Who handles your information
TwelveBirds Technologies Inc. operates Twelva at twelva.ai and client.twelva.ai. Contact us at hello@twelva.ai. This notice covers Twelva accounts, creative workspaces, payments, service enquiries and the Twelva processing of visits and enquiries on websites hosted using Twelva. It does not cover TwelveBirds Domain or TwelveBirds Formation, which have separate services and privacy notices.
TwelveBirds Technologies Inc.455 Market St Ste 1940, San Francisco, California 94105-2448
We determine the purposes of account, billing, service security and regional-access processing. When a customer uses Twelva to host a website and receive visitor enquiries, that site owner determines the purpose of its collection and use; we process the hosted information to provide the relevant service. The owner’s notice should identify them and explain their use. Contact the site owner about that use, or contact us for help routing a request.
Account and workspace information
Your Twelva account records include your name, contact email, phone number and an identifier linking the account to its sign-in identity. A contact phone number is required at registration. Clerk provides authentication and processes the credentials, verification codes, connected sign-in identities and session information needed for the method you use. Email addresses or phone numbers can be verified and, when configured for your account, used for sign-in or additional verification. A contact detail is not treated as verified merely because it was entered. Older accounts may retain a protected password hash for the existing-account linking flow.
We also process your declared residence country or region, adult-eligibility confirmation, accepted terms and acknowledged privacy versions, and the server-recorded time and history of those actions. These records support account administration, access eligibility and evidence of the terms applicable to your use.
We process your messages, generated answers, project settings, brand references, uploaded files, creations, generation and task history, saved versions and usage records to provide the features you request. Information comes from you, people authorized to use your workspace and the services that return processing results. Support correspondence and the references you send help us investigate and respond to requests.
Documents retain their original file and extracted text for reading, downloading and reference. Attaching a document to a conversation can send relevant text and source references with an AI request, including later messages in the same conversation. Clearing a document or brand setting does not remove text already copied into a conversation or published output.
Location and access decisions
Our hosting infrastructure processes network information, including IP addresses, and can provide an approximate country or region derived from your connection. We use that country, its source, your declared residence country, the requested capability or model, and the applicable access-policy version to decide whether generation or a purchase is available. These checks support our regional rollout, provider requirements, security and applicable restrictions. They are not a determination of your nationality or precise physical location.
An eligibility decision may prevent a new generation or purchase without preventing you from managing saved work, billing or privacy requests. Account acceptance records and relevant task or transaction records may retain the associated region and policy information to explain decisions, prevent circumvention, handle disputes and investigate errors. Network information can also appear in hosting and security records.
Approximate location and account information can be wrong or out of date. Email hello@twelva.ai to request human review or correct your declared residence. Include your account email, actual country or region and the error message. We do not require a passport or identity document in the initial request. We will explain if proportionate additional evidence is necessary. Our regional terms describe the current rollout.
AI providers and custom training
For ordinary chat, website creation and supported media requests, we send prompts and the context needed for the request through Vercel AI Gateway to the applicable model provider. Context can include conversation history, selected document excerpts, brand instructions and reference images. The permitted route depends on the selected model, feature, region and availability; an eligible fallback may be used when supported. Provider services receive the information needed to generate and return a result.
Processing, logging and retention differ by service and model route. We do not promise universal zero retention, provider-independent confidentiality or that every provider excludes all data from model improvement. Do not submit confidential or regulated information unless you have confirmed that the particular feature and applicable arrangements meet your needs. We are responsible for explaining our own processing; provider notices provide additional detail about their services. Vercel AI Gateway data controls.
Voice conversations and dictation
When you start a real-time voice conversation, your microphone audio is streamed to ElevenLabs and the model services used by its voice agent to recognize speech and respond. Conversation text, session identifiers, duration and usage information support the conversation and billing. Opening the voice dialog does not activate your microphone. You can mute the microphone or end the session in the dialog; closing it ends the connection. Provider processing and retention follow the applicable service configuration and terms.
Dictation in the message field is separate: your browser handles speech recognition and may use its own speech service. Recognized words appear in an editable draft before you send. Speech generation sends the reply text to the configured speech provider. If you transfer a voice transcript into a chat or assistant task, the text is handled as part of that workspace request. ElevenLabs.
When connected-service tools are enabled for voice, the assistant can discover your connected accounts and prepare an operation for review. You approve each operation in the voice dialog before it runs. Relevant service names, tool descriptions, operation arguments and results are sent to ElevenLabs and its voice model to answer your request. Operation receipts are saved separately from the voice transcript. Ending a call does not cancel an operation you already approved.
