Privacy Policy

This Privacy Policy explains how PMC Baltic FZ-LLC collects, uses, shares, stores, and protects personal data when you use AI Twin, and the choices and rights available to you.

In this Privacy Policy, “AI Twin” or the “Service” includes the AI Twin website, onboarding quiz, application, AI Twin conversations, Daily activities, Discover content, Personal Sessions, Personal Readings, Quests, Insights, Experts features, memory features, avatar features, member platform, digital content, subscriptions, customer support, and related services.

This Privacy Policy governs personal-data processing only. Commercial rights relating to purchases, subscriptions, cancellation, refunds, or Money-Back Guarantees are governed by the applicable checkout terms, Terms of Service, Subscription Terms, Money-Back Policy, and mandatory law.

1. Data Controller and Contact Information

1.1 Applicable Controller

PMC Baltic FZ-LLC, Licence No. 45001684, operates AI Twin and is the default data controller responsible for personal data processed in connection with the Service, unless a different controller is identified for a specific processing activity or regional notice.

Registered address: SFFO0507 Compass Building, Al Shohada Road, AL Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates

Email: hello@myaitwin.com

1.2 Contracting Party, Seller, Merchant of Record and Payment Roles

The data controller may differ from the Seller, contracting party, Merchant of Record, billing entity, payment processor, gateway, acquiring partner, or payment administrator for a particular transaction.

A Seller, Merchant of Record, or payment provider may process transaction data needed to accept payment, issue transaction records, administer subscriptions, process refunds or reversals, prevent fraud, and respond to payment disputes. Handling a payment does not by itself make that entity the controller of all AI Twin data.

1.3 Affiliates, Service Providers and Regional Notices

Affiliates and service providers may support technical operations, AI functionality, hosting, authentication, email, analytics, advertising, payments, finance, compliance, customer support, security, risk management, or administration. Where another entity acts as a separate or joint controller for a specific activity, the applicable notice or supplement may identify that role.

Additional regional privacy notices or supplements may apply where required by law and may control the specific local privacy matter they address.

2. AI Twin Is Not a Medical or Emergency Service

AI Twin supports self-reflection and personal development. It is not a psychologist, therapist, psychiatrist, counsellor, doctor, healthcare provider, crisis service, or emergency service, and it does not diagnose or treat any condition.

If you or someone else may be in immediate danger, contact the appropriate local emergency service, crisis line, healthcare provider, or other qualified professional immediately. Do not rely on AI Twin for emergency assistance.

3. Categories of Personal Data

3.1 Onboarding Quiz and Personalization Data

Depending on the questions you answer, we may process quiz answers such as age range, gender, relationship status, daily routine and activity level, stress and bodily effects, sleep, eating and caffeine habits, emotional patterns, life satisfaction, goals, and details you choose to type.

We also process the email address you provide to receive results and access the Service.

3.2 Account and Sign-In Data

AI Twin supports sign-in with Google or Apple. We may receive your email address and a unique account identifier and, depending on the provider and your settings, your name and profile picture. If you use Apple's hide-email option, we may receive a relay email address.

We do not receive your Google or Apple password. Authentication is handled through Supabase, and we may record the sign-in provider and relevant sign-in activity needed to provide secure account access.

3.3 Content You Create in AI Twin

Depending on the features you use, we may process:

• messages sent to AI Twin and Experts, together with AI-generated replies;
• Daily check-ins, including mood where provided;
• journal entries, answers to activities, Personal Sessions, Quests, in-app quizzes, and progress;
• Personal Readings, Insights, Areas to Work On, and other personalized content generated for you;
• memories created from information you share, together with relevant source excerpts, earlier versions, and memory privacy settings;
• profile preferences, including the name you want AI Twin to use, selected Twin style, language, and time zone; and
• a photo you choose to upload for generation of a personalized avatar, together with the generated avatar.

For avatar generation, the uploaded original photo is used only to generate the avatar and is not retained after the avatar has been created. The generated avatar may remain until you remove it or delete your account.

If you use voice dictation, speech recognition is performed by your browser or device and may be handled by its provider. Only the resulting text is sent to AI Twin.

3.4 Purchase and Payment Data

Payments are processed by Solidgate. Card details are entered into Solidgate's payment form, and AI Twin does not store the full card number or security code.

We may receive and retain transaction information such as the plan and offer selected, market and language, amount and currency, payment, subscription, refund and chargeback status, order and subscription identifiers, and the email address associated with the purchase.

