Privacy Policy

Last updated: 30 July 2026 · Draft for legal review

1. Who we are

sessiontwin (the "Service", at sessiontwin.ai) is operated by an individual developer established in Israel (the "operator", "we", "us"). The formal legal-entity name, registered address, and a data-protection contact address are [TO BE SUPPLIED BY THE OPERATOR — see open questions]. Until then, privacy queries can be directed to [privacy contact — TO BE SUPPLIED].

2. The data we process, and why

Account data

When you sign in, we process your email address and, if supplied by your login provider, your name, together with an account role. Sign-in is by email/password or Google OAuth, handled by Base44. We also record a timestamp of when you were last active. Purpose: to authenticate you and attach your missions to you. Legal basis (GDPR, where it applies): performance of a contract (Art 6(1)(b)).

Mission data

We process the task you type ("goal"), and for code missions the repository identifier, file path and branch you specify, plus the resulting pull-request references. Purpose: to run and record the mission. Legal basis: performance of a contract.

Repository file contents

For a code mission, we fetch the current contents of the single file you name from the repository, hand it to the AI worker, and store the worker's revised file as part of the mission's signed record. The file — and any personal data it happens to contain (e.g. author names, emails or names in comments) — is therefore processed and stored. Purpose: to perform the requested change. Legal basis: performance of a contract; and, for any third-party personal data inside the file, see section 8 (our role).

Ledger, approvals and verdicts

Every step the agent takes is written to an append-only, cryptographically signed ledger, along with any approval questions you answer and the independent pass/fail verdict. These records are designed not to be edited or deleted — that immutability is the product's core feature. See section 6 on what that means for erasure.

3. Where your data goes (recipients & sub-processors)

sessiontwin is built and hosted entirely on Base44 (operated by Wix.com Ltd.; the controller entity named in Base44's own privacy documents is "Base44, Inc."). Base44 acts as our processor. The following recipients receive data:

Base44's published sub-processors (which become ours) include MongoDB, SendGrid, Langfuse (Germany), Logfire (UK), Render, Google Cloud, OpenAI, Anthropic, Wix.com Ltd. (Israel), Supabase and DataDog. The full current list, with each one's purpose and country, is maintained by Base44 and reproduced in our Data Processing Terms.

AI providers and training

Your task and file contents are sent to an AI model (Anthropic) via Base44 to perform the work. Base44's Terms of Service, as published, grant Base44 a licence that includes using customer data to train its software tools, including AI/ML models; its Data Processing Addendum states that personal data is used only to provide the service or in anonymised/ aggregated form. These two provisions are in tension. We disclose this rather than paper over it, and we are seeking written confirmation from Base44 of the controlling term and of the retention/training terms of the underlying model providers (this is an open question below).

4. International transfers

Because the Service runs on Base44's US-based infrastructure by default, data from the EU/EEA, the UK or elsewhere is transferred to the United States and other countries where Base44's sub-processors operate. The operator is in Israel, which currently benefits from a European Commission adequacy decision (reconfirmed 15 January 2024), so EU→Israel transfers do not currently require additional safeguards; transfers onward to the US rely on the transfer mechanisms in Base44's DPA (EU-US Data Privacy Framework and/or Standard Contractual Clauses). Adequacy status is under ongoing review — see open questions.

5. What we do not do

• We do not show advertising or use ad-tech, and we do not track you across other sites.
• sessiontwin's own code runs no analytics, telemetry, error reporting or session recording. However, our hosting platform (Base44) sets a platform-analytics session identifier in your browser, and our CDN (Cloudflare) collects real-user-monitoring performance telemetry. These are described in the Cookie Notice. We are reviewing whether they require your prior consent.
• We do not sell or rent your personal data.
• We do not profile you. The "Twin" learns only from the approval answers you yourself give, recomputed from those records — there is no stored model or score.
• We do not set our own cookies or browser storage; see the Cookie Notice.

6. Retention and your rights

Account data is retained while your account exists and then per Base44's retention and backup practices (Base44 states backups are deleted "after set intervals" — we are confirming the exact period). Mission ledgers are, by design, append-only and immutable.

Where the GDPR, UK GDPR or Israel's Privacy Protection Law applies, you may have rights to access, rectify, erase, restrict, port or object to the processing of your personal data, and to complain to a supervisory authority. To exercise them, contact us at the address in section 1.

7. Security

Missions are signed with a key the backend never holds, so records are tamper-evident even against the most privileged platform write. Hosting security (encryption, access control, penetration testing) is provided by Base44, which asserts SOC 2 Type II and ISO 27001 on its trust pages. See the Security & Vulnerability Disclosure page.

8. Third-party personal data in repositories

Code you ask us to work on may contain other people's personal data (names and emails in commit history, code or comments). If you connect a repository, you confirm you are entitled to have its contents processed. In such cases you are typically the controller of that data and we act as your processor; the Data Processing Terms govern that relationship. (In the current build, code access uses the operator's own GitHub credentials, so this scenario is limited — see the Data Processing Terms.)

9. Children

The Service is not directed to children and is intended for professional developers. We do not knowingly collect data from children under the age set by applicable law.

10. Changes

We will update this policy as the Service changes and revise the "Last updated" date. Material changes will be signposted on this page.

Evidence map (source in code)

Each factual claim above traces to the following sources. Full detail: legal/_data-map.md.