Privacy Policy

Effective date: September 15, 2026
Last updated: September 15, 2026

1. Introduction and identity of the controller

Twaali respects your privacy and is committed to processing personal data lawfully, fairly and transparently.

Twaali is a service for managing social media accounts and creating, storing, scheduling and publishing content. It is owned and operated by:

KEYZSOFT LTD
A private limited company registered in England and Wales under company number 14394329
Registered office: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.

For data-protection purposes, KEYZSOFT LTD acts as the controller of personal data relating to the creation and administration of Twaali accounts, billing, security, and operational and marketing communications. Where a user, acting as a business, organisation or freelancer, processes other people’s data through content or social accounts managed using Twaali, KEYZSOFT LTD may act as a processor on that user’s behalf. The user remains responsible for having a lawful basis and issuing lawful instructions for that processing.

This policy covers the main website at https://twaali.com, the Twaali application at https://app.twaali.com, and services connected with them.

2. Scope of the service and age requirement

Twaali is intended for businesses, organisations, freelancers and professional use. This does not mean that the service is available exclusively for business-to-business transactions.

You must be at least 18 years old to use Twaali. We do not target children or knowingly collect their personal data. If you believe that a person under 18 has provided personal data to Twaali, contact us at privacy@twaali.com so that we can take appropriate action.

3. Personal data we collect

3.1 Registration and account data

When an account is created, we collect:

• full name;
• email address;
• username;
• time zone;
• password in a technically protected form; we do not store it as readable plain text;
• a record of acceptance of applicable terms and policies, where available; and
• account settings, including language, security and two-factor authentication settings.

We do not currently request a telephone number or city during registration.

3.2 Team and workspace data

When team features are used, we may process:

• the team and workspace name;
• member invitations and email addresses;
• roles, permissions and social accounts assigned to each member; and
• the identity of the team owner and records of actions associated with team administration.

Where a team remains active, its owner must transfer ownership to another member before the owner’s account can be deleted.

3.3 Connected social-account data

When you choose to connect a social account, page or profile, we receive and store data made available by the relevant platform under the permissions you approve. This may include:

• account or page name, username, external identifier and profile image;
• access tokens, refresh tokens and authorisation data required to maintain the connection;
• pages and accounts you are authorised to manage;
• connection status, permissions and token expiry information;
• content you choose to publish or schedule, publishing status and the resulting post identifier; and
• limited data needed to perform a function you requested or diagnose a connection or publishing failure.

Depending on availability and activation, Twaali may integrate with Facebook, Instagram, Threads, LinkedIn, X, TikTok, YouTube, Pinterest, Google Business Profile and other destinations selected directly by the user.

Twaali does not automatically collect all information in your social account. We do not claim access to friends, private messages, comments, likes, followers or analytics unless a specific feature has been activated, the necessary permissions have been granted and the data is required to provide that feature. The current version does not retrieve social-account analytics. We will update this policy before activating a new analytics module if doing so introduces additional processing.

Data obtained from Meta platforms is also handled in accordance with applicable Meta Platform Terms and policies.

3.4 Content and media

We process content that you enter or upload, including:

• text, titles, captions, links and hashtags;
• images, videos and attached files;
• drafts and scheduled or published posts;
• publishing date and time, time zone and selected channels;
• execution status and technical failure messages; and
• copies you create to reuse a post within Twaali.

After publication, a copy of the content and its status record may remain in Twaali until you delete them or the account is deleted under this policy. Deleting Twaali’s copy does not automatically delete the copy published on a social platform. When a Twaali account is deleted, posts already published on social platforms remain there, while Twaali deletes its copy under its deletion procedures unless the law requires limited information to be retained.

3.5 Payment and subscription data

When you purchase a paid plan, Stripe processes payment information. Twaali does not normally receive the full card number or security code. We may receive information from Stripe such as:

• payer name, email address and billing address, depending on what the user provides;
• customer, subscription or payment identifier;
• payment-method type, last four digits and payment status; and
• amount, currency, tax, invoices and refunds.

Entry and processing of card information is also governed by Stripe’s privacy terms. Current prices are stated in US dollars, and taxes may be calculated according to the customer’s country and applicable legal requirements.

3.6 Communications and support

We process messages sent to support or privacy contacts, their content and attachments, and records of handling and resolving requests. We may also process your marketing-subscription preferences and delivery, opening, click and unsubscribe records to the extent provided by the email service in use and permitted by law.