3.5 Technical, Usage, Cookie and Advertising Data

Depending on how you use the Service, we may process:

• browser language, time zone, device type, referral source, and campaign parameters;
• quiz steps viewed or completed and checkout-related events;
• IP address, browser and device information, dates and times of requests, and technical or hosting logs;
• hashed identifiers used for rate limiting or abuse prevention where applicable;
• cookie and browser-storage identifiers, including Meta Pixel identifiers where used;
• session replays, heatmaps and interaction data from the quiz website, such as pages viewed, clicks, taps, scrolling and answer options selected, collected through Microsoft Clarity; and
• email-delivery, open, and click information recorded by the email provider where applicable.

3.6 Communications With Us

When you contact us, we process your email address, the content of your message, and any information you provide, such as screenshots and purchase information submitted with a support or refund request.

4. Sensitive and Special-Category Information

Because AI Twin is designed for self-reflection, you may choose to share information about mental or emotional well-being, physical health, stress, sleep, relationships, sex life or sexual orientation, religious or philosophical beliefs, or other personal matters. Some quiz questions may also ask about stress and how it affects your body.

Where such information qualifies as sensitive or special-category personal data under applicable law, we process it only for the relevant Service features and rely on explicit consent or another legally valid basis where required.

Providing sensitive information is voluntary. Where processing is based on consent, you may withdraw that consent at any time without affecting processing that was lawful before withdrawal.

Sensitive information is not used for advertising. The content of quiz answers, conversations, journal or check-in entries, memories, and Insights is not shared with advertising partners for advertising purposes.

Please share information about other people only where you are comfortable doing so and have the right to share it.

5. Purposes and Legal Bases

Where the GDPR, UK GDPR, or a similar legal framework applies, we may rely on the following legal bases:

• providing the quiz, results, accounts, subscription access, AI Twin conversations, Experts features, Daily activities, Discover content, Insights, memories, avatars, and other Service features: performance of a contract or steps at your request before entering into a contract;
• processing sensitive information needed for the features you choose to use: explicit consent where required;
• processing payments, subscriptions, renewals, refunds, chargebacks, accounting records, and related compliance obligations: contract, legal obligation, and legitimate interests in fraud prevention and defence of claims where applicable;
• sending service communications such as account access, purchase confirmations, billing information, and important policy notices: contract or legal obligation where applicable;
• sending marketing emails: consent where required, or another legally permitted basis where applicable, with the ability to unsubscribe;
• analytics and advertising measurement, including Meta Pixel and Conversions API where used: consent where required, otherwise another legally permitted basis where applicable;
• security, fraud and abuse prevention, rate limiting, troubleshooting, and protection of users and systems: legitimate interests or legal obligation where applicable;
• improving the Service using usage, quiz analytics, and error information: legitimate interests or consent where required; and
• compliance with law, lawful requests, enforcement of terms, and establishment, exercise, or defence of legal claims: legal obligation or legitimate interests where applicable.

Where processing is based on consent, you may withdraw consent at any time. Where processing is based on legitimate interests, you may have the right to object under applicable law.

6. AI Processing, Memory and Personalization

6.1 How AI Outputs Are Generated

When you chat with AI Twin or an Expert, or when the Service creates Personal Readings, Personal Sessions, Insights, memories, or an avatar, relevant content may be sent to OpenAI to generate the requested output.

Depending on the feature, this may include the current message, a limited number of earlier messages, relevant memories, relevant quiz or activity answers, and an avatar photo where you choose to use that feature.

OpenAI processes this information to generate the requested output. We do not use this content to train AI models, and it is not used for advertising.

6.2 Memories and User Controls

AI Twin may create memories from information you share so later interactions can be more personalized. Depending on the controls available in the Service, you may be able to:

• view memories and the excerpts they are based on;
• edit or correct a memory;
• change how a memory may be used;
• delete a memory;
• pause memory so new conversations and activities are not used to create new memories;
• export profile and content data, including memory exports; and
• delete your profile and its content.

Deleting a memory may also remove dependent personalized outputs such as certain Insights, Personal Readings, or Areas to Work On, but it may not delete the original messages or answers from which the memory was created. Account deletion is handled separately and remains subject to lawful retention obligations.

6.3 Automated Personalization and Profiling

We use automated processing to personalize quiz results, recommendations, Daily activities, Insights, and AI replies based on your answers and content.

This profiling is used to personalize the Service and is not intended to produce legal effects concerning you or similarly significantly affect you.

