Privacy Policy

Last updated: September 8, 2026

1. Personal data we collect

• Account data: your email address, authentication identifiers from our login provider (ZITADEL), plan, and preferences.
• Connected X account data: session cookies and tokens, optional login credentials and two-factor authentication secrets you choose to provide, profile name, handle and avatar, assigned proxy, and account health state.
• Proxy configurations: IP/host, port, and credentials for proxies you register.
• Lead lists and campaigns: scraped or imported prospect handles/profiles, message templates, campaign settings, delivery statistics.
• Conversations: messages sent/received through connected accounts so your unified inbox can display them.
• Usage and device data: pages and features used, interactions, approximate location derived from IP address, browser, device, referring URL, and identifiers used for product analytics.
• Operational data: IP addresses, job runs, error reports, diagnostic details, and administrative audit events.
• Support and billing data: messages you send us and, when billing is enabled, subscription and transaction details. Payment card details are handled by the payment provider rather than stored by TweetWhale.

We receive data from you, your authorized team members, connected X accounts, public X profiles you direct us to process, and our service providers.

2. Purposes and legal bases

• Contract: creating and securing your account, providing requested features, processing your instructions, supporting you, and administering subscriptions.
• Legitimate interests: protecting the Service, preventing abuse, diagnosing failures, improving usability and reliability, and understanding feature usage. We balance these interests against your rights.
• Legal obligations: retaining records and responding to lawful requests where required.
• Consent: where applicable law requires it, including for optional technologies or communications. You may withdraw consent at any time without affecting earlier processing.

We do not use your lead lists or conversations to train models or for any other product's benefit.

3. Service providers and disclosures

• Infrastructure providers that host the application and database.
• Authentication software (self-hosted ZITADEL) for account registration and sign-in.
• PostHog EU for product analytics, including feature and page interactions and associated device information.
• Sentry EU for error monitoring, including diagnostic, device, IP address, and request information associated with an error.
• Payment processors, when billing is enabled, for payment and subscription administration.
• We may disclose data if required by law or to protect rights, safety, and security.

Providers may use data only to perform services for us under contractual confidentiality and data-protection obligations. We do not permit them to use your lead lists or conversations for their own marketing.

4. Cookies and similar technologies

We use cookies and browser storage for authentication, security, preferences, and product analytics. You can control non-essential analytics through available browser controls and by contacting us. Blocking essential storage may prevent sign-in or other Service features from working.

5. International transfers

We choose EU-hosted services where stated, but some providers or their support teams may process data in other countries. Where personal data leaves the EEA, UK, or Switzerland, we use an adequacy decision, approved standard contractual clauses, or another legally recognized safeguard as applicable. Contact us for information about the safeguard relevant to your data.

6. Security

We use access controls, encryption in transit, protections for stored secrets, backups, and monitoring designed to protect personal data. No system is perfectly secure. Use a unique, strong password and restrict who can access your workspace and connected accounts.

7. Retention and deletion

We generally keep account and Service content while your account is active and as needed to provide the Service. Deleting a connected X account removes its active stored tokens and credentials. After account deletion, we delete or anonymize personal data within 30 days, although encrypted backups expire on their normal rotation and limited records may be kept longer for security, disputes, tax, accounting, or other legal obligations. Retention also depends on the data's volume, sensitivity, purpose, and risk. You can request account deletion at [email protected]; deleting data does not affect lawful processing completed before deletion.

8. Your choices and rights

Depending on where you live, you may have rights to be informed, access, correct, delete, restrict or object to processing, receive a portable copy, withdraw consent, and appeal or complain about our handling of your data. You may object at any time to direct marketing. We may need to verify your identity before completing a request. Contact us to exercise these rights. EEA and UK residents may also complain to their local data protection supervisory authority.

9. Automated decisions and children

TweetWhale does not make solely automated decisions about you that produce legal or similarly significant effects. The Service is for business users aged 18 or older and is not directed to children.

10. Customer responsibilities

Customers decide which prospects and conversations to process through the Service. They are responsible for providing any notice, honoring data-subject rights, and establishing a lawful basis for that processing and for their outreach. If your data appears in a customer's campaign or inbox, contact that customer first; we will assist them as required.

11. Changes and contact

We will announce material changes in-app or by email before they take effect where required. To ask a question, exercise a privacy right, or contact TweetWhale as data controller, email [email protected].