3.7 Technical and usage data

We may automatically collect:

• IP address, date and time;
• browser and device type and operating system;
• pages or features used and basic navigation information;
• session, login and authentication-attempt data;
• error, performance and security logs; and
• technical identifiers required to prevent fraud and abuse.

We do not intend to record passwords or complete access tokens in application logs. If we discover that a secret has appeared in a log, we treat this as a security incident, remove it and take appropriate rotation or revocation action.

4. Cookies and similar technologies

The public website at twaali.com uses cookies and similar technologies necessary to operate its essential functions, remember the visitor’s selected language, record consent choices and support the correct display of certain website elements.

At the effective date of this policy, we do not intentionally activate non-essential analytics, advertising or behavioural-targeting cookies on the public website. If we introduce analytics, marketing or other optional technologies in the future, we will update our disclosures and cookie list and request consent before activating them where legally required.

When the cookie banner is displayed, you can accept or reject optional cookies or customise your choices. You may later change your choice or withdraw consent through the Cookie Settings link in the website footer or the displayed consent-settings button. You can also delete or block cookies through your browser settings.

The Twaali application at app.twaali.com may use separate technologies required for authentication, account security, sessions and operation of the service. Its technology list will be updated when its inventory has been completed and verified.

For details, read our Cookie Policy.

5. Why we use personal data and our lawful bases

Purpose	Usual lawful basis
Creating an account, signing in, managing a team and providing the service	Performance of a contract or steps taken before entering into a contract
Connecting social accounts and storing, scheduling and publishing content at your direction	Performance of a contract and the user’s instructions
Managing subscriptions, invoices and payments	Performance of a contract and compliance with legal obligations
Support, operational communications and service notifications	Performance of a contract and our legitimate interest in supporting the service
Protecting accounts, preventing fraud and investigating faults or abuse	Legitimate interests and legal obligations
Keeping financial records and complying with lawful requests	Compliance with legal obligations
Improving performance and understanding use	Legitimate interests, or consent where required
Direct marketing	Consent or legitimate interests where permitted by law, always subject to the right to object
Establishing, exercising or defending legal claims	Legitimate interests and legal obligations

When we rely on legitimate interests, we balance those interests against the user’s rights. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of earlier processing.

6. How we share personal data

We do not sell your personal data. We may share only the data reasonably necessary with:

• social platforms you choose to connect, to perform connection, publishing, deletion and requested functions;
• Stripe, to process payments, subscriptions, taxes and related refunds;
• hosting, infrastructure and backup providers;
• operational and marketing email providers;
• analytics and performance-measurement providers, where lawfully activated;
• security, error-monitoring and technical-support providers where needed;
• advisers, auditors and competent authorities where required by law or necessary to protect rights; and
• an organisation acquiring or merging with all or part of our business, subject to appropriate safeguards.

We maintain a separate list of relevant service providers and processors so that operational providers can be updated without making this core policy misleading. Where made available, that list forms part of our privacy information.

7. International transfers

We are a UK company. Personal data may be processed in the United Kingdom, the European Economic Area or other countries where service providers or social platforms selected by you operate.

Where the law requires safeguards for an international transfer, we use an appropriate mechanism, such as an adequacy decision, the UK International Data Transfer Agreement, the UK Addendum to the EU Standard Contractual Clauses, or the EU Standard Contractual Clauses, with supplementary measures where necessary.

8. Data security

We apply technical and organisational measures appropriate to the risks. Depending on the nature of the data, these include:

• HTTPS encryption for data in transit;
• password hashing and no storage of passwords as readable plain text;
• encryption of stored social-account credentials in the database;
• need-based restrictions on administrative access;
• two-factor authentication available to users;
• backups, monitoring and security updates; and
• measures to minimise exposure of secrets in logs and review error logs.

No electronic method is absolutely secure. If a personal-data breach occurs, we will assess it, contain it and notify the supervisory authority or affected individuals where required by law.

9. Data retention

We retain personal data only for as long as necessary for the purposes set out in this policy, taking account of its nature, associated risks and legal obligations.

