Privacy Policy — Tweeksy

Version: 1.0 Effective date: July 1, 2026 Service: Tweeksy, published by Wazo SRL Controller: Wazo SRL Address: 5, Ellerwee, 8523 Beckerich, Luxembourg Luxembourg Trade and Companies Register: B157533 VAT number: LU24431813 Business permit: 10011646 Personal data contact: privacy@tweeksy.com Support contact: support@tweeksy.com

1. Purpose of this Privacy Policy

This Privacy Policy explains how Wazo SRL, the publisher of the Tweeksy service, collects, uses, stores and protects personal data in connection with the use of Tweeksy.

It applies in particular to:

• users who create a Tweeksy account;
• customers who use Tweeksy to create, manage or publish websites;
• members invited into a Tweeksy workspace;
• persons who contact Tweeksy;
• visitors to websites created with Tweeksy, where their data is technically processed by Tweeksy on behalf of a customer.

In plain language: this policy explains what data is processed by Tweeksy, why it is used, how long it is stored and what rights may be exercised.

2. Who is the controller?

For data related to the creation and use of a Tweeksy account, Wazo SRL acts as controller.

This includes, in particular:

• user account data;
• login data;
• billing data;
• subscription-related data;
• support requests;
• communication preferences;
• proof of acceptance of legal documents;
• data necessary for platform security.

For data collected through websites created by Tweeksy customers, in particular through forms, the customer who owns the website generally acts as controller.

In this case, Wazo SRL / Tweeksy acts as a technical processor on behalf of the customer, to the extent necessary for hosting, storage, transmission or technical processing of such data.

In plain language: for your Tweeksy account, Wazo is the controller. For data collected through a customer website, the website owner is generally the controller, and Tweeksy provides the technical tool.

3. Personal data processed

Tweeksy may process different categories of data depending on how the service is used.

3.1 User account data

This may include:

• first name;
• last name;
• email address;
• securely stored password;
• preferred language;
• country;
• role in a Tweeksy workspace;
• account creation date;
• account status.

3.2 Data related to tenants / Tweeksy workspaces

This may include:

• name of the Tweeksy workspace;
• workspace settings;
• members;
• roles and permissions;
• associated websites;
• subscription or plan;
• AI Credits;
• linked domains;
• activity history useful for the operation of the service.

3.3 Data related to websites created with Tweeksy

This may include:

• pages;
• content;
• texts;
• images;
• logos;
• media;
• SEO settings;
• languages;
• publication settings;
• GDPR configuration;
• data sources;
• forms;
• domain-related settings.

3.4 Form data collected through customer websites

When the customer activates forms on their website, the data submitted by visitors may include, depending on the configured fields:

• last name;
• first name;
• email address;
• phone number;
• message;
• company;
• any other information voluntarily entered in the form;
• active language;
• submission date;
• IP address;
• user agent;
• version of the information notices displayed;
• status of any checkboxes.

As of the effective date of this Policy, forms offered by Tweeksy do not allow file uploads, unless the service evolves in the future.

3.5 Payment and billing data

Tweeksy uses third-party services to manage payments.

The data processed may include:

• customer or transaction identifiers;
• subscribed plan;
• billing period;
• amount;
• currency;
• payment status;
• payment references;
• invoices;
• data necessary for accounting follow-up.

Full payment card details are not processed directly by Tweeksy when they are collected by the payment provider.

3.6 Data related to domain names

When the customer purchases, connects or renews a domain name through Tweeksy, the processed data may include:

• domain name;
• owner / registrant;
• administrative contact;
• technical contact;
• registrar billing contact;
• email address;
• postal address if required;
• phone number if required;
• domain status;
• expiry date;
• data necessary for renewal or transfer.

The customer remains responsible for the accuracy of the data provided for the registration or management of a domain.

3.7 Data related to the use of artificial intelligence

Certain Tweeksy features rely on artificial intelligence tools.

To execute a request, Tweeksy may technically process:

• prompts;
• instructions;
• content to be modified;
• generated texts;
• images or image descriptions;
• generation settings;
• history or context strictly necessary for the requested feature.

Tweeksy does not use customer content to train its own artificial intelligence models.

3.8 Technical data and logs

Tweeksy may process technical data necessary for the operation, security and improvement of the service:

• IP address;
• user agent;
• login logs;
• timestamps;
• technical identifiers;
• security events;
• application errors;
• diagnostic data;
• critical actions performed in the interface.

3.9 Communication data

When a user contacts Tweeksy, the processed data may include:

• email address;
• name;
• message content;
• attachments possibly sent by email to support;
• exchange history;
• information necessary to handle the request.

4. Purposes of processing

Tweeksy processes personal data for the following purposes.

4.1 Account creation and management

Data is used to:

• create the user account;
• allow login;
• manage the profile;
• verify the email address;
• manage roles and permissions;
• secure access to the service.

4.2 Provision of the Tweeksy service

Data is used to:

• create, modify and publish websites;
• manage Tweeksy workspaces;
• store content;
• manage media;
• configure forms;
• manage languages;
• allow website publication;
• provide AI features;
• manage AI Credits;
• connect or manage domains.

