Privacy Policy
Introduction
Twistag is an applied AI company based in Lisbon, Portugal. This Privacy Policy explains what personal data we collect when you visit our website (https://twistag.com) or contact us, why we collect it, how long we keep it, who we share it with, and the rights you have. It is written to meet the EU General Data Protection Regulation (GDPR) and Portuguese data-protection law.
Who is the Data Controller?
Twistag Sociedade Unipessoal Lda
Av. de Berna, 30, 2B
1050-048 Lisbon, Portugal
Email: hello@twistag.com
Phone: +351 916 131 035
Twistag is incorporated and registered in Portugal. We have not appointed a Data Protection Officer; for any privacy question or request, write to hello@twistag.com.
What Personal Data We Collect
Data you give us
- Contact form: your name, work email, company (optional), the areas you are interested in, your message, how you heard about us (optional), and the page you sent it from.
- Campaign attribution with any form you send: the campaign parameters (such as utm_source, utm_medium and utm_campaign), ad click identifiers, the referring website and the landing page of the visits that brought you to our website. See How We Use Cookies.
- Newsletter sign-up: your email address.
- Booking a call: if you choose to book a time after sending a message, the details you enter in the Google Calendar booking window (usually your name and email).
- Job applications: the details and documents you send to careers@twistag.com.
- Emails and calls: whatever you choose to share when you contact us directly.
Data collected automatically
- Server logs: when your browser requests a page, our hosting provider processes technical data such as your IP address, browser type, the page requested and the time. This is needed to deliver the website and protect it from abuse.
- Analytics, only with your consent: the pages you view, the website that referred you, approximate location derived from your IP address, device and browser type, and a small set of named interactions (for example, opening the contact form). See How We Use Cookies.
- Company recognition, only with your consent: the pages you view and your IP address, which Apollo.io uses to identify the company the visit comes from. See How We Use Cookies.
You do not have to give us any personal data. We need your name and email to reply to a message or send the newsletter; without them we cannot do so.
Why We Use Your Data and Our Legal Basis
| Purpose | Data | Legal basis (GDPR Art. 6) |
|---|---|---|
| Replying to your message and preparing a proposal | Contact form, emails, calls | Steps you ask us to take before a contract (6(1)(b)); our legitimate interest in answering business enquiries (6(1)(f)) |
| Sending you a confirmation of your message | Name, email | Legitimate interest (6(1)(f)) |
| Arranging a call you book | Booking details | Steps you ask us to take before a contract (6(1)(b)) |
| Delivering services to clients and managing the relationship | Business contact details | Contract (6(1)(b)) |
| Sending the newsletter | Consent (6(1)(a)); you can unsubscribe at any time | |
| Sending a playbook worksheet you request, and following up about it | Email, the worksheet requested | Steps you ask us to take (6(1)(b)); our legitimate interest in following up on the request (6(1)(f)) |
| Assessing job applications | Application details | Steps you ask us to take before a contract (6(1)(b)) |
| Hosting and protecting the website | Server logs | Legitimate interest in running a secure website (6(1)(f)) |
| Understanding how the website is used, to improve it | Analytics data | Consent (6(1)(a), and the Portuguese ePrivacy rules for cookies) |
| Recognising which companies visit, so we can follow up with relevant outreach | Company recognition data | Consent (6(1)(a), and the Portuguese ePrivacy rules for cookies) |
| Keeping accounting and tax records | Client billing details | Legal obligation (6(1)(c)) |
Where we rely on legitimate interest, our interest is to answer the people who contact us and to keep the website working and secure. You can object to this processing at any time (see Your Rights). We do not use your data for automated decision-making or profiling that has legal or similarly significant effects on you.
How We Use Cookies
Our website uses one necessary cookie, which records your cookie choice. Analytics and marketing cookies are set only if you accept them in the cookie banner, and you can accept one category without the other. Until you choose, and if you reject them, no analytics or marketing scripts are loaded and no such data is sent from your browser. Vercel Web Analytics and Speed Insights, in the analytics category, set no cookies. We do not use advertising cookies.
