TwinTalk Privacy Policy

1. Data controller

The controller of the data required to operate TwinTalk is Bouba, the publisher of the application, established in Belgium.

For any question concerning privacy or the exercise of your rights, you can write to [email protected].

2. Data processed

TwinTalk limits data processing to what is necessary for operation, security and the features requested by the user.

• Account and profile data: email address, username, first name, last name, selected languages and, where applicable, profile picture.
• Communication data: messages, images, videos, files and other content the user chooses to send.
• Data required for calls: session information, connection settings and audio or video streams when the user starts or joins a call.
• Translation data: text, audio or content strictly necessary for the translation feature being used.
• Technical data: information required for authentication, synchronization, notifications, security, error diagnosis and proper operation of the service.

3. Encryption and confidentiality of communications

TwinTalk uses encryption mechanisms to protect communications and sensitive data. Passwords are not stored in plain text.

Messages and media to which TwinTalk end-to-end encryption is applied are encrypted on users’ devices using keys that are not made available to the server for reading the content. For such content, the server stores or transmits encrypted data and Bouba does not have, on the server side, the information required to read the content in plain text.

This protection does not mean that all information relating to the service is invisible to the server. Certain account data, technical information, synchronization metadata or elements required for routing, security and operation of the service must be processed by the infrastructure.

Loss of keys stored on the device may make some encrypted content unrecoverable. Bouba cannot reconstruct a private key that it does not possess.

4. Audio/video calls and translation

Audio and video calls use a secure real-time communication infrastructure. Streams are protected in transit. Transport encryption for a call should not, however, be confused with end-to-end encryption of stored messages.

Depending on the device, languages concerned and available features, some translations may be performed directly on the device. When translation requires server processing, only the content necessary to perform the translation is sent to the relevant service.

5. Purposes and legal bases

• Provide the service requested by the user: account creation, authentication, conversations, synchronization, calls, media exchange and translation.
• Ensure service security, prevent abuse, diagnose malfunctions and protect accounts, based on Bouba’s legitimate interest in providing a reliable and secure service.
• Comply with legal obligations to which Bouba may be subject, in particular when a competent authority issues a request or order in accordance with applicable law.
• Process certain optional features on the basis of the user’s choice or consent where consent is the appropriate legal basis.

6. Recipients and technical service providers

Data is not sold to advertisers. It is disclosed only to persons or service providers who need it to provide, secure or maintain the service, and only to the extent necessary.

• The hosting infrastructure used by Bouba for TwinTalk services.
• The real-time communications provider used to establish calls and sessions, currently LiveKit Cloud.
• Apple or Google services required for operation of the operating system, notifications or certain native device functions.
• The server-side translation service when a translation cannot be performed locally on the device.
• Public or judicial authorities when disclosure is required by an applicable legal obligation.

7. Transfers outside the European Economic Area

Some technical service providers may process data from several countries. Where a transfer of personal data outside the European Economic Area is necessary, Bouba ensures that it relies on a mechanism recognized by applicable law, such as an adequacy decision or appropriate contractual safeguards.

8. Retention period

Account data is retained while the account remains active and then for the period strictly necessary to process its deletion, ensure service security and comply with any applicable legal obligations.

Conversation content retained to enable synchronization remains associated with the service for as long as necessary for that feature and until it is deleted through the options offered by TwinTalk or following an applicable request.

Security logs and technical data are retained for a limited period proportionate to their diagnostic, security or abuse-prevention purpose.

Where the law requires certain information to be retained for a longer period, that legal obligation takes precedence only for the data concerned.

9. Security

Bouba implements technical and organizational measures designed to protect data against unauthorized access, loss, alteration or disclosure. These measures include, in particular, encryption of communications where applicable, protection of network exchanges, non-reversible storage of passwords and restriction of technical access.

No information system can guarantee zero risk. Security measures are therefore adapted and reassessed according to the nature of the data, the features and the risks identified.

10. Advertising, profiling and sale of data

TwinTalk does not include targeted advertising and does not use conversation content to build advertising profiles.

Bouba does not sell users’ personal data.

11. Private content and server-side unreadability

When conversation content is protected by TwinTalk end-to-end encryption, Bouba cannot read that content from the server and does not perform prior editorial monitoring of private exchanges.

This technical limitation does not prevent a user from reporting problematic behavior or content. For action to be possible where content cannot be read server-side, the report must provide the information needed for review, such as identification of the account concerned, approximate date, context and, where relevant, a copy, export or screenshot of the content held by the user.

Bouba may also act where it otherwise has sufficient information or where a competent authority sends a request compliant with applicable law. Encryption does not remove legal obligations that may apply to Bouba.

12. Your rights

Subject to the conditions set by the GDPR, you may request access to your personal data, rectification or erasure, restriction of certain processing, data portability where applicable, or object to certain processing based on legitimate interests.

Where processing is based on your consent, you may withdraw it for the future without affecting the lawfulness of processing carried out before withdrawal.

For content protected by encryption for which Bouba does not possess the decryption key, Bouba may not be technically able to return the content in plain text. This limitation does not reduce your rights regarding other personal data that is actually accessible to and processed by Bouba.

13. Complaint to a supervisory authority

You can contact Bouba with any question or request concerning your data. You also have the right to lodge a complaint directly with a data protection authority without having to contact Bouba first.

In Belgium, the competent authority is the Data Protection Authority.

https://www.autoriteprotectiondonnees.be/citoyen

14. Changes to this policy

This policy may evolve to reflect new TwinTalk features, technical changes or legal requirements. The last-updated date shown at the top of the page identifies the applicable version.

15. Contact

For any question about this policy or to exercise your rights: [email protected].