4.3 Management of subscriptions, payments and invoices

Data is used to:

• manage plans;
• process payments;
• track subscriptions;
• issue or make invoices available;
• manage non-payment;
• apply possible suspensions;
• comply with accounting, tax and legal obligations.

4.4 Management of AI Credits

Data is used to:

• calculate available credits;
• consume credits during relevant actions;
• distinguish credits included in the subscription from purchased packs;
• log credit movements;
• notify the customer when credits become insufficient;
• block an action when credits are insufficient.

4.5 Management of domain names

Data is used to:

• purchase or register a domain;
• connect a domain to a website;
• manage renewal;
• manage the necessary contacts;
• communicate with domain service providers;
• inform the customer of deadlines or expiry risks.

4.6 Management of customer website forms

Data collected through forms is processed to:

• transmit the message to the customer;
• store the submission if the feature is enabled;
• allow the customer to consult messages;
• apply retention rules;
• automatically delete data that has reached expiry.

In this case, the customer who owns the website is generally the controller, and Tweeksy acts as a technical processor.

4.7 Security and abuse prevention

Data may be used to:

• detect unauthorized access;
• prevent fraud;
• fight spam, phishing or abuse;
• protect accounts;
• protect the infrastructure;
• analyze incidents;
• retain evidence necessary in the event of a dispute.

4.8 Customer support

Data may be used to:

• respond to requests;
• diagnose a problem;
• provide assistance;
• track exchanges;
• improve support quality.

4.9 Transactional emails

Tweeksy may send transactional emails related to the operation of the service, in particular for:

• account creation;
• email verification;
• password reset;
• user invitation;
• failed payment;
• non-payment reminder;
• suspension;
• insufficient credits;
• domain approaching expiry;
• domain renewal;
• account security;
• important service changes.

These emails are necessary for the operation of the service and are separate from marketing communications.

4.10 Marketing communications

Tweeksy may send marketing communications only where the user has given consent or where permitted by law.

The user may withdraw consent or unsubscribe from marketing communications at any time.

5. Legal bases for processing

Depending on the case, processing carried out by Tweeksy is based on the following legal bases:

• performance of a contract or pre-contractual measures;
• compliance with a legal obligation;
• legitimate interest of Wazo / Tweeksy;
• consent of the data subject;
• defense of the rights of Wazo / Tweeksy in the event of a dispute.

6. Data of visitors to customer websites

Websites created with Tweeksy may be operated by customers independent from Wazo.

When a visitor fills in a form or interacts with a customer website, the website owner is generally the controller of the data collected.

The customer must in particular:

• inform visitors to their website;
• determine the legal basis for processing;
• configure the information notices;
• manage visitor requests;
• comply with the obligations applicable to their activity.

Tweeksy processes this data only as a technical service provider, to the extent necessary for the operation of the service.

Visitors to a customer website should primarily contact the owner of the relevant website to exercise their rights. Tweeksy may assist the customer where necessary and possible.

7. Use of artificial intelligence

Tweeksy may use artificial intelligence services to provide certain features.

Data transmitted to these services is limited to what is necessary to execute the user's request.

Tweeksy does not use customer content to train its own artificial intelligence models.

Third-party services used to provide AI features may technically process the content, prompts, images or instructions necessary to execute the request.

The customer remains responsible for reviewing AI-generated or AI-assisted content before publication.

8. Google Analytics, Google Tag Manager and cookies

As of the effective date of this Policy, Tweeksy does not provide an internal analytics tool integrated into the platform.

Tweeksy may, however, allow the customer to configure certain provided integrations, including:

• Google Analytics;
• Google Tag Manager.

When the customer activates these services on their own website, the customer is responsible for:

• informing visitors;
• obtaining any required consents;
• correctly configuring the tools;
• complying with the obligations applicable to their website.

The use of cookies and similar technologies is detailed in Tweeksy's Cookie Policy, available at: https://www.tweeksy.com/en/legal/cookies

9. Data recipients

Personal data may be accessible, depending on the case, to the following recipients:

• authorized Wazo / Tweeksy personnel;
• hosting providers;
• storage providers;
• CDN or media delivery providers;
• payment providers;
• email sending providers;
• domain name providers;
• artificial intelligence providers;
• support or maintenance providers;
• legal, accounting or tax advisors;
• competent authorities where required by law.

Tweeksy limits access to data to persons and providers who need it to provide the service, ensure security, comply with legal obligations or defend its rights.

10. Processors and third-party services

To provide Tweeksy, Wazo SRL may rely on specialized processors and third-party services.

These providers intervene only to the extent necessary for the provision, security, operation, billing or improvement of the service.

This list may evolve according to Tweeksy's technical, functional, legal or commercial needs.

When Tweeksy acts as controller, Wazo ensures that it uses providers offering appropriate safeguards in terms of security and personal data protection.

When Tweeksy acts as processor on behalf of a customer, the conditions applicable to sub-processors are specified in the Data Processing Agreement or applicable contractual documents.

