Privacy Policy

Last updated: 9 October 2026

This Privacy Policy explains how Mykey Digital ("Mykey Digital", "we", "us", or "our"), the company behind the Twindem products, collects, uses, discloses, and protects personal data when you use the Twindem Team product (the desktop application, control plane, and delivery board), the Twindem Suite applications (such as Twindem Pulse), and the twindem.ai website (together, the "Services"). Mykey Digital operates from Romania, European Union, and processes personal data in accordance with the EU General Data Protection Regulation (GDPR).

Data controller: SC MYKEY DIGITAL SRL, Str. C-tin Radulescu Motru nr. 12, Bl. 27B-28, sector 4, Bucharest, Romania. Registered with the Trade Register under no. J40/14943/2021, sole registration code (CUI) RO44820207.

1. Information we collect

We collect only the data needed to operate the Services:

• Account & identity data — name, work email, and sign-in identifier (including Microsoft Entra ID identifiers when you sign in with your organization).
• Organization & seat data — your organization, projects, team members, seat assignments, roles, and subscription/billing metadata received from Microsoft Azure Marketplace (we do not receive or store your payment card details).
• Product usage & telemetry — records of agent runs, token usage, work-item activity, review findings, and related operational metrics used for coordination, usage visibility, and metered billing.
• Content you provide — work items, comments, project documents (Docs), knowledge-base notes, and Project Library artifacts you create in the Services.
• Support communications — messages, attachments, and contact details you send us for support or sales.
• Website data — standard log data and analytics from twindem.ai (see Cookies).

AI coding agents run locally on the operator's machine, where your source code resides. We do not receive your source code repositories; only the plans, status, evidence, and usage telemetry you push to the board are stored in the Services.

2. Twindem Pulse: email, calendar & connected accounts

Twindem Pulse is a native macOS email and calendar application. When you connect a Google (Gmail, Google Calendar) or Microsoft 365 / Outlook account, Pulse accesses that account directly from your Mac through the provider's official APIs (Gmail API, Google Calendar API, Microsoft Graph) or IMAP, using the permissions you grant on the provider's consent screen.

What Pulse accesses and why

• Email — Pulse reads, organizes (read/unread, flags, folders and labels, categories), moves, and deletes messages, and sends messages and drafts that you write, so that it can work as your email client.
• Calendar — Pulse reads your calendars and events, shows free/busy availability, and creates, updates, or responds to events you choose, so that it can work as your calendar.
• Basic profile — your name and email address, to identify the connected account.

Where your data is stored

Your messages, attachments, and calendar events are stored only on your Mac, in Pulse's local database, so you can read and search them offline. Access and refresh tokens are stored in the macOS Keychain. Mykey Digital does not receive, store, or have access to your mailbox or calendar data. Archives you export from Pulse (".pulse" files) are created on your Mac and remain under your control.

Vio, the optional AI assistant

Pulse includes Vio, an optional AI assistant that only acts when you ask it to (for example, to summarize a message, draft a reply, or answer a question about your email). For that request only, Pulse sends the relevant excerpt (such as the message you are reading or the search results you selected) to the Twindem service, which forwards it to Azure OpenAI (Microsoft, EU region — Sweden Central) to generate the answer, and returns the answer to your Mac. We do not store the content of these requests or answers; we keep only content-free usage records (for example, token counts and timing) for usage limits and billing. Azure OpenAI does not use this data to train models.

If you enable Vio's writing-style learning, Pulse sends a small set of messages you wrote (up to 30) so that Vio can derive a short description of your writing style (for example, tone and greeting preferences). Only that derived style description is stored, linked to your Twindem account; the sample messages themselves are not stored. You can turn learning off or reset the style profile at any time in Pulse settings. Vio can be disabled entirely.

Google API Services User Data Policy

Twindem Pulse's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. In particular, data obtained through Google APIs is used only to provide and improve user-facing features of Pulse that you request; it is never sold, never used for advertising, never used to train or improve generalized AI or machine-learning models, and is not read by humans unless you give explicit permission for a specific message (for example, in a support request), it is necessary for security purposes, or it is required by law.

Revoking access and deleting data

You can disconnect an account at any time from Pulse (Settings → Accounts), which deletes its local data and tokens from your Mac. You can also revoke Pulse's access from your provider account: for Google at myaccount.google.com/permissions, and for Microsoft at myapps.microsoft.com or through your organization's administrator. Uninstalling Pulse and removing its data folder deletes all locally stored mail and calendar data.

3. How we use information

• Provide, operate, secure, and improve the Services.
• Authenticate users and enforce organization, project, and seat access.
• Coordinate delivery work and provide usage, cost, and audit visibility.
• Calculate and report metered usage for Azure Marketplace billing.
• Provide support and respond to your requests.
• Comply with legal obligations and protect against fraud and abuse.

4. Legal bases (GDPR)

We process personal data to perform our contract with you (providing the Services), for our legitimate interests (securing and improving the Services, preventing abuse), to comply with legal obligations, and with your consent where required (for example, non-essential website analytics).

5. Hosting & sub-processors

The Services run entirely on Microsoft Azure. We use a limited set of sub-processors:

6. How we share information

We do not sell personal data. We share it only with the sub-processors above, with Microsoft as the marketplace and billing provider for subscription and metered-usage reporting, when required by law, or to protect our rights and users.

7. International transfers

Personal data is primarily processed within the EU. Where a sub-processor processes data outside the EU, we rely on appropriate safeguards such as the European Commission's Standard Contractual Clauses.

8. Data retention

We retain personal data for as long as your account or organization is active and as needed to provide the Services, then delete or anonymize it within a reasonable period, unless a longer period is required by law (for example, billing records).

9. Security

We apply strong technical and organizational measures, including multi-tenant isolation enforced by PostgreSQL Row-Level Security, encryption in transit and at rest, secret management in Azure Key Vault, a network-private database, and least-privilege access controls.

10. Your rights

Subject to applicable law, you have the right to access, correct, delete, restrict, or object to the processing of your personal data, and to data portability. You may also withdraw consent and lodge a complaint with your supervisory authority (in Romania, the ANSPDCP). To exercise your rights, contact us at hello@twindem.ai. If you use Twindem Team through an organization, that organization is the controller of its content and you should also contact them.

11. Cookies & analytics

twindem.ai uses essential cookies required for the site to function and Google Analytics to understand aggregate usage. You can control cookies through your browser settings. The Twindem Team application uses only cookies and tokens necessary for authentication and session management.

12. Children

The Services are intended for business use and are not directed to children under 16.

13. Changes to this policy

We may update this policy from time to time. Material changes will be reflected by updating the "Last updated" date above and, where appropriate, by additional notice.

14. Contact

Questions or requests regarding this policy or your personal data: hello@twindem.ai.