Privacy Policy
Last updated: 6 August 2026
Effective date: 6 August 2026
Who we are
Twinfeed ("Twinfeed", "we", "us", "our") is operated by David Dominguez, a sole trader established at Cra 12 # 116-23, Bogotá D.C., Colombia.
We are the data controller for the personal data described in this policy.
For anything relating to privacy or your data protection rights, contact us at david@usecloser.ai.
1. What this policy covers
Twinfeed is a personal-branding autopilot. You tell us about yourself and your brand, we build a "digital twin" from that information, and the Service then generates social media posts — captions and images — and publishes them to your connected social accounts on a schedule you define.
That product does three things that matter for your privacy, and this policy explains each of them:
- We collect an unusually rich, personal picture of you — how you see yourself, your opinions, your story, what you will and won't say publicly.
- We send that information to third-party AI providers to generate content.
- We publish content in your name, on platforms where you have a public reputation.
This policy applies to our website, our web application, and our API and integrations (together, the "Service"). It does not apply to the social media platforms you connect — those are governed by their own privacy policies.
2. The personal data we collect
2.1 Account and identity data
Your name, email address, and password (stored only as a salted hash by our authentication provider). If you choose to provide them: phone number, profile photo, job title, company, country, and time zone.
2.2 Brand and "digital twin" data
This is the core of the Service and the most sensitive category we hold. It includes everything you tell us during onboarding and afterwards:
- how you describe yourself, your background, your career and your personal story
- your brand positioning, tone of voice, values and beliefs
- your target audience and content pillars — the topics you write about
- your exclusions — topics, opinions, words and claims you do not want associated with you
- writing samples, past posts, notes, ideas and any documents or links you upload or paste
- your visual style: colours, fonts, logo, image treatments and templates
- the derived "digital twin" profile our systems generate from all of the above
Special category data. Some of what you tell us about your brand may reveal political opinions, religious or philosophical beliefs, trade union membership, health information, or data about your sex life or sexual orientation. Under Article 9 GDPR these are "special categories" of personal data. Please do not submit special category data unless you intend it to be used in your public content. Where you do choose to provide it, you give us your explicit consent (Article 9(2)(a) GDPR) to process it for the purpose of generating and publishing your content, and you may withdraw that consent at any time by deleting the relevant material and contacting us.
2.3 Content data
Post drafts, approved posts, generated captions, generated and uploaded images and other media, prompts, edits, feedback, scheduling instructions, and the publication history of everything we post for you.
2.4 Connected social account data
When you connect LinkedIn, X (Twitter), Instagram or TikTok, we receive and store:
- OAuth access and refresh tokens (encrypted at rest), and the scopes you granted
- your platform account identifier, handle, display name and profile picture
- the identifiers and status of posts we publish for you
- where the platform makes it available and you have granted the relevant permission, engagement metrics for those posts (impressions, likes, comments, shares)
We request the narrowest set of permissions that lets us publish on your behalf. You can disconnect any account at any time, from Twinfeed or from the platform's own settings.
2.5 Billing data
Payments are processed by FastSpring, which acts as the merchant of record for purchases of Twinfeed. FastSpring collects and processes your payment card or account details and billing address directly, as an independent controller under its own privacy policy. We never receive or store your full card number. We receive from FastSpring only the data we need to run your account: your name, email, billing country, the product purchased, subscription status, and transaction identifiers.
2.6 Usage, device and log data
IP address, browser and device type, operating system, referring pages, pages viewed, actions taken in the app, timestamps, and error and diagnostic logs. These are generated automatically when you use the Service.
2.7 Support and communications
The content of emails, chat messages, bug reports and feedback you send us, and our replies.
3. Where we get it
Most of it comes directly from you — during onboarding, in the app, and through support. Some is generated automatically when you use the Service (logs, usage, diagnostics). Some comes from the platforms you connect (profile details, publication results, metrics), and some from FastSpring (subscription and transaction status).
4. Why we use it, and our legal basis
| What we do | Why | Legal basis (GDPR Art. 6) |
|---|---|---|
| Create and maintain your account | To give you access to the Service | Contract — Art. 6(1)(b) |
| Build and maintain your digital twin | It is the product you signed up for | Contract — Art. 6(1)(b) |
| Generate captions and media | Core function of the Service | Contract — Art. 6(1)(b) |
| Publish posts to your connected accounts on your schedule | You instructed us to | Contract — Art. 6(1)(b) |
| Show you performance metrics for published posts | Part of the Service | Contract — Art. 6(1)(b) |
| Process special category data you voluntarily provide | To generate content reflecting it | Explicit consent — Art. 9(2)(a) |
| Take payment, manage subscriptions, prevent chargebacks | To be paid, and to comply with tax law | Contract — Art. 6(1)(b); Legal obligation — Art. 6(1)(c) |
| Provide support and respond to you | To help you use the Service | Contract — Art. 6(1)(b); Legitimate interests — Art. 6(1)(f) |
| Keep the Service secure, detect abuse and fraud | To protect users and our systems | Legitimate interests — Art. 6(1)(f) |
| Improve the Service using de-identified and aggregated data (see §6) | To make the product better | Legitimate interests — Art. 6(1)(f) |
| Send product and marketing emails | To tell you about Twinfeed | Consent — Art. 6(1)(a), or legitimate interests for existing customers |
| Comply with legal obligations and defend legal claims | We must | Legal obligation — Art. 6(1)(c); Legitimate interests — Art. 6(1)(f) |
Where we rely on legitimate interests, we have weighed our interest against your rights and concluded ours does not override yours. You can ask for details of that assessment, and you have the right to object — see §12.
