Legal

Privacy Policy

Last updated: 7 September 2026 · Version 1.0

Behavioural Twin builds a structured model of how you prefer to communicate, decide and be challenged, so that AI can work with you more effectively. Behavioural data is personal data, and we treat it accordingly. This policy explains what we collect, why, where it is held, and the control you keep over it.

1. Who we are

Behavioural Twin is operated by [COMPANY NAME], a company registered in England and Wales under company number [COMPANY NUMBER], with its registered office at [REGISTERED ADDRESS] ("we", "us", "our").

For the personal data described in this policy, we are the data controller, except where section 9 says otherwise. We are registered with the Information Commissioner's Office under registration number [ICO REGISTRATION NO].

We have not appointed a statutory Data Protection Officer, as we are not required to do so. Privacy questions should be sent to privacy@behaviouraltwin.com.

2. Summary

The detail follows, but in short:

• Your assessment responses and your Behavioural Twin profile are stored in your own browser, on your own device. We do not hold them in a database and we cannot see them.
• Text you submit for AI processing is transmitted to third-party AI model providers to generate a response, then returned to you.
• Counterparty Twin does not involve data about other people. It is generated from your own Behavioural Twin. You do not enter anyone else's details, and we hold none.
• Buying a Twin means we hold order and payment records. Our payment provider handles the card details; we never see the full card number.
• We use website analytics to understand how the site is used. We do not sell personal data, and we do not use behavioural profile content for advertising.
• Because your Twin lives in your browser, clearing your browser data will permanently delete it. Export your profile if you want to keep it.
• You have rights over your personal data, including access, correction, erasure and objection. Section 16 explains how to use them.

3. Scope of this policy

This policy applies to the website at behaviouraltwin.com and the Behavioural Twin and Counterparty Twin features available through it (together, the "Service"). It should be read alongside our Terms and Conditions.

It does not apply to third-party AI assistants, agents or platforms into which you choose to paste or import your exported profile. Once you place your profile into another system, that system's provider determines how it is handled, and their privacy terms apply.

4. Personal data we process

We deliberately do not send assessment answers, construct scores or generated profile content to analytics tools. Analytics record that an event happened, not what it contained.

Data you are not required to give us

You can browse the site and read every explanatory page without giving us any personal data. Buying a Twin requires an email address and payment details, because we cannot take payment or send you an order confirmation without them. Subscribing to updates is optional and separate.

5. Where your Twin is stored

Your assessment responses and generated profile are held in your browser's local storage on the device you used. This has consequences you should understand before you start:

• We have no copy. We cannot retrieve, restore, view or repair your profile, and we cannot send it to you.
• Your profile is tied to that browser on that device. It will not appear in a different browser, on another device, or in a private or incognito window.
• Clearing your browsing data, using browser privacy settings that purge site storage, or uninstalling the browser will permanently delete your profile.
• Anyone with access to that device and browser profile can view your Twin. Use device-level protection if that matters to you.
• Use the export function to keep a copy under your own control.

This is a deliberate design choice: it keeps sensitive behavioural material with you rather than accumulating it on our servers. If we later introduce optional accounts and server-side storage, we will update this policy and tell you before any of your data is stored with us.

6. Why we process your data

Under Article 6 of the UK GDPR we rely on the following legal bases.

Where we rely on legitimate interests, we have assessed that our interest is not overridden by your rights and freedoms. You can ask for a summary of that assessment, and you can object at any time under section 16.

7. AI processing of your inputs

Generating profiles, testing your Twin and producing interaction guidance involves sending text to third-party AI model providers. These providers act as our processors or sub-processors and are contractually bound to process the content only to return a response to us.

• Content is sent for the purpose of generating output and is returned to your browser.
• We do not use your inputs or generated profiles to train our own models.
• We select providers who contractually undertake not to use submitted content to train their models. Providers may retain content briefly for abuse monitoring, in line with their own published terms.
• We do not currently name individual providers in this policy because our provider mix may change. You can ask us who is processing content at any given time by emailing privacy@behaviouraltwin.com, and we will tell you.

Do not paste confidential, privileged, commercially sensitive or regulated material into the Service unless you are satisfied it is appropriate to do so. If you are using the Service in a work context, check your employer's policy on AI tools first.

