Privacy Policy

Twixium AI Inc. ("Twixium AI," "we," "us") operates twixium.ai and LUNA, an AI assistant that businesses use to talk with their customers on WhatsApp and web chat. This policy explains what personal data we collect, why, how long we keep it, who we share it with, and what rights you have. It applies worldwide, and includes the information required by the EU and UK General Data Protection Regulation (GDPR).

• Twixium AI Inc., 221 W 9th St PMB 955, Wilmington, DE 19801, USA.
• Privacy contact: support@twixium.ai. Please use the subject line "Privacy request."
• We have not appointed a Data Protection Officer, because we are not required to under Article 37 GDPR. Our privacy contact handles all data protection questions.

Two roles.

• Controller: for our own customers (the businesses that sign up), website visitors and prospects, Twixium AI decides how data is used. This policy covers that data.
• Processor: when LUNA talks with the customers, guests or patients of a business that uses Twixium AI ("End Customers"), that business is the controller. We process the data only on its instructions, under our Data Processing Addendum. If you are an End Customer, please contact the business directly; we will help it answer your request.

• Account data: your name, email address, phone number, business name, business address, language and password (stored hashed by our authentication provider).
• Billing data: plan, invoices and billing country. Card payments are processed by Stripe; we never see or store full card numbers.
• Business configuration: LUNA's settings, knowledge base, business hours, locations, review links and the content you upload.
• Connected accounts: tokens and basic profile information for the services you choose to connect (Google Calendar, WhatsApp Business, Facebook, Instagram and other social platforms).
• Calendar data: free/busy availability and the events LUNA creates. We do not read the contents of your existing events.
• End Customer data (processor role): WhatsApp and web chat messages; names, phone numbers and email addresses; bookings and reservations; reviews and feedback; and short notes LUNA remembers about returning customers. End Customers may choose to share other information in their messages, such as the reason for a dental appointment. Businesses are responsible for having a lawful basis to collect it.
• WhatsApp Business app users: if you connect a number you also use in the WhatsApp Business app, Meta shares with Twixium your contacts' names and numbers, copies of messages you send from the app (so LUNA can pause in that chat), and — only if you approve it in the app and turn on 'Let LUNA learn from my chats' — up to 6 months of past chats. Twixium never deletes or changes anything on your phone. You can turn history off at any time and we delete the stored copy.
• Support and contact data: what you send us through the contact form, the support chat or email.
• Website usage data: pages visited, device and browser type, and approximate location. Google Analytics collects this only if you accept analytics cookies (see our Cookie Policy).
• Prospect data: we may collect publicly available business contact details (business name, work email, phone) to introduce our services to businesses. You can opt out at any time by replying to any message or writing to support@twixium.ai.

We do not sell personal information, and we do not use it for cross-context behavioral advertising. We do not use your data or End Customer data to train AI models.

LUNA uses large language models to understand messages and draft replies. They are accessed through OpenRouter, Inc., and the model providers include Anthropic, Google, OpenAI and Meta. LUNA does not make decisions that have legal or similarly significant effects on people. A business can always review conversations and take over. Businesses using LUNA must make sure the people LUNA talks with know they are chatting with an AI assistant.

LUNA integrates with third-party services only when you explicitly connect them:

• Google Calendar: to check availability (free/busy) and create booking events. We access only free/busy data and the events LUNA creates; we do not read the contents of your existing calendar events.
• WhatsApp Business API (Meta): to send and receive messages on your behalf.
• Social media platforms: to publish posts you approve, and to read the comments and reviews you ask us to manage.

To generate appointment-booking replies, LUNA sends derived availability (open time-slot options computed from your Google Calendar free/busy data) to OpenRouter, Inc., an AI gateway. Through OpenRouter, requests may be processed by language models operated by Anthropic, Google, OpenAI, and Meta. We do not send the contents of your existing calendar events to any third party. Our OpenRouter account is configured so that no provider retains or trains on this data.

Each integration uses OAuth 2.0 or API tokens. You can disconnect any service at any time from your dashboard, which revokes our access. We also use service providers for hosting and database, AI model processing, messaging, email delivery, payments and website analytics. They process personal data only on our instructions. A list is available on request from support@twixium.ai.

AI assistant connections (Claude, ChatGPT and other MCP clients). If you connect your Twixium account to an AI assistant using our connector (https://mcp.twixium.ai/mcp), you authorize that assistant to access your Twixium business data on your behalf through a secure sign-in (OAuth). What it can access: your business information and LUNA settings, leads, conversations between LUNA and your customers, appointments, reservations, campaigns, social posts, reviews and analytics. What it can do: read this data when you ask, and make changes or send messages only after showing you a preview and receiving your explicit confirmation. Who processes it: the information you request is sent to the AI assistant provider you chose (for example Anthropic for Claude or OpenAI for ChatGPT), which processes it under its own terms and privacy policy; Twixium does not control how those providers retain conversation data. What we keep: we log each connector action (which tool, when, and whether it succeeded) for security and abuse prevention, and keep these logs for up to 12 months. Pending confirmations expire after 10 minutes. We do not use connector data to train AI models. Your choices: you can disconnect at any time from your assistant's settings, which ends its access immediately, or contact support@twixium.ai to revoke all sessions.

Twixium AI is based in the United States, and our database is hosted in the United States (Amazon Web Services, us-east-1, via Supabase). When we transfer personal data from the EEA, the UK or Switzerland, we rely on:

• the European Commission's Standard Contractual Clauses (2021/914), plus the UK Addendum where applicable, which are incorporated into our DPA and our agreements with providers; and
• where a provider is certified, the EU-U.S. Data Privacy Framework and its UK and Swiss extensions.

You can ask us for a copy of the relevant safeguards.

• Data is encrypted in transit (TLS 1.2+) and at rest.
• Row-level security ensures each business can access only its own data.
• Staff access follows least privilege.
• Access tokens for connected services are stored server-side in access-restricted tables and are never exposed in logs or API responses.

No system is perfectly secure. If a breach affects your data, we will notify you and the authorities as the law requires.

Depending on where you live (including the EEA, the UK and many US states), you may have the right to:

• access your data and get a copy of it;
• correct inaccurate data;
• delete your data;
• restrict how we use it;
• receive it in a portable format;
• object to processing based on legitimate interests, including an absolute right to object to direct marketing;
• withdraw consent at any time, without affecting earlier processing;
• complain to your data protection authority, for example the authority in the EU country where you live or work.

How to make a request. Email support@twixium.ai with the subject "Privacy request", or use our Contact page. We reply within one month, and we may ask you to verify your identity. For account deletion steps, see Data Deletion. End Customers should contact the business they spoke with; we will help that business respond.

Our services are for businesses and are not directed to anyone under 18. We do not knowingly collect children's data for our own purposes.

Twixium AI's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Specifically: raw or derived user data obtained from Google Workspace APIs (including Google Calendar free/busy data and any data derived from it) is used only to provide and improve the user-facing appointment-booking features you request. This data is never used, transferred, or sold to develop, train, or improve any generalized or foundational artificial intelligence or machine learning models. Where LUNA uses AI models to generate responses, those models are accessed via providers who are contractually prohibited from — and configured not to — train on this data.

We will post updates on this page and change the "Last updated" date. For material changes, we will also notify account holders by email.

Twixium AI Inc., 221 W 9th St PMB 955, Wilmington, DE 19801, USA · support@twixium.ai · twixium.ai/contact