Last updated 11 October 2026 · Growthx Ventures Pty Ltd, ABN 75 632 942 208
This addendum forms part of the Terms between you and Growthx Ventures Pty Ltd (ABN 75 632 942 208), the company that runs Twoself. It applies to personal information about other people in your Content (your contacts, correspondents and connections), which Twoself handles on your behalf. Part A applies to every customer. Part B applies automatically, with no signature, when your use of Twoself involves personal information covered by the UK GDPR or the EU GDPR. If this addendum and the Terms conflict about personal information, this addendum applies.
We handle that information only to provide Twoself to you, on your instructions as set out in the Terms, your settings and your requests. We do not use it for our own purposes, sell it, advertise with it, build profiles of your contacts for anyone else, or use it to train any general AI model.
Only people who need access to provide or secure Twoself may access it, under duties of confidentiality, and only as the Privacy Policy allows.
We keep the measures described on the Security page, and will not reduce their overall level.
We use the providers listed in the Privacy Policy under Who handles your data, each bound to handle data only for us and to protect it. We update that list, with the date, before a new provider receives your Content. If you object to a new provider, you may stop using Twoself and delete your account.
Your Content is stored in Sydney, Australia. Some providers, including AI providers, process it outside Australia, as that list shows. We take reasonable steps to ensure each provider handles it consistently with the Australian Privacy Principles.
If we find that your Content has been accessed or disclosed without authority, or lost, we will tell you within 72 hours of confirming it: what happened, what information was involved, what we have done and what you can do.
If someone asks you about information Twoself holds for you, you can find, export, correct or delete it in the app. We will help you if you ask.
You can export your Content at any time. If you delete your account, every connection is cut at once and your Content is erased after 30 days.
AI providers receive only what the Privacy Policy describes, on terms that do not allow training on your data. Private items stay out of answers unless you ask for them. Mail and calendar items that match your Never-read list are never stored.
You confirm you may let Twoself hold this information, as the Terms say, and you remain responsible for any obligations you owe your own clients and contacts.
Twoself is not yet offered in the UK or EU. Part B applies anyway, automatically and with no signature, whenever your use of Twoself involves personal data covered by the UK GDPR or the EU GDPR, so that you have the terms those laws require.
You are the controller of the personal data in your Content, and we are your processor. We are the controller of our own account and billing data about you.
We process the personal data only on your documented instructions (the Terms, your settings and your requests), unless the law requires otherwise, in which case we tell you first unless the law forbids it. People who process it are bound by confidentiality. We keep the security measures on the Security page. We use the sub-processors in the list, under written terms giving the same protection, tell you before adding one, and remain responsible for them. We help you answer requests from individuals and with impact assessments and consultations, taking into account what we can see. At the end, you can export your data and we erase it within 30 days of your account being deleted, unless the law requires us to keep it. We give you the information needed to show we comply, and answer reasonable audit questions in writing.
Your data is stored in Australia. For EU personal data, the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) apply and are incorporated by reference: Module Two where you are a controller, and Module Three where you are a processor and for our transfers to sub-processors. Clause 7 (docking) applies; under Clause 9 we use the general authorisation option with notice as in section 4; the optional wording in Clause 11 does not apply; Clauses 17 and 18 are governed by, and disputes go to the courts of, Ireland. Annex I is section 14 below and Annex II is the Security page. For UK personal data, the UK International Data Transfer Addendum (version B1.0) issued by the Information Commissioner applies on top of those clauses, with its tables completed from this addendum.
Subject matter and purpose: providing Twoself to you. Data subjects: your contacts, correspondents, LinkedIn connections and other people named in your Content. Data: names, email addresses, job titles and companies, message subjects and short summaries, meeting details, notes, files and LinkedIn data you import; any special-category data only as it happens to appear in your Content, which Twoself marks private. Duration: while your account exists, then 30 days.
We notify you without undue delay, and within 72 hours of becoming aware of a personal data breach affecting your data, with the information you need to meet your own obligations.
If a public authority asks us for your data, we tell you unless the law forbids it, and we challenge requests we consider unlawful or too broad. We have not received any such request.
Questions, or a countersigned copy: team@twoself.ai.