8. Special category data

We do not seek and do not knowingly process special category data — information revealing health, racial or ethnic origin, political opinions, religious or philosophical beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation.

Behavioural Twin measures interaction preferences: how much detail you want, how directly you want to be challenged, how you prefer decisions to be framed. It is not a clinical, diagnostic or health assessment and it is not designed to reveal any special category characteristic.

Please do not enter health information, clinical assessments, or other special category data about yourself or any other person. Where you do so anyway, we rely on your explicit consent under Article 9(2)(a) of the UK GDPR for the transient processing needed to return the output you requested, and you may withdraw that consent by ceasing to use the feature and clearing the relevant content from your browser.

9. Counterparty Twin and other people's data

Counterparty Twin helps you understand how to work with someone whose behavioural style differs from your own. It is worth being precise about how it does that, because it determines whether anyone else's personal data is involved. It is not.

How it works

A Counterparty Twin is generated from your own Behavioural Twin. The system takes the behavioural model built from your assessment and derives a complementary or opposing profile from it — a counterpart whose preferences differ from yours in ways that matter for how the two of you would interact. The output tells you how someone with that profile is likely to want information framed, and how you should adapt your natural style in response.

You do not supply anything about a real person to generate it. There is no field in which to name someone, no notes, no correspondence, no uploads and no free text describing an individual.

What this means for your data and theirs

• We process no personal data about third parties. There is none to process. We do not hold, infer, store, aggregate or share information about anyone other than the user in front of the screen.
• Counterparty Twins are not profiles of real individuals. A generated counterpart is a behavioural archetype derived from your own data. It is not a model of any identifiable person, and it should never be treated as one.
• Nobody else acquires rights against you through this feature, because no one else's data is used. You do not need a lawful basis for processing another person's data, and you have no transparency obligation towards them, because you are not processing their data.
• Your counterparty data is your own data. A generated counterpart derives from your assessment, so it is held and treated exactly like the rest of your Behavioural Twin: in your browser, under your control, deleted when you delete it.

Please keep it that way

Where the Service offers free-text input — for example when testing your Twin or refining output — do not enter names, contact details, private correspondence, confidential material or other information identifying a real person. There is no product reason to do so, and doing so would introduce someone else's personal data into a service that is designed not to handle any.

If you enter such information anyway, you become the controller of it. You would then be responsible for having a lawful basis and for meeting your own transparency obligations under the UK GDPR, and the restrictions in our Terms and Conditions apply. Because the content sits in your browser and not in a database we control, we would be unable to locate or delete it for you.

Using the output responsibly

Counterparty output describes a behavioural archetype, not a verdict on a person you know. Do not treat it as an assessment of a real colleague, client or counterparty, do not present it to anyone as a psychological evaluation of them, and do not use it to make or support decisions about a person's employment, credit, insurance, education or care. Those uses are prohibited by our Terms.

10. Profiling and automated decisions

The Service is a profiling tool: it analyses your responses to model your behavioural preferences, and derives complementary counterpart profiles from that same model. All of it concerns you. You should understand three things about it.

• It produces a model, not a verdict. Output describes likely interaction preferences with an indicated confidence level. It does not diagnose, score your worth, or predict what you will do.
• You remain in control. Your Behavioural Twin is inspectable and editable. Where you correct it, your stated preference overrides the inferred one.
• We make no automated decisions about you. We do not use the Service to make decisions producing legal effects concerning you or similarly significantly affecting you, whether solely automated or otherwise. We do not use it for eligibility, pricing, employment or credit decisions, and our Terms prohibit you from doing so either.

The restriction in Article 22 of the UK GDPR, as amended by the Data (Use and Access) Act 2025, is therefore not engaged by our processing. If that ever changes, we will tell you, explain the logic involved and the consequences, and provide the safeguards the law requires — including the ability to obtain human intervention, make representations and contest the decision.

11. Cookies and similar technologies

We use a small number of storage and access technologies. Under the Privacy and Electronic Communications Regulations 2003, as amended by the Data (Use and Access) Act 2025, some of these are exempt from the requirement to obtain consent, but we still tell you about them and let you object.

We do not use advertising, retargeting or cross-site tracking technologies. If we ever introduce technology that falls outside these exempt categories, we will ask for your consent first through a consent banner.

