The site works without optional tracking. Choose whether to allow analytics or advertising and affiliate attribution. You can change or withdraw your choices here anytime.
Twidget is operated by TWIDGET LIMITED, company number 14995704, registered at 128 City Road, London, United Kingdom, EC1V 2NX. Idris Kadri handles privacy enquiries at info@twidget.io.
We are the controller for our account administration, billing, support and website activities. For personal data customers put into applications, tables, files and workflows, we generally act as their processor under their instructions. The customer determines its processing purposes and must provide its users with an appropriate notice. This notice is not blanket consent or a substitute for a customer data processing agreement.
Information comes from you, your organisation, service interactions and authorised integrations. Information required for access and paid services is needed for those features; optional integrations and marketing choices are not required for ordinary account use. Hashing an identifier does not make all related information anonymous.
We use DigitalOcean for hosting/storage, OpenAI for enabled AI features, Stripe for payments and Namecheap Private Email for platform communications. Customer workflows may transmit content to selected Google, Slack, Twilio, email, HTTP or other providers. Information relevant to the enabled feature may also be available to authorised support personnel or legal authorities where necessary and lawful.
Hosting is in DigitalOcean's SFO3 region in the United States, not exclusively the EU or UK. Supplier processing and support access can involve other countries. Applicable transfers require an adequacy decision or contractual safeguards, such as standard contractual clauses with the UK addendum where required, and any necessary assessment. Contact us for the safeguards applicable to your service and how to obtain a copy. Site use is not blanket consent to international transfers.
Integration access depends on authorised scopes and configured actions. Permissions may allow broader resource discovery than an individually selected file. Credentials, configuration and content needed to execute or retain workflows may be stored in Twidget. Results may be saved to your tables or transmitted to destinations you configure; we do not promise that all integration content is immediately discarded or never shared.
We use Google and Slack connection data to provide configured integrations, not advertising. Remove a connection in Twidget or revoke it with the provider to stop further authorised access. Revocation does not itself delete previously stored results, logs or provider copies. Contact us or the application controller about applicable deletion. Avoid unnecessary personal information in authored logs and AI prompts.
Necessary authentication, security and interface storage supports the service. The marketing website provides separate analytics and advertising/affiliate choices through Privacy settings, including rejection and withdrawal. The builder's optional advertising/conversion trackers are disabled. Social sign-in loads the chosen provider when requested. Functional assets, Google Fonts, sign-in and reCAPTCHA can contact their providers for the relevant feature and disclose network/request information. These choices do not control independently configured customer applications.
Account and application information is retained while needed for the service; deletion is subject to customer instructions, shared ownership and lawful exceptions. Approved defaults are 30 days for customer request logs/event history and ordinary deleted-workspace recovery archives, 90 days for minimal technical security audit evidence, and seven days for rotating MongoDB backups. Approved erasure has no ordinary recovery window. Retained backup information must remain beyond use and deletion decisions must be applied before restored information becomes accessible.
Accounting records, privacy/support cases, security incidents and documented legal holds have purpose-specific retention rather than the general log period. Retained information and access are limited to the continuing purpose. Namecheap's published Private Email terms specify daily backups retained up to four weeks; the seven-day MongoDB period does not cover these email copies. Customer-selected providers have their own rules. We explain relevant retained records and exceptions when responding to a request; an intake acknowledgement is not confirmation of completed deletion.
Minimal privacy-request case evidence is retained for 12 calendar months after closure, unless a specific necessary exception is documented and reviewed. Full exports and unnecessary identity-document copies are not kept under this rule. Separate minimal deletion-suppression records remain only while recoverable copies could reintroduce erased data; their necessity is reviewed monthly.
Depending on the processing and applicable law, you may request access and processing information, correction, erasure, restriction or portability, or object to processing. You can withdraw consent without affecting prior lawful processing and object to direct marketing. Email info@twidget.io. We verify identity and authority proportionately and normally respond within one month, explaining any applicable exception or extension. For a customer's application, contact its controller; we assist that customer as appropriate.
Your right to object: you can object to our processing based on legitimate interests for reasons relating to your particular situation. You can object to direct marketing at any time, and we will stop using your information for that purpose. Contact us using the privacy email above.
You can complain to the UK Information Commissioner's Office or the competent data protection authority where applicable.
We apply security measures appropriate to the service and review them as risks change; no service guarantees absolute security. Platform accounts are not intended for children under 16. Customers must assess their application's audience and any additional protections. Contact us if children's information has been provided improperly.
Customer-configured workflows may make automated decisions; their controller must explain any legally significant decisions and safeguards. This notice is not permission for those decisions. We update the notice when the service changes and communicate material changes as appropriate; an update is not new blanket consent.
No credit card required.
© Copyright 2026 - Twidget.io