Where we rely on consent, you can withdraw it at any time. Withdrawal does not affect processing carried out before you withdrew.
5. How your data is processed by AI systems
This section describes something most privacy policies do not have to, so we are being specific.
Your content is sent to third-party AI providers. To generate your digital twin, your captions and your images, we transmit your brand data, your content and your instructions to the AI providers listed in §7. Those providers process it on our instructions as our processors, and return generated output to us.
We choose providers that do not train on our inputs. We use paid API and enterprise tiers whose terms commit the provider not to use data submitted through the API to train or improve their models, and we configure our integrations to that effect. We cannot, however, control a third-party provider's own breach of its commitments, and where a request is routed through a model aggregator we depend on the terms of the underlying model host.
Generation is automated, but publication is your decision. Our systems generate drafts without human review. What gets published depends on the settings you choose: you can require your approval before every post, or you can enable autopilot, in which case approved schedules publish automatically. Autopilot is your instruction to publish without prior review, and you remain responsible for the result. You can pause or cancel any scheduled post before it goes out.
No decisions with legal effect. We do not use automated decision-making that produces legal effects concerning you or similarly significantly affects you within the meaning of Article 22 GDPR.
AI output can be wrong. Generated content may be inaccurate, misleading, out of date, or may unintentionally resemble content produced for someone else. Review before you publish, and see our Terms and Conditions.
6. Using your data to improve the Service
We use de-identified and aggregated data to improve Twinfeed — for example, to refine our prompts, evaluate the quality of generated output, fix failures, and measure how features perform.
What "de-identified" means here. Before content is used for improvement, we strip direct identifiers — your name, email, account ID, handles, connected account identifiers, contact details, and the names of people and companies detected in the text. What remains is used in aggregate or as isolated examples that are not linked back to your account.
What we do not do. We do not sell your personal data. We do not use your identifiable brand profile, your posts or your media to train models that generate content for other customers. We do not share your content with other customers.
Honesty about the limits of de-identification. Text that describes your career, your opinions and your story can sometimes be re-identifiable even after direct identifiers are removed. We treat de-identified content as still requiring protection, keep it under the same access controls, and do not attempt to re-identify it.
You can object. This processing relies on legitimate interests, and you have an absolute right to object to it. Email david@usecloser.ai and we will exclude your content from all Service improvement processing. It costs you nothing and does not affect your use of Twinfeed.
7. Who we share it with
We do not sell your personal data. We share it with the following categories of recipients.
7.1 Service providers (processors)
| Provider | What they do | Where |
|---|---|---|
| Supabase | Database, authentication, file storage | EU / US |
| Vercel | Application hosting, CDN, analytics | EU / US |
| Google Cloud (Vertex AI) | Text and image generation | EU / US |
| Groq | Text generation (inference) | US |
| OpenRouter | Model routing to third-party model hosts | US |
| ElevenLabs | Audio and voice generation | US |
| Browserbase | Managed browsers for rendering and screenshots | US |
| Pexels | Stock image search | US |
| Tavily | Web search for content research | US |
| FastSpring | Payments, as merchant of record (independent controller) | US / EU |
| Email and support providers | Transactional email, support correspondence | EU / US |
Each processor is bound by a written data processing agreement, may only act on our documented instructions, and must apply appropriate security measures. This list may change as our stack evolves; the current version always lives in this policy, and we will tell you before adding a processor that materially changes how your data is handled.
7.2 Social media platforms
When you instruct us to publish, we transmit your content — and the credentials you authorised — to LinkedIn, X (Twitter), Instagram and/or TikTok. Once published, that content is on their platform, under their terms and their privacy policy, and outside our control. Deleting content in Twinfeed does not delete it from a platform where it has already been published.
7.3 Others
Professional advisers (lawyers, accountants) under duty of confidentiality; authorities, courts or regulators where we are legally required to disclose; and a buyer or successor if we sell or restructure the business, in which case we will notify you and this policy will continue to apply until replaced.
8. International transfers
Several of our providers are established in the United States or process data there. When we transfer personal data outside the EEA or the UK, we rely on:
- an adequacy decision of the European Commission, including the EU–US Data Privacy Framework where the recipient is certified under it; or
- the European Commission's Standard Contractual Clauses, together with supplementary technical measures such as encryption in transit and at rest.
