1. Who we are
Turntwo Interact is a product of Turntwo Technology B.V. ("Provider", "we", "us"), registered at Niasstraat 35, 1095 TV Amsterdam, The Netherlands, KVK 42217973.
For questions about this policy, contact: info@turntwo.com.
2. Scope of this policy
This policy applies to you personally when you use Turntwo Interact, provided through the organization you're part of ("the Subscriber"). For example, when you log in, ask questions via the chat interface, or receive automated reports.
This is separate from:
- The commercial agreement between Provider and the Subscriber (pricing, scope, service levels and the Data Processing Agreement). You're not a party to that.
- The User Terms, which govern your use of Interact.
- How the Subscriber's data in Interact ("Subscriber Data") is processed, such as its business and customer data, reports and the content of chats. That processing is governed by the Data Processing Agreement (DPA) between Provider and the Subscriber, where the Subscriber is the controller and Provider acts as processor.
3. What data we collect
| Category | Examples | Why |
|---|---|---|
| Account data | Name, email, role, organization, User Terms acceptance (who, when, which version) | To create and manage your access |
| Login and usage data | Login timestamps, session activity, features used | Security, product improvement, support |
| Technical data | IP address, browser/device type | Security, troubleshooting |
| Product analytics | Pages viewed, features used, device and browser data and organization ID, collected with Google Tag Manager and Google Analytics; your user ID only with your consent | Understanding how Interact is used |
The questions you ask in chats and the responses are Subscriber Data: we process them on behalf of the Subscriber, under the DPA. As set out in the User Terms, do not input personal data of third parties into the chat interface beyond what is necessary and permitted by your organization's data policies.
4. Why we process this data (legal basis)
- Performance of a contract. Providing you access to Interact as part of the agreement between Provider and the Subscriber.
- Legitimate interest. Improving product reliability, security monitoring, preventing misuse. We balance this against your privacy interests.
- Legal obligation. Where retention or disclosure is required by law.
We do not rely on your individual consent as the basis for providing the core service, since your access is arranged through the Subscriber's contract with Provider. Product analytics (Google Tag Manager and Google Analytics) is based on our legitimate interest in understanding how Interact is used. We have set it up in a privacy-friendly way: IP addresses are not stored, Google may not use the data for its own purposes or share it with other Google services, and we have a data processing agreement with Google. We only add your user ID to the analytics data after you consent to it. You can give or withdraw that consent at any time in the cookie settings. Section 7 lists the cookies we use.
We may use de-identified, aggregated usage patterns (not tied to you individually) to improve Interact. If you send us feedback or suggestions about the product, we may use that feedback to improve Interact.
5. Who we share data with
- Subprocessors that host and run Interact, such as hosting, database, background jobs, email and error monitoring.
- AI model providers that power the chat, agents and reports, accessed through OpenRouter. Only the providers of the models your organization's agents use receive prompts and data.
- Google for product analytics (Google Tag Manager and Google Analytics). Your user ID is only shared with your consent.
- We do not sell your data or share it for third-party advertising.
The subprocessor list names every subprocessor and AI model provider, with its purpose and location.
6. International transfers
We process your personal data within the European Union / European Economic Area where we can. Some subprocessors, in particular the AI model providers, are located in or can access data from outside the European Economic Area (EEA), mainly the United States. For these transfers we rely on an adequacy decision of the European Commission, such as the EU-US Data Privacy Framework for certified providers, or on the Standard Contractual Clauses adopted by the European Commission.
7. Cookies
Interact uses a small number of cookies. Functional cookies are needed to sign you in and to make Interact work. Analytics cookies are set up in a privacy-friendly way (see section 4) and have little impact on your privacy. Neither requires your consent. We only add your user ID to the analytics data after you consent to it.
| Cookie | Type | Purpose | Expires |
|---|---|---|---|
| t2.session_token | Functional | Keeps you signed in | 12 hours after your last activity, or when you sign out |
| t2_tos_pending | Functional | Remembers that you accepted the User Terms before signing in, until we record your acceptance | 7 days, or once your acceptance is recorded |
| mcp_oauth_flow | Functional | Remembers a platform you are connecting while you sign in with that platform | 10 minutes |
| t2_view_as | Functional | Lets Provider's platform administrators view Interact with a different role (administrators only) | 8 hours |
| Cookie choice | Functional | Remembers whether you consented to adding your user ID to the analytics data | 12 months |
| _ga and ga[ID] (Google Analytics) | Analytics | Distinguishes visits and sessions so that we understand how Interact is used. Set by Google LLC, which may process the data in the United States under the EU-US Data Privacy Framework | 2 years |
You can change your choice for your user ID at any time in the cookie settings, and you can delete cookies in your browser.
8. Retention
- Account data: for the duration of your access, plus a maximum of 12 months after offboarding.
- Chats: chats that are not saved are deleted after 180 days. Saved chats are deleted after 2 years, or earlier when they are deleted or the Subscriber's agreement with Provider ends.
- Usage logs: a maximum of 3 years.
A longer period may apply where required for a security investigation or a legal obligation.
9. Your rights
Under GDPR you have the right to:
- Access the data we hold about you
- Correct inaccurate data
- Request erasure, where applicable
- Restrict or object to certain processing
- Data portability, where applicable
- Withdraw your consent at any time, where we rely on it (such as for adding your user ID to analytics data)
- Lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens)
To exercise these rights, contact info@turntwo.com. Note: some requests may need to be routed via your organization where they concern data your organization controls.
10. Security
We apply technical and organizational measures as part of our Information Security Management System, which is aligned with ISO/IEC 27001, including access control and encryption in transit and at rest.
11. Changes to this policy
We may update this policy from time to time. Material changes will be communicated via in-app notice and email, with the updated version always available at this page.