| Name | Provider | Purpose | Category | Duration |
|---|---|---|---|---|
| tw_consent | Twistag | Stores your cookie choice | Necessary | 6 months |
| tw_attr_first (local storage) | Twistag | Records how your first visit arrived (campaign parameters, referring site, landing page) | Lead attribution | 90 days |
| tw_attr_last (session storage) | Twistag | Records how the current visit arrived | Lead attribution | Until the browser tab closes |
| _ga, _ga_* | Google Analytics 4 | Distinguishes visitors and sessions for usage statistics | Analytics | Up to 2 years |
| ph_*_posthog (cookie and local storage) | PostHog (EU cloud) | Distinguishes visitors and sessions for usage statistics | Analytics | Up to 1 year |
| Cookies and local storage set by the tracker (including liveIntentData) | Apollo.io, with LiveIntent | Recognises the company a visit comes from | Marketing | As set by Apollo.io |
Analytics records the pages you view and a small set of named interactions, such as opening the contact form or completing the service finder. PostHog also records session replays (mouse movement, clicks and scrolling) to show where pages are hard to use; everything typed into forms is masked and never recorded. Google Analytics runs with Google Consent Mode, with advertising storage and advertising personalisation denied.
The lead attribution records stay in your browser. They are sent to us only when you submit a form, so we can see which channels bring enquiries, and you can clear them at any time from your browser’s site-data settings.
Changing or Withdrawing Your Consent
You can change your choice at any time through the Cookie Settings link in the footer of every page. If you withdraw consent, we delete the analytics or marketing cookies and local storage set on our domain, and those scripts stop loading. Withdrawing consent does not affect processing that took place before you withdrew it.
Who We Share Your Data With
We do not sell your personal data. Inside Twistag, only the people who need it to do their work can see it. Outside Twistag, we share it only with the service providers below, who process it on our behalf under data-processing agreements, and with professional advisers or public authorities when the law requires it.
- Vercel Inc. (USA, website hosting): processes server-log data to deliver the website and protect it from abuse.
- Resend Inc. (USA, email delivery): delivers the messages you submit through our contact and newsletter forms to our team, and the confirmation email to you; it also holds the newsletter list, which an address joins only after confirming the subscription from the link we email to it, and a list of the people who requested a playbook worksheet, so we can follow up about it.
- Cloudflare Inc. (USA, Turnstile spam check): when you start using one of our forms, checks that a person rather than an automated script is sending it. It processes technical data such as your IP address and browser signals, sets no tracking cookies, and is strictly necessary to keep the forms free of spam.
- Google Ireland Limited (Google Analytics 4): usage statistics, only with your consent.
- PostHog Inc. (PostHog, data hosted in the EU): usage statistics, only with your consent.
- Vercel Inc. (Web Analytics and Speed Insights): cookieless usage and page-speed statistics, only with your consent.
- Apollo.io (ZenLeads Inc., USA), with LiveIntent: company recognition for sales follow-up, only with your marketing consent.
- Google LLC (USA, Google Calendar appointment schedules): only if you choose to book a call; the booking window loads from Google when you open it, and Google processes the details you enter.
- Google Ireland Limited (Google Workspace): our email, where your messages to us and our replies are stored.
International Transfers
Some of these providers are based in the United States or may access data from there. Each transfer is covered by an appropriate safeguard under GDPR Chapter V: the provider’s certification under the EU-US Data Privacy Framework, or the European Commission’s Standard Contractual Clauses. You can ask us for a copy of the relevant safeguard.
How Long We Keep Your Data
| Data | How long |
|---|---|
| Enquiries that do not lead to a project | 24 months after our last exchange |
| Worksheet requests | 24 months after the request, or until you ask us to delete them |
| Client contact and project records | For the duration of the relationship, then 5 years |
| Accounting and tax records | 10 years, as required by Portuguese law |
| Newsletter email | Until you unsubscribe |
| Job applications | 12 months after the recruitment process ends, or longer with your consent |
| Server logs | Kept by our hosting provider for a short period, normally up to 30 days |
| Analytics data | Up to 14 months, then deleted automatically |
Data Security
We protect personal data with technical and organisational measures that follow our ISO/IEC 27001 information-security practice, including encryption in transit, access controls limited to the people who need them, and secure providers. No method of transmission over the internet is completely secure, but we work to keep your data safe and to act quickly if anything goes wrong.
Your Rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have your data erased;
- restrict how we use your data;
- receive the data you gave us in a portable format;
- object to processing based on legitimate interest, and to direct marketing at any time;
- withdraw your consent at any time, where we rely on consent.
To exercise any of these rights, write to hello@twistag.com. We will reply within one month. You also have the right to lodge a complaint with a supervisory authority. In Portugal this is the Comissão Nacional de Proteção de Dados (CNPD), www.cnpd.pt; you can also complain to the authority in the EU country where you live or work.
Children
Our website and services are aimed at businesses and are not directed at children under 16. We do not knowingly collect personal data from children.
Updates to This Policy
We may update this Privacy Policy when our services or the law change. The date at the top shows when it was last updated, and the latest version is always available on this page.