Custom image training
If you choose custom image training, we obtain a separate authorization for that request. We collect the selected image references, model name, training job identifier, resulting model-file reference, status and associated authorization record. The images are packaged into a downloadable archive for fal.ai to retrieve and train the requested image model. This is a direct fal.ai integration outside AI Gateway. Later use of the model sends its model-file reference and your prompt to fal.ai for image generation. fal.ai privacy information.
The training archive uses a publicly accessible file URL and resulting model files are hosted by the provider. Your workspace listing does not make the underlying files private. Anyone who obtains a usable file URL may be able to access it. Do not select confidential images for training. Deleting a model listing does not itself delete its archive, provider files or previously generated images. Contact us for help with removal; we will explain the applicable provider and file limitations.
Twelva browser extension
The optional Twelva extension reads the webpage you select when you invoke it. You can review and edit captured text before sharing it. A capture includes the page title, URL without query parameters, selected or visible text, and labels and links for available page controls. It excludes password and payment input fields. Twelva stores captures and browser task records in your account and sends the relevant content to the AI provider used for your task.
If you enable a continuous browser task, subsequent page captures within the website origins you approve are shared automatically after each step until the task ends, is paused, reaches its limit, or the side panel closes. Access to additional websites is requested for the exact origins you enter. You can separately allow automatic navigation and scrolling; forms, uploads and other actions require review. The extension does not read or export cookies, passwords or browser history. A signed-in Twelva tab makes authenticated browser-task requests.
The side panel also displays the Twelva Conversation website in an isolated embedded frame. Its sign-in, conversations, files, voice and connected-service requests use the same workspace services and privacy practices as the website. The embedded website has no direct extension API access. Choosing Add reviewed text to conversation adds the selected page text, title and URL to an editable draft; it does not send the message automatically.
Optional page screenshots are shared only when you enable them for a browser task. Input fields are masked, but other visible page content can still contain personal information; review the screenshot before sharing it. For an approved website upload, you choose a local file and confirm the action. That website may upload the file as soon as its file field changes. Generic browser tasks leave login, verification codes, payments and CAPTCHA to you.
Unsent webpage drafts are kept separately for each tab in Chrome session storage, with a 24-hour recovery window. Drafts contain reviewed text, the source title and URL, your question and chosen project or assistant; they do not include screenshots or executable actions. Closing the source tab, discarding the draft or ending the browser session removes that local draft. Restoring a draft does not send it or authorize an action.
The separate Twelva Spend checkout requires your approval of the merchant, card and exact total. Card setup is handled by Crossmint. For supported checkouts, the extension receives an encrypted one-time payment credential, decrypts it only in memory and fills the supported merchant payment form. Card numbers and security codes are not saved in extension storage or included in assistant page context. Purchase identifiers, status and recovery receipts are retained to prevent duplicate attempts; they do not prove bank settlement or a refund.
The extension keeps interface preferences in Chrome local storage and current task state and execution receipts in Chrome session storage. You can delete saved page captures in the Assistant Browser tab. Copies linked into a project or conversation are separate workspace records and can be removed there. Disconnecting or uninstalling the extension does not erase records already saved in your Twelva account. Contact hello@twelva.ai for help with privacy requests.
Hosted-site visitors and security
When you submit an enquiry through a Twelva-hosted contact form, we process the name, email address and message you provide, the related site and submission time, and the status of the enquiry so the site owner can read and manage it. Do not put payment credentials, identity documents or unnecessary sensitive information in an enquiry. The site owner is responsible for its subsequent use of your message; submitting an enquiry does not automatically subscribe you to marketing.
Hosted-site statistics use page addresses, referring-site information and navigation events to produce daily page and referral counts for the owner. The statistics beacon does not set a visitor tracking cookie. This does not mean that all visit processing is anonymous: hosting, request protection and rate limiting separately process technical information such as IP addresses and request timing. We use that information to deliver pages, prevent abuse, investigate errors and protect the service.
Cookies and saved preferences
Essential authentication cookies and session identifiers maintain sign-in, including through Clerk. Session duration and additional verification depend on the authentication configuration and security checks; sessions can expire or be revoked. A legacy guest identifier may be read to connect eligible older workspace records to an authenticated account; current generation requires an account. Signing out revokes the current session, and available account controls can revoke other sessions.
When you submit Help Center feedback, we store the public article, its version and language, your helpfulness vote, any selected reason and the submission time. A browser identifier is hashed in the feedback record to limit repeat votes. After a successful submission, a first-party cookie keeps that identifier for up to one year. Feedback records are used to improve guides and maintain vote integrity; they are not anonymous at collection. Clearing this cookie does not delete feedback already submitted. This feedback form does not request your account details, private conversations or uploaded work.