AI-generated content may be inaccurate and is not a diagnosis or professional assessment. Where applicable, you may contact us to request human review, express your point of view, or contest a result.

7. Cookies, Tracking and Advertising

The Service may use cookies, local storage, session storage, pixels, and similar technologies for strictly necessary functionality, functional features, analytics, and advertising or attribution purposes where applicable.

Where consent is required, non-essential technologies and related advertising measurement are used subject to the consent mechanism made available through the Service.

The Cookie Policy provides further details.

8. Payments, Refunds, Disputes and Chargebacks

Transaction data may be processed to administer purchases and subscriptions, confirm access, handle failed payments, process refunds or reversals, prevent fraud, maintain accounting records, investigate allegedly unauthorized transactions, respond to payment-provider or card-network disputes, and manage chargebacks.

Where reasonably necessary, we may retain and use order records, checkout or acceptance records, transaction terms, delivery or access logs, cancellation records, usage status, support and refund communications, payment-provider records, fraud indicators, and chargeback history to resolve disputes, establish amounts owed, enforce applicable policies, and establish, exercise, or defend legal claims.

This Privacy Policy does not determine whether a refund or Money-Back Guarantee claim is eligible.

9. Recipients and Service Providers

9.1 Core Service Providers

The Service uses the following providers for the functions described:

• Supabase — Function: Database hosting and account authentication. Data / Scope: Account, quiz, app, profile and authentication data as needed to provide the Service.
• Vercel — Function: Hosting and delivery. Data / Scope: Technical request data such as IP address, browser information and request logs.
• OpenAI — Function: AI model provider. Data / Scope: Relevant messages, memories, quiz or activity context, personalized content inputs, and avatar photo where applicable.
• Solidgate — Function: Payments and subscription billing. Data / Scope: Purchase, subscription, refund, fraud-prevention, authentication and transaction data.
• ActiveCampaign — Function: Service and marketing email delivery. Data / Scope: Email address, language or market, quiz and purchase status, tags, and email interaction information.

Depending on the specific processing activity, a provider may act as a processor or service provider, or may independently determine certain purposes and means of processing under applicable law or its own privacy notice.

9.2 Advertising and Analytics Partners

AI Twin uses Meta Pixel and Meta Conversions API for advertising measurement and attribution where enabled and permitted.

Meta may receive event information such as page views, email submission, checkout events, payment-related conversion events, purchase value, currency, product code, cookie or browser identifiers, IP address and browser information, and hashed versions of the email address and a random session identifier for server-side purchase matching.

The content of quiz answers, conversations, journal entries, memories, Insights, or other reflections is not sent to Meta for advertising.

Meta may process data it receives as a separate controller for its own purposes under its privacy practices.

The AI Twin quiz website uses Microsoft Clarity, provided by Microsoft, for usage analytics. Clarity receives interaction data such as pages viewed, clicks, taps, scrolling and answer options selected, together with device and browser information, IP address and Clarity cookie identifiers, and produces session replays and heatmaps. Text typed into form fields, such as the email address, is masked, and payment card details are not captured. Clarity is not used in the AI Twin app.

Microsoft may also use data collected through Clarity for its own purposes, including site optimization, fraud and security purposes, and advertising, as described in the Microsoft Privacy Statement.

9.3 Sign-In Providers

When you choose Google or Apple sign-in, the selected provider processes data under its own privacy terms and may share the account information described above.

9.4 Other Recipients

We may also disclose personal data to banks, card issuers, payment networks, professional advisers, courts, regulators, public authorities, law-enforcement bodies, or parties involved in a merger, acquisition, reorganization, financing, or sale of the business, where permitted or required by law.

10. International Transfers

PMC Baltic FZ-LLC is based in the United Arab Emirates. AI Twin's primary database is hosted in the European Union (Frankfurt, Germany), while some service providers or partners, including OpenAI, Vercel, ActiveCampaign and Meta, may process personal data in the United States or other countries.

Where the GDPR, UK GDPR, or a similar law requires safeguards for an international transfer, legally recognized mechanisms may be used, including Standard Contractual Clauses, a UK Addendum where applicable, transfers to qualifying recipients under an applicable data-transfer framework, or another lawful transfer mechanism.

11. Retention and Deletion

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy and to meet legal, accounting, tax, payment, fraud-prevention, security, dispute, chargeback, refund, regulatory, and limitation-period requirements.

