Privacy Policy

Who is responsible

Twerll operates the Twerll apps and sites, including app.twerll.com. Twerll is operated as a sole proprietorship based in Canada and is accountable for your personal information under PIPEDA and similar laws. Privacy contact: legal@twerll.com.

This policy covers the Service. It does not cover what other users do with documents and information you choose to share with them.

What we collect

You provide: account details (email, username, optional profile and photo; passwords are stored hashed by our authentication provider), documents and agreements, signatures and signing media (drawn or typed signatures, voice or video where you use them), Evidence Vault files, messages in chats and rooms, your connections, contact details of people you invite (you confirm you may share them), and support messages.

Collected automatically: signing and custody records (timestamps, verification events, IP address, device and browser details tied to signing and evidence events), usage and crash data via Google Firebase, and cookies or local storage on the web needed for sign-in and preferences. No third-party advertising cookies.

Why we use it

• Provide the Service: store and deliver documents, run signature requests, chats, rooms, certificates.
• Integrity and trust: custody ledgers, audit records, tamper-evidence, public certificate verification.
• AI features you invoke.
• Payments, if and when paid subscriptions are offered.
• Communications: one-time codes, signing requests, receipts, security notices; product news only with consent.
• Safety: preventing fraud, spam, and abuse; acting on reports.
• Improvement: analytics and debugging.
• Legal compliance.

We do not sell your personal information, and we do not use the content of your documents, evidence, or messages for advertising.

AI processing

When you use an AI feature, the content that feature needs (for example document text you ask about, or a drafting prompt) is sent to third-party AI model providers (currently Anthropic's Claude models, accessed through an API gateway) to generate the response. We send only what the feature needs, and our agreements do not permit these providers to use your content to train their models. AI usage may be metered per account.

Who we share it with

• People you choose: counterparties, signers, room and chat participants, and anyone you give a signing, verification, or invite link to.
• Service providers: Google (Firebase: authentication, database, storage, functions, hosting, analytics, notifications), payment providers if and when paid subscriptions are offered (we never store full card numbers), AI model providers, and email delivery providers.
• Legal: when required by law or valid legal process, or to protect the rights and safety of Twerll, our users, or the public.
• Business transfer: if the Service is reorganized or sold, your information transfers under the same protections, with notice of material changes.

Where it is stored

The Service runs on Google Cloud infrastructure; your information may be stored and processed in the United States and other countries where our providers operate, which may have different data protection laws. We use providers committed to appropriate safeguards, including standard contractual clauses where required.

How long we keep it

• Account data: while your account exists, then deleted or anonymized within a reasonable period.
• Deleted items: trash grace period (currently 10 days), then permanent deletion; brief residual copies in backups.
• Signed agreements, signing records, custody ledgers: shared records, kept as long as reasonably necessary for the parties who rely on them and for legal purposes, even if one party deletes their account.
• Payment records: as required by tax and accounting law.

Your rights

Subject to shared-record retention and applicable law, you can: access your personal information and how it has been used and shared; correct it (much of it directly in the app); delete your account and content, in-app or by email; withdraw consent where processing is based on consent; and, where the GDPR or UK GDPR applies, request portability or restriction, object to legitimate-interest processing, and complain to your supervisory authority.

Use the in-app controls or email legal@twerll.com. We may verify it is really you first. If unsatisfied with our response, you may contact the Office of the Privacy Commissioner of Canada (priv.gc.ca).

Security

We protect your information with encryption in transit, encrypted cloud storage, sealed evidence storage with integrity hashes, tamper-evident custody ledgers, access controls, and security rules restricting who can read what. No system is perfectly secure; if a breach creates a real risk of significant harm, we will notify you and the relevant authorities as required by law.

Email and messages

We send transactional messages needed to run the Service (one-time codes, signature requests you are a party to, receipts, security notices). Marketing messages are sent only with your consent and always include a working unsubscribe (per Canada's anti-spam law, CASL). Signature requests and invites are sent at the request of the user who initiated them and identify that user as the sender.

Children

The Service is for adults (18+, or the age of majority where you live) and is not directed to children. We do not knowingly collect personal information from children; if you believe a child has an account, contact us and we will delete it.

Changes to this policy

We may update this policy as the Service evolves. For material changes we give notice in-app or by email before the new version takes effect and update the effective date. Prior versions are available on request.

Contact

Privacy questions, access requests, and complaints: legal@twerll.com.