How to object. You can opt out of statistical and preference technologies at any time using our cookie settings, or by emailing privacy@behaviouraltwin.com. Objecting will not affect your ability to use the assessment. You can also block or delete storage through your browser settings, but doing so will delete your Behavioural Twin.

12. Who we share data with

We do not sell personal data and we do not share it for advertising. We share it only with:

• AI model providers, to generate the output you have requested (section 7).
• Hosting and infrastructure providers (Lovable), who operate the servers delivering the site.
• Analytics providers (our privacy-focused analytics provider), who process technical and usage data on our instructions.
• Our payment provider (Stripe), who processes your payment. They act as a controller in their own right for the payment transaction and apply their own privacy notice, in addition to processing order data on our instructions.
• Email and communications providers (our email delivery provider), where you have contacted us or subscribed to updates.
• Professional advisers — lawyers, accountants and insurers — where necessary and under a duty of confidentiality.
• Authorities and third parties, where we are required to disclose by law, or where disclosure is necessary to establish, exercise or defend legal claims or to protect the rights and safety of others.
• A buyer or successor, if we sell or reorganise the business, in which case data would be transferred subject to the protections in this policy.

All processors act on written instructions under contracts meeting Article 28 of the UK GDPR.

13. International transfers

Some of our providers, particularly AI model providers, process data outside the United Kingdom, including in the United States and the European Economic Area.

Where we transfer personal data outside the UK, we rely on one of the following: an adequacy decision made by the Secretary of State; the International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses; or another lawful transfer mechanism. Before transferring, we satisfy ourselves that the protection for data subjects is not materially lower than under UK law, which is the standard introduced by the Data (Use and Access) Act 2025.

You can request details of the safeguards applying to a particular transfer by emailing privacy@behaviouraltwin.com.

14. Retention

15. Security

We take appropriate technical and organisational measures to protect personal data, including encryption in transit (HTTPS/TLS), access controls and least-privilege administration, vetting of processors and contractual security commitments, and keeping the volume of personal data we hold deliberately small.

Because your profile is held on your device, an important part of the security picture is under your control. Use a device passcode, keep your browser updated, and avoid completing the assessment on a shared or public computer.

No online service can be guaranteed completely secure. If a personal data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours where required, and will tell you directly where the risk is high.

16. Your rights

Under the UK GDPR you have the right to:

• Be informed about how your data is used — this policy.
• Access a copy of the personal data we hold about you.
• Rectification of inaccurate or incomplete data.
• Erasure of your data in certain circumstances.
• Restrict processing in certain circumstances.
• Data portability — to receive data you provided to us in a structured, commonly used, machine-readable format.
• Object to processing based on legitimate interests, and to object to direct marketing at any time, absolutely.
• Withdraw consent at any time where we rely on it, without affecting processing carried out beforehand.
• Not be subject to a solely automated decision producing legal or similarly significant effects, in the circumstances the law provides.

How to exercise them. Email privacy@behaviouraltwin.com. We may ask for information to verify your identity. We will respond within one month, and will tell you if we need to extend that by up to two further months because the request is complex. If we need clarification to identify what you are asking for, the response period may be paused until you provide it. There is no charge unless a request is manifestly unfounded or excessive.

A practical note on access and erasure. Your assessment responses and profile are not held by us, so we cannot produce them in response to an access request, and we cannot delete them on your behalf. You already have full access, and you can erase them yourself by using the delete function in the product or clearing site data for behaviouraltwin.com in your browser.

17. Complaints

If you are unhappy with how we have handled your personal data, tell us first at privacy@behaviouraltwin.com. You have a statutory right to complain to us directly. We will acknowledge your complaint within 30 days and take appropriate steps to resolve it without undue delay.

If you remain dissatisfied, you can complain to the Information Commissioner's Office:

Complaining to us does not affect your right to complain to the ICO or to seek a remedy through the courts.

18. Children

The Service is intended for adults and is not directed at children. You must be 18 or over to use it. We do not knowingly collect personal data from anyone under 18. If you believe a child has used the Service, contact privacy@behaviouraltwin.com and we will take appropriate steps.

19. Changes to this policy

We may update this policy as the product develops or the law changes. The version and date at the top of the page will always show the current position. Where a change materially affects how we handle your personal data — for example, if we introduce accounts and server-side storage — we will give you clear notice before it takes effect, and will seek your consent where the law requires it.

20. Contact us