Twivo Labs ("we", "us", "our") is a studio that produces advertising and short-form video, at twivolabs.com. This page tells you what personal data we hold, why, and your choices. There is no public sign-up here — we hold data about people who enquire, about clients whose work we produce, and, for research, about the public posts of accounts we have never dealt with.
1. Data we hold
- Enquiry details: what you type into the enquiry form. Only your name and phone number are required; the brand name, the email address and the description of what you need are all optional, and leaving them blank still reaches us.
- How you reached us: the campaign tags carried in the link you clicked (source, medium, campaign) and the address of the page that referred you. The form reads these off the URL by itself — you do not type them — and files them with the enquiry so we know which channel produced it. Arrive by typing the address in and there is nothing to record.
- Your IP address, and the phone number you enquire with: submitting the enquiry form is counted twice against a 15-minute window — once under your IP address, once under the phone number you typed — so that neither one address nor one number can flood us. Both are written into that counter in plain text; the phone number therefore sits in the counter as well as on the enquiry. Approving or requesting changes on a review link is counted under the IP address only. Neither counter is filed against the enquiry itself. A counter row stops being used the moment its window passes, and is cleared a day or two later — sooner if the next submission from anyone sweeps it, otherwise by the nightly clean-up.
- Reference material: the photos and voice samples a client sends so that a model can be built.
- Face and voice models: the models derived from that reference material, and the provider ids that identify them at the service holding them.
- The consent record: who consented, whether to face, voice or both, when, and the verbatim text of the notice they were shown. It also holds the evidence the consent was given — how it was captured (a video, a one-time code, a signature) with a reference to it, and the IP address and browser user agent it came from. We store the wording word for word rather than by version number, so that months later we can show exactly what a person agreed to. Consent records are never edited — a change is a new record that supersedes the old one.
- Deliverables and working files: scripts, voiceovers, renders, the finished reel or ad, and the private review links they were shown on.
- Public posts we study: to work out what is landing on a platform we collect public Instagram posts and keep them in our own database — the handle of the account that posted, the caption, a transcript of the audio, the music credited, hashtags, mentions, accounts tagged in the post, the location named on it and the public engagement numbers. These are strangers' public posts, gathered for research, and they belong to whoever posted them rather than to any client of ours. We never contact anyone off the back of them and we never publish them. There is no automatic expiry on this table today, so a post stays until we delete it; if one of yours is in there and you want it gone, email us and we will remove it.
- An Instagram Business connection, if the studio owner authorises one: the access token and account details returned by Meta when the owner connects the studio's own Instagram account. It is the studio's account, never a client's — you are never asked to connect anything.
- Operational logs: timestamps of production runs for debugging and abuse prevention.
We do not hold card or UPI details. Invoices are paid outside this site.
2. How we use it
- To reply to your enquiry and quote for the work.
- To know which channel an enquiry arrived through, so that we put our effort where the work actually comes from.
- To produce the reel or ad you commissioned, and to deliver it to you.
- To prove, for any asset we produced, that consent for the likeness in it existed.
- To send transactional email about your engagement (review links, delivery, invoices).
- To study what is working publicly on a platform, so that a brief is written from evidence rather than guesswork. That is the only thing the collected public posts are for.
We never sell your data, and we do not use a client's face, voice or material to produce work for anyone else.
3. Processors in the pipeline
- Anthropic (Claude) — brand context and script drafting. Anthropic does not train on API content.
- ElevenLabs — voice model creation and speech generation. The account is ours, not yours.
- A face generation service — creation and storage of a face model, and generation from it. Which service holds a given model is recorded against that model, and we name it to the person whose face it is before the model is built. None is connected on the live site today.
- Cloudflare R2 — storage of reference material, working files and deliverables.
- Resend — transactional email delivery.
- Neon / Vercel — database and hosting.
As the consent notice says: these services hold their own copies under their own terms.
Two more services are wired into the studio. Neither is sent anything you give us, but both are named here because both touch personal data:
- Apify — the service that runs the public-post research in section 1. It receives the hashtags and account names we ask it to look up, and returns the public posts of the strangers who published them.
- Meta (Instagram Graph API) — used only where the studio owner has connected the studio's own Instagram Business account. Meta issues the access token we then hold. No client account is ever connected to it.
4. Retention, and withdrawing consent
Consent for a face or voice model stays in force until it is withdrawn. You may withdraw it at any time in writing, at hello@twivolabs.com. We will then delete the model and stop new production within 30 days. Content already published or delivered before the withdrawal is not affected.
Ask us to delete your enquiry details and we will purge them, and the attribution filed beside them, within 14 days. The throttle counters that hold an IP address and a phone number clear themselves without you asking, a day or two after the window they belong to. Consent records themselves are kept after a model is deleted, because they are the evidence for work already delivered.
The public posts we collect for research are kept with no automatic expiry — nothing deletes them on a timer today. Ask for one to be removed and we will remove it.
5. Your rights
You can access, correct, export or delete your data. Email hello@twivolabs.com for any request.
6. Security
Studio access is limited to the owner and the editors working on a specific piece. Sessions use HTTP-only cookies signed with HMAC. Provider credentials are held server-side and never exposed to a client or an editor. We use TLS for all transit. No system is perfectly secure; report any concerns to security@twivolabs.com.
7. Children
Nothing here is addressed to children, and we do not knowingly hold personal data about anyone under 18. If you believe we hold a child's photos, voice sample or contact details, email hello@twivolabs.com and we will delete them.
8. Changes
We may update this policy. Where a change materially affects a client whose work is in production, we will tell them directly.
9. Contact
Twivo Labs · India · hello@twivolabs.com