Privacy notice (draft for legal review)

Who is responsible

Controller: [organisation name and contact]. Data protection contact: [DPO or privacy contact]. Twinosys acts for the controller as [processor / controller, to be confirmed].

What we process and why

• Account data (name, email, password hash, workspace membership): to provide and secure your account.
• Captured knowledge (Work mode and Expert mode): transcripts of what you choose to record, occasional screenshots if you turn Screen share on, files you attach, questions and your answers, and summaries you confirm. Used to build the expert's Virtual Apprentice and to guide colleagues. Recording only happens while you have a session running, and you can pause or stop at any time.
• Guide mode requests: what a learner types and, only if they choose, a single snapshot of their screen. Used once to answer that request, then discarded. They are not stored.
• Security and audit logs: who did what and when (for example “capture deleted”), without the content of captures, questions or answers.
• Service usage metrics: counts derived from those logs (for example how many guide requests a person or team made, and whether answers were supported by evidence), used to run, support and improve the service. No captured content. Legal basis: [legitimate interests, to be confirmed]; you can object via [privacy contact].
• Sharing: an expert's captured knowledge is only available to the colleagues that expert chooses (or the whole organisation, if they choose that and the organisation allows it).
• Support access: Twinosys support staff cannot see captured content unless a manager of your organisation grants time-limited access. Every view is recorded and shown in your organisation's Activity. Support staff may keep internal notes about account help; these never contain captured content.
• Optional usage analytics: only if you turn it on in settings. Anonymous event names, timings and outcomes, never what you type, say or share. Kept for 90 days; turning it off deletes it.

Legal basis: [to be confirmed by the controller for each purpose, e.g. contract, legitimate interests, or consent for optional analytics].

AI processing

To generate questions, summaries and guidance, relevant text (and, only where this deployment has enabled it, images) is sent to the AI provider chosen for this deployment: [provider, region, and data-retention terms]. Answers are limited to the expert's published captures and are decision support. You remain responsible for decisions you make.

Transcription

Speech may be transcribed by your browser. Some browsers (for example Chrome) send audio to the browser vendor's speech service; others transcribe on your device. Audio and video recordings are not kept: only the text and any screenshots you allow.

How long we keep it, and deleting it

Captures are kept until they are deleted. The person who captured a session, or a workspace manager, can permanently delete it and everything derived from it (transcript, screenshots, attachments, summaries, questions and answers, generated documents) from the review page. Guidance stops using it immediately. Deleted captures are also removed again if a backup is ever restored. Account and audit retention: [periods to be set by the controller].

Your rights

You can ask to access, correct, export or delete your data, object to processing, or withdraw consent for optional analytics at any time in settings. Contact: [privacy contact]. You can also complain to the UK Information Commissioner's Office or your local supervisory authority.