The Service uses the following retention approach:

• account and app content, including profile, conversations, memories, Insights, check-ins, activity progress, Personal Readings, and generated avatar: generally while the account exists, subject to lawful retention exceptions;
• quiz answers and email address: for as long as needed to provide results, connect them to the account, and support communications not opted out of, after which they may be deleted or anonymized;
• purchase and payment records: for the period required by applicable tax, accounting, payment-industry, dispute, fraud-prevention, or legal-claim requirements;
• marketing email data: until unsubscribe or deletion is requested, subject to maintaining a suppression record where needed to respect an opt-out;
• support correspondence and refund evidence: for as long as needed to handle the request and any related complaint or dispute;
• security and rate-limit records: for limited periods appropriate to the security purpose; and
• backup and service-provider logs: for a limited period until overwritten or deleted in the ordinary course.

A valid deletion request is handled subject to applicable law and lawful retention exceptions. Closing or deleting an account does not necessarily require immediate deletion of every transaction, accounting, consent, fraud, security, support, dispute, refund, chargeback, or legal-claim record that we are permitted or required to retain.

12. Privacy Rights and Choices

Depending on applicable law and your location, you may have rights concerning your personal data, including rights to:

• request access to personal data and receive a copy;
• request correction of inaccurate or incomplete data;
• request deletion, subject to lawful exceptions;
• request restriction of certain processing;
• object to certain processing, including direct marketing and certain processing based on legitimate interests;
• withdraw consent where processing is based on consent, without affecting prior lawful processing;
• receive certain personal data in a structured, commonly used, machine-readable format where portability applies;
• not be subject to certain decisions based solely on automated processing where applicable law provides that right;
• opt out of targeted advertising, statutory sale or sharing, or similar processing where applicable law provides such rights; and
• lodge a complaint with a competent supervisory authority.

We may need to verify your identity or authority before acting on a privacy-rights request. Where applicable law permits authorized-agent requests, we may request information reasonably necessary to verify the agent's authority.

Privacy-rights requests may be submitted to hello@myaitwin.com.

Where the GDPR or UK GDPR applies, we generally respond to a valid rights request within one month. Where permitted by law, this period may be extended by up to two further months for complex or numerous requests, and we will inform you of the extension. We may charge a reasonable fee or refuse a request only where applicable law permits, including where a request is manifestly unfounded or excessive.

12.1 In-App and Communication Controls

Where available, the Service may allow you to view, edit, or delete memories, change memory settings, pause memory, export data, or delete the profile.

Marketing emails include an unsubscribe mechanism where required.

Cookie and advertising choices are addressed through the controls described in the Cookie Policy and the relevant consent or privacy settings.

13. Security

We use reasonable administrative, technical, and organizational measures designed to protect personal data against unauthorized access, loss, misuse, alteration, or disclosure.

The current implementation includes encrypted connections, signed session cookies, access controls, restricted database access, and hashed identifiers for certain rate-limiting purposes. Payment card details are handled by the payment provider rather than stored on AI Twin servers.

No method of transmission or storage can be guaranteed to be completely secure.

14. Age

AI Twin is intended only for adults aged 18 or older.

We do not knowingly collect personal data from anyone under 18 in violation of applicable law.

If you believe that a person under 18 has provided personal data, contact hello@myaitwin.com so that we can investigate and take appropriate action.

15. Third-Party Services

The Service may link to or integrate third-party services, including sign-in providers, payment pages, AI providers, email services, advertising platforms, and external support resources.

Those third parties may be governed by their own terms and privacy notices where they independently control the relevant processing.

16. Changes to This Privacy Policy

We may update this Privacy Policy to reflect changes in the Services, technology, vendors, payment infrastructure, business practices, group operations, or legal requirements.

Where applicable law requires additional notice or consent for a material privacy change, we will provide that notice or obtain the required consent.

The “Last updated” date at the top of this Policy indicates the date of the most recent revision.

17. Contact

• Email: hello@myaitwin.com
• Operator: PMC Baltic FZ-LLC
• Licence No.: 45001684
• Address: SFFO0507 Compass Building, Al Shohada Road, AL Hamra Industrial Zone-FZ, Ras Al Khaimah, United Arab Emirates

18. Related Policies and Document Hierarchy

This Privacy Policy should be read together with the applicable commercial and service policies. It governs personal-data processing and does not create or expand any commercial entitlement to a refund, cancellation, reimbursement, subscription benefit, or Money-Back Guarantee.

• Cookie Policy
• Terms of Service
• Subscription Terms
• Money-Back Policy