Data Processing Agreement.
Effective: 8 July 2026
This Data Processing Agreement (“DPA”) forms part of the Terms of Service between you or your organization (“Controller”) and TwinForge (“Processor”) and applies where TwinForge processes personal information on your behalf. Where this DPA conflicts with the Terms, this DPA governs for data processing.
1. Roles & scope
You are the Controller of the content you upload and generate. TwinForge acts as your Processor, processing that content only to provide the Service and only on your documented instructions (which include your use of the product's features).
2. Nature of processing
TwinForge stores your knowledge base and data tables to make them retrievable, distills voice-training uploads into your Twin and then deletes the raw files (within 24 hours), and sends the specific content a request requires to AI inference providers to produce the output you ask for. The categories of data are those you choose to upload; TwinForge does not require special-category data and asks you not to upload it unless necessary.
3. Subprocessors
You authorise the subprocessors listed in our Privacy & Security Statement (§10). We impose data-protection obligations on each subprocessor no less protective than those in this DPA, and remain liable for their performance. We will give notice of a new subprocessor before it begins processing your data, and you may object on reasonable data-protection grounds.
4. Security
We apply database-level row security so one customer's data cannot be read while serving another, encrypt bring-your-own-key secrets with AES-256-GCM at rest, restrict production access, and never use your content to train any AI model. Full detail is in the Privacy & Security Statement.
5. International transfers
We host your database and file storage in an Australian region. AI inference occurs outside Australia (principally the United States) under commercial API terms that prohibit training on your content, as disclosed in the Privacy Statement (§5). If you require onshore-only processing, contact us before uploading regulated material.
6. Assistance, breach & deletion
We assist you with data-subject requests and provide self-serve export and deletion in the product. We will notify you without undue delay after becoming aware of a personal data breach affecting your content. On termination, you may export everything, and your data is deleted on account deletion with residual backups purged within 30 days.
7. Countersigned copy
Procurement teams needing an executed copy on company letterhead can request one via the support address in your account. Using the Service constitutes acceptance of this DPA in the meantime.