Under Colombian law (Article 26, Ley 1581 de 2012), transfers to countries that do not provide an adequate level of protection require your authorisation. By using the Service you authorise the transfers described above, which are necessary to provide it — our AI providers, hosting and payment processing are located outside Colombia.
You can request a copy of the safeguards we rely on by emailing david@usecloser.ai.
9. How long we keep it
| Data | Retention |
|---|---|
| Account and brand/digital twin data | For as long as your account is active |
| Content, drafts and generated media | For as long as your account is active |
| Publication history and metrics | For as long as your account is active |
| OAuth tokens for connected accounts | Until you disconnect the account or delete your account, then deleted immediately |
| All of the above, after account deletion | Deleted or irreversibly anonymised within 30 days, except as below |
| Backups | Purged on our rolling backup cycle, no later than 90 days |
| Invoices and transaction records | Up to 10 years, where tax law requires it |
| Security and access logs | Up to 12 months |
| Records needed to establish or defend legal claims | Until the claim is resolved and the limitation period expires |
| De-identified and aggregated improvement data | Retained indefinitely, as it no longer identifies you |
10. How we protect it
We apply measures appropriate to the risk, including: encryption in transit (TLS) and at rest; encryption of social account tokens with a dedicated key; row-level access controls so one customer's data is not reachable from another's session; least-privilege access for our own staff and contractors, granted only where needed to run or support the Service; access logging; and regular dependency and infrastructure updates.
No system is perfectly secure. If a breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the competent supervisory authority within 72 hours where required, and notify you without undue delay where the risk is high.
11. Cookies and similar technologies
We use:
- Strictly necessary cookies — to keep you signed in, maintain your session and protect against cross-site request forgery. These cannot be switched off and do not require consent.
- Analytics — privacy-friendly, aggregated product analytics to understand how the Service is used.
We do not use advertising or cross-site tracking cookies. Where consent is required for non-essential cookies in your jurisdiction, we ask for it before setting them, and you can change your choice at any time.
12. Your rights
We offer the Service internationally, so more than one data protection regime can apply. We apply the GDPR standard below to everyone, and the country-specific rights that follow are additional.
If you are in the EEA or the UK, you have the right to:
- access the personal data we hold about you, and get a copy;
- rectify data that is inaccurate or incomplete;
- erase your data ("right to be forgotten");
- restrict processing in certain circumstances;
- data portability — receive the data you provided in a structured, commonly used, machine-readable format, or have it sent to another controller;
- object to processing based on legitimate interests, including our Service improvement processing (§6) and any direct marketing — for direct marketing, the right is absolute;
- withdraw consent at any time, where processing is based on consent;
- not be subject to decisions based solely on automated processing that produce legal or similarly significant effects (we do not carry out such processing).
Exercising your rights. Email david@usecloser.ai. We will respond within one month, extendable by two further months for complex requests, and we will tell you if we need the extension. There is no charge unless a request is manifestly unfounded or excessive. We may need to verify your identity first.
In-app self-service. You can export your content and delete your account directly in the app at any time.
Complaints. You can lodge a complaint with your local data protection supervisory authority. We would appreciate the chance to address your concern first.
Colombian residents. We are established in Colombia, so Ley 1581 de 2012 and Decreto 1074 de 2015 apply to our processing. Under those rules you have the right to know, update and rectify your data; to request proof of the authorisation you gave us; to be informed on request how we have used your data; to complain to the Superintendencia de Industria y Comercio (SIC) for breaches of the statute; to revoke your authorisation and request deletion where no legal or contractual duty requires us to keep the data; and to access your data free of charge.
By creating an account and providing your information, you give us your prior, express and informed authorisation (autorización) to process your personal data for the purposes described in §4. Where that data is sensitive (datos sensibles) — see §2.2 — you are not obliged to provide it, and we will not refuse you the Service for declining.
Send consultas and reclamos to david@usecloser.ai. We answer consultations within 10 business days (extendable by 5) and complaints within 15 business days (extendable by 8), as the statute requires. You must exhaust this process before complaining to the SIC.
California residents. If the CCPA/CPRA applies to you, you have rights to know, delete, correct, and opt out of the "sale" or "sharing" of personal information. We do not sell or share personal information as those terms are defined, and we do not process sensitive personal information for purposes requiring an opt-out. You will not be discriminated against for exercising your rights. Use the same contact address above.
13. Children
The Service is not directed at children. You must be at least 18 years old to use Twinfeed. We do not knowingly collect personal data from anyone under 18, and we delete it if we discover we have.
14. Changes to this policy
We may update this policy as the Service changes. The "Last updated" date at the top always reflects the current version. If a change materially affects how we handle your personal data, we will notify you by email or in the app at least 14 days before it takes effect. Continuing to use the Service after that means you accept the updated policy.
15. Contact
David Dominguez
Cra 12 # 116-23
Bogotá D.C.
Colombia
Privacy enquiries and rights requests: david@usecloser.ai
General enquiries: david@usecloser.ai