAM", "we", "us") handles personal data when you visit twinjam.com, request information, start a trial, or use the TWINJAM service.

TWINJAM 9PEARL PRIVATE LIMITED is the data fiduciary under India's Digital Personal Data Protection Act, 2023, and the controller for the purposes of the GDPR, for the personal data described in this Policy.

For website visitors, prospects and account administrators, TWINJAM is the controller (a "data fiduciary" under India's Digital Personal Data Protection Act, 2023). For content that our customers connect to the service, such as Slack messages, Jira tickets and Statements of Work, our customer is the controller and TWINJAM acts as a processor under our Data Processing Addendum.

2. Personal data we collect

We collect only the personal data we need to run the website, sell and support the service, and operate the product.

We do not collect sensitive personal data such as health, biometric or financial account data, and we ask customers not to connect channels that carry it.

3. How we use personal data

• To provide the service: parse contracts, evaluate allow-listed messages and tickets against boundary rules, and generate change order drafts for PM approval.
• To secure the service: detect abuse, investigate incidents and keep audit logs.
• To support you: answer requests, run onboarding and send service notices.
• To sell and market: respond to inquiries, send product updates you asked for, and measure campaign performance using aggregated data.
• To bill you and meet legal, tax and accounting obligations in the United States and India.

4. Legal bases for processing

Where GDPR or the UK GDPR applies, we rely on: performance of a contract (providing the service), legitimate interests (securing and improving the service, B2B marketing to business contacts), consent (non-essential cookies and certain marketing emails), and legal obligation (tax and accounting records).

Where the DPDP Act 2023 applies, we process personal data on the basis of your consent, given through a clear notice at the point of collection, or for legitimate uses permitted by Section 7 of the Act, such as fulfilling a request you made voluntarily. You may withdraw consent at any time with the same ease with which it was given.

5. How we share personal data

We do not sell personal data and we do not share it for cross-context behavioural advertising.

• With subprocessors listed in our Subprocessors register, under written contracts that require equivalent protection.
• With professional advisers, auditors and insurers under confidentiality duties.
• With authorities when required by law, after we review the request and narrow it where we can. We notify affected customers unless legally prohibited.
• In a merger, acquisition or asset sale, subject to this Policy.

6. International transfers and data residency

Customer content is hosted in the region the customer selects: United States (AWS us-east-1), European Union (AWS eu-central-1, Frankfurt) or India (AWS ap-south-1, Mumbai). Account and billing data is hosted in the United States.

When personal data from the EEA, UK or Switzerland is transferred to a country without an adequacy decision, we rely on the European Commission's Standard Contractual Clauses and the UK International Data Transfer Addendum. Transfers from India follow the DPDP Act 2023 and any restrictions notified by the Central Government.

7. How long we keep data

8. Your rights

Depending on where you live, you may have the right to access, correct, update, erase or port your personal data, to object to or restrict processing, and to withdraw consent. Under the DPDP Act 2023 you also have the right to grievance redressal and to nominate another person to exercise your rights in the event of death or incapacity.

California residents may request to know, delete and correct personal information and may not be discriminated against for exercising these rights. We do not sell or share personal information as those terms are defined under the CCPA as amended by the CPRA.

To exercise a right, email privacy@twinjam.com. We respond within 30 days, or sooner where local law requires. If your request concerns customer content, we will refer you to the agency that controls it and assist them.

9. Security

We protect personal data with AES-256 encryption at rest, TLS 1.3 in transit, per-tenant encryption keys managed in AWS KMS, least-privilege access, mandatory hardware-key multi-factor authentication for staff, and continuous monitoring. Our controls are examined annually under SOC 2 Type II. See our Security Architecture document for details.

10. Grievance Officer and contacts

Grievance Officer and Data Protection contact (India): Kavya Iyer, Head of Security & Compliance, TWINJAM 9PEARL PRIVATE LIMITED, Floor 4, Plot 24/26 Cecil Court, Regal Cinema, Colaba, Mumbai G.P.O., Mumbai, Maharashtra 400001, India. Email: privacy@twinjam.com. We acknowledge grievances within 48 hours and resolve them within 30 days.

EU representative requests and all other privacy questions can be sent to privacy@twinjam.com. If you are not satisfied with our response, you may complain to your local supervisory authority or, in India, to the Data Protection Board of India.

11. Changes to this Policy

We will post any changes here and update the date above. For material changes we will notify workspace administrators by email at least 30 days before they take effect.