For Help Center searches with no results, we record a random event identifier, the selected topic, language and time so we can improve guide coverage. This counter does not store the search text, a visitor or account identifier, an IP address, conversations or files. Its administration view shows counts by topic and language for the last 30 days. The browser skips this counter when Global Privacy Control or Do Not Track is enabled.
After successful guide feedback, browser storage also remembers the public guide, its version and language, and your saved vote so the page can show that you already responded. Clearing browser storage removes this local reminder, not the feedback submitted to us.
Twelva’s own pages use Vercel Web Analytics to count page views. It does not set cookies or use browser storage. Vercel identifies a visit by a hash of request information that is discarded after 24 hours, and records the page address, referring site, approximate location (country, region and city), browser, operating system and device type. Before a page view is sent, we remove the address fragment and every query parameter except campaign tags (utm_source, utm_medium, utm_campaign, utm_content and utm_term) and plan selections. Page analytics is skipped when your browser sends Global Privacy Control or Do Not Track. Customers’ published sites, previews and staff pages are not measured.
To understand how people find and start using Twelva, we record conversion events on your account: sign-up, first generation, checkout started, trial started and payment, with the plan and amount where relevant. When the link you followed to sign up carried campaign tags or came from another site, we also record those tags and that site’s host name with your account. Campaign tags travel in page links; we do not store them on your device. These records do not include prompts, generated content, payment card details or contact information. They are kept with your account and billing records and are used in aggregate to improve our marketing and product, based on our legitimate interests where that legal basis applies.
Your browser also saves input drafts and interface preferences. Clear a draft in the composer, or clear this site’s browser storage to remove locally saved data. Signing out does not erase all workspace records or local drafts. Blocking essential cookies can prevent sign-in and account features from working.
Google Calendar and Google Drive
Connecting Google is optional. The Integration Center offers separate Google Drive, Calendar and Gmail connections through Pipedream. Review the permissions on the authorization screen: they may include listing and reading your Drive files, reading or changing calendar events, and reading or sending email. The exact scope depends on the service and permission profile you authorize. Existing direct Google connections retain their original permissions. You can disconnect in the Integration Center and revoke access in your Google Account.
Events on your main Google calendar are read from Google when you view the Assistant’s calendar and are not saved by Twelva. When you ask the assistant about your schedule, or a task you hand to it needs your schedule, the events it reads are sent to the AI model answering you and are kept in that conversation’s history like other tool results. Twelva adds or changes events only when you review an event in Calendar and click Confirm and add event, click Add to Google Calendar on an event card or, if you turn on calendar sync, for your to-dos with a date and your active scheduled emails. Synced events are updated or removed when the item changes, is finished, deleted or paused, or when you turn sync off.
When you pick files with From Google Drive, Twelva downloads only those files, converting Google Docs, Sheets and Slides to Word, Excel and PDF, and saves copies in your Documents. They are then handled like documents you upload, including text extraction and use in AI requests you make. With a managed Drive connection, the file picker can search the authorized Drive library; the import action copies only the files you choose. Other Drive operations can be proposed by your assistant for review within the permissions you granted.
For managed connections, Pipedream handles Google credentials and authorized API calls; Twelva stores account references, permissions, preferences and operation records. Existing direct connections store encrypted Google tokens in Twelva. Disconnecting removes the selected connection from the applicable provider; you can also revoke its grant in Google Account settings. Copies already in Documents, recorded operation results and existing calendar events are not automatically deleted.
We do not sell Google user data, use it for advertising, or use it to develop, improve or train generalized AI or machine-learning models. Our personnel do not read it unless you ask us to for support, it is needed to investigate security or abuse, or the law requires it.
Twelva’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
SMS terms and privacy
Twelva text messages use the registered messaging brand TWELVEBIRDS AI LABS.
Text messages are optional. If you add a mobile number for texts in the Assistant settings, agree to receive them and confirm the number with a code, we use it to send you verification codes, replies from your assistant, reminders you set and notices about tasks you hand to the assistant. Message frequency varies with your use. Message and data rates may apply. Reply HELP for help or STOP to stop receiving texts.
Texts you send to our number are handled like messages you type in Twelva, including being sent to the AI model that answers you. Twilio delivers our text messages and processes your phone number and message content to do so.
We do not sell or share your SMS opt-in data or personal information with third parties for marketing purposes.