• Account data and content remain while the service is used and for as long as necessary to provide it, unless the user deletes specific content sooner.
• When a subscription ends, the account may become restricted according to the applicable plan status. A user may request an export or account deletion through privacy@twaali.com. After verification, we delete or anonymise the data unless the law requires limited information to be retained.
• We may retain financial records and invoices for the period required under tax and accounting laws.
• Security, support and error logs are retained for a period proportionate to their purpose and then deleted or anonymised.
• Deleted data may remain for a limited period in rotating backups. It is not used for ordinary purposes while there and is removed as the backups rotate under the operational schedule.
• Deletion may be suspended to the extent necessary to comply with a legal obligation or court order, prevent fraud, or establish, exercise or defend a legal claim.

10. Disconnecting social accounts and deleting platform data

You can use the delete or disconnect option displayed next to each connected social account. Once confirmed, Twaali deletes the account connection, tokens and associated authorisation data from the operational database and stops using that connection.

You may also be able to revoke Twaali’s access through the social platform’s settings. Revoking permission on the platform alone does not necessarily delete every copy stored in Twaali, so you should also use Twaali’s deletion option or submit a deletion request.

Disconnecting an account or deleting a Twaali account does not automatically remove posts previously published on Facebook, Instagram or another platform. Those posts remain on the social platform until you delete them there or intentionally use a supported deletion function within Twaali.

For Meta data, you may also use our Data Deletion Instructions or email privacy@twaali.com. Twaali may also receive a deauthorisation notice or deletion request from Meta and process connection data in accordance with Meta’s applicable requirements.

11. Deleting a Twaali account

The user dashboard does not currently provide a self-service control to delete a complete Twaali account. To request deletion:

1. Send the request from the email address associated with the account to privacy@twaali.com.
2. Use the subject line Twaali Account Deletion Request.
3. Include the username or email address associated with the account, but do not send your password or access tokens.
4. We may request reasonable identity verification to protect the account from unauthorised deletion.

If you own a team, you must transfer its ownership to another member or request deletion of the team and its data before your account deletion can be completed. After verification, we delete or anonymise account data, content, media and social connections, subject to the legal and backup exceptions described above.

12. Your rights

Depending on the applicable law, you may have the right to:

• know whether we process your personal data and obtain a copy;
• correct inaccurate data and complete incomplete data;
• request deletion where the law provides that right;
• restrict or object to processing;
• receive data you provided in a structured, commonly used and machine-readable format where the right to data portability applies;
• withdraw consent at any time where consent is the lawful basis;
• object to direct marketing at any time and unsubscribe through a message; and
• lodge a complaint with a competent supervisory authority.

We respond without undue delay and within the legally applicable period, normally one month under UK data-protection law. This period may be extended for complex requests as permitted by law and after informing the requester.

We may refuse or limit a request where the law permits, for example where it conflicts with another person’s rights or a legal obligation. We will explain the reason where required.

You may contact us at privacy@twaali.com. You may also complain to the UK Information Commissioner’s Office at https://ico.org.uk. We encourage you to contact us first so that we can try to resolve the matter.

13. Responsibilities of business users

If you use Twaali to manage data or content relating to your clients, employees or audience, you are responsible for:

• having authority to connect and manage the social accounts;
• providing required notices and obtaining any necessary consents from data subjects;
• lawfully selecting content, audience and publishing time;
• respecting privacy and intellectual-property rights and each social platform’s terms;
• managing team-member permissions and removing access from anyone no longer authorised; and
• not uploading personal data that the service does not need, or sensitive data without necessity and an appropriate lawful basis.

14. External links and services

The service may contain links or functions that take you to external websites or platforms. The external organisation controls its independent processing under its own policy. This policy does not cover practices for which Twaali does not determine the purposes and means.

You can also read our Cookie Policy to understand the technologies used on the public website and how to manage your choices.

15. Changes to this policy

We may update this policy when the service, providers or law changes. We will publish the new version with a clear revision date. If a change is material, we will make reasonable efforts to inform users, such as by email or a prominent notice on the website or in the application, before it takes effect where appropriate.

We do not treat continued use of the service as consent where the law requires fresh affirmative consent.

16. Contact us

For privacy enquiries, rights requests and data deletion:

Privacy: privacy@twaali.com
Support: support@twaali.com
Company: KEYZSOFT LTD, company number 14394329
Address: 71–75 Shelton Street, Covent Garden, London, WC2H 9JQ, United Kingdom.