We do not share your mobile number or text-message consent with third parties or affiliates for their marketing or promotional purposes. Text-message opt-in data and consent are not shared with any third party except the providers that deliver our messages.
Recipients, payments and international processing
Clerk receives authentication information to provide sign-up, sign-in, verification and session management. If you choose Google sign-in, Google also processes the authentication request and shares the identity information used to connect your account. Email or SMS delivery for verification involves the relevant authentication and delivery services. Authentication does not by itself send your AI conversation history to Google.
Intercom processes the contact details, support messages and attachments you send to our support team. Product feedback is submitted as a separate ticket without opening live chat. Previous Crisp support records may remain available to our team. Twelva stores support continuity, delivery receipts and unread status. Your AI conversation history and project contents are not automatically shared with support.
Service providers receive information for the functions they perform. They include Vercel for hosting, AI Gateway and Blob file delivery; the AI model services serving an eligible request; fal.ai for supported custom image training and generation; Neon for database storage where connected; and Stripe for enabled payments and billing management. Our account and transaction records include billing identifiers, plan status, payment events and credit activity. Payment details are entered on Stripe’s checkout page; we do not receive your full card number. Stripe privacy notice.
When you connect an external account through Pipedream, Pipedream manages the authorization and credentials needed for that connection and processes API or MCP requests for the service you select. Relevant account identifiers, requested inputs and returned data pass through this connection service. You can manage or disconnect connected accounts in the Integration Center; disconnecting does not delete copies already imported into Twelva or retained by the original service. Pipedream.
Authorized personnel and providers may process information to operate the service, support you and investigate issues. We may disclose information where required by law or lawful process, to protect rights and service security, or in connection with a business reorganization subject to applicable protections. Publishing and submitting a hosted-site enquiry also disclose information to the recipients you choose, as described above.
These services may process information in the United States and other countries where the relevant provider operates. Standard Twelva access does not include a promise of local-only hosting or storage in your residence country. A privacy-notice acknowledgement does not by itself waive legally required transfer protections. If your use needs a particular data location, transfer mechanism or processing agreement, contact us before uploading the affected information so we can establish whether that use is supported. Mainland China AI generation and new purchases are not currently offered; this notice does not represent that Chinese filing, local-representative or cross-border requirements have been completed.
Purposes and retention
We use information to provide requested features and administer the account and contract; take and reconcile payment; determine service eligibility; secure and support the service; handle requests and disputes; and meet applicable legal obligations. Where a law requires a legal basis, the relevant basis depends on that purpose: performing our agreement, complying with a legal obligation, legitimate interests such as proportionate security and service administration where available, or consent for processing that requires it. Optional, separately authorized training is not inferred solely from accepting the general privacy notice.
Account and workspace information is kept to maintain your account and saved work and address deletion requests. Billing and credit records may need to remain for accounting, reconciliation, disputes and legal obligations. Access-decision, acceptance and security records are kept according to their continuing need for access administration, abuse prevention, evidence and investigation. Support records are kept for handling and documenting the issue. Provider processing, backups and existing published copies can have separate retention conditions.
We consider the type and sensitivity of information, the purpose, account status, applicable requirements and outstanding disputes when determining retention. We do not promise one fixed deletion period for all categories or immediate erasure of every copy after an interface deletion. A deletion response will explain information removed, information retained for a legitimate applicable reason and any practical or legal limits.
Your choices, rights and updates
Use available controls to edit or clear brand memory, remove documents, manage messages and sign-in sessions, and manage billing. Content already copied into a conversation, version or published output may need separate action. To request access, correction, an export, account deletion or a review of a regional decision, email hello@twelva.ai. Include your account email and a description of the request, never your password. We may need proportionate information to verify your authority and protect other people’s information.
Depending on applicable law, you may also have rights to object, restrict processing, withdraw consent, obtain data portability or complain to a privacy regulator. Withdrawing consent does not change the lawfulness of prior processing and may prevent us from continuing the optional feature that needs it. We will respond within the applicable legal period and explain any lawful limits or appeal route. You can contact us without making a purchase or accepting a new terms version.
Twelva’s AI features and purchases are for adults as described in the terms. If you believe a child has submitted information through an account, tell us so we can investigate. Hosted-site visitors should follow the relevant site’s notice; a site owner must not use our enquiry forms to intentionally collect children’s or sensitive information without the necessary supported arrangements.
The effective date and version identify this notice. We will update it when our practices change and provide additional notice or obtain separate authorization where required. Contact TwelveBirds Technologies Inc. at hello@twelva.ai for questions or complaints.