Some providers may process data outside the European Economic Area. In such cases, Tweeksy ensures that transfers are governed by appropriate safeguards where required by applicable regulations.

Tweeksy does not sell personal data to third parties.

11. Transfers outside the European Economic Area

Some providers used by Tweeksy may be located or process data outside the European Economic Area.

Where transfers outside the European Economic Area take place, Tweeksy ensures that they are governed by appropriate safeguards where required, for example:

• adequacy decision;
• standard contractual clauses;
• additional contractual, organizational or technical measures;
• any other mechanism recognized by applicable regulations.

12. Retention periods

Tweeksy does not retain personal data indefinitely.

Data is retained for a period appropriate to the purpose of processing, legal obligations and evidence or security needs.

12.1 User account

Account data is retained for the lifetime of the account, then deleted or archived according to the applicable rules after deletion of the account or Tweeksy workspace.

12.2 Websites and Tweeksy workspaces

In the event of voluntary deletion of a website or Tweeksy workspace:

• soft deletion is immediate;
• recovery is possible for 30 days;
• active data may be permanently deleted after 30 days.

12.3 Backups

Data deleted from the active application may remain temporarily present in technical backups. It disappears progressively according to the backup rotation cycle, with a maximum target period of 90 days.

12.4 Prolonged non-payment

In the event of prolonged non-payment, Tweeksy may delete certain data after 90 days from the public suspension of the website, according to the applicable rules and after any notifications.

12.5 Form data

Form submissions have a configurable retention period.

The recommended default retention period is 365 days, unless configured otherwise.

The expiry date is calculated and recorded at the time of submission.

Expired submissions may be automatically deleted.

12.6 Billing and accounting data

Data necessary for billing, payments, accounting and tax obligations may be retained for longer, in accordance with applicable legal obligations.

12.7 Contractual evidence

Proof of acceptance of legal documents may be retained for as long as necessary to demonstrate acceptance, comply with legal obligations or defend the rights of Wazo / Tweeksy.

12.8 Security, fraud and disputes

Data necessary for security, abuse prevention, fraud detection or dispute management may be retained for the period necessary for these purposes.

13. Deletion of a website or Tweeksy workspace

The customer may request deletion of a website or Tweeksy workspace where this feature is available.

Voluntary deletion results in immediate soft deletion.

For 30 days, the data may remain recoverable by an authorized user or through an appropriate procedure.

After this period, Tweeksy may permanently delete the relevant active data.

Certain data may remain temporarily present in technical backups, with a maximum target period of 90 days.

Certain data may be retained for longer where required by a legal, tax, accounting or contractual obligation, or for evidence purposes.

Deletion of a Tweeksy workspace does not automatically transfer ownership of a domain name and does not improperly remove the customer's rights over a domain registered in their name.

14. Data security

Tweeksy implements technical and organizational measures intended to protect personal data against:

• unauthorized access;
• loss;
• alteration;
• unauthorized disclosure;
• destruction;
• abuse;
• security incidents.

These measures may include in particular:

• access control;
• role management;
• logging;
• backups;
• application security measures;
• secure communications;
• separation of environments;
• limitation of internal access to authorized persons.

However, no security measure can guarantee absolute security.

15. Rights of data subjects

Subject to the conditions provided by applicable regulations, data subjects have in particular the following rights:

• right of access;
• right to rectification;
• right to erasure;
• right to restriction of processing;
• right to object;
• right to data portability;
• right to withdraw consent where processing is based on consent;
• right to lodge a complaint with a supervisory authority.

To exercise these rights regarding processing carried out by Wazo / Tweeksy as controller, it is possible to write to: privacy@tweeksy.com

Tweeksy may request additional information to confirm the identity of the requester where necessary.

Where the request concerns data collected through a customer website, the visitor should primarily contact the owner of the relevant website. Tweeksy may assist the customer in handling the request where necessary and possible.

16. Complaint to the supervisory authority

Data subjects may lodge a complaint with the competent supervisory authority.

For Luxembourg, the competent authority is:

Commission nationale pour la protection des données — CNPD 15, Boulevard du Jazz L-4370 Belvaux Luxembourg

Website: https://cnpd.public.lu

17. Marketing communications

Tweeksy may send marketing communications where the user has consented or where permitted by law.

The user may unsubscribe at any time using the link provided in the emails or by contacting Tweeksy.

Marketing communications are separate from transactional emails necessary for the operation of the service.

18. Transactional emails

Tweeksy may send transactional emails even if the user does not receive marketing communications.

These emails may concern, in particular:

• account creation;
• email address verification;
• password reset;
• invitation to join a Tweeksy workspace;
• security;
• failed payment;
• non-payment reminder;
• suspension;
• payment regularized;
• low or exhausted credits;
• domains;
• forms;
• important service changes.

These emails may in particular be sent from the following address: notifications@tweeksy.com

19. Minors

Tweeksy is not specifically intended for minors.

Where use of the service by a minor requires authorization from a legal representative, such authorization must be obtained before using the service.

Tweeksy may delete or suspend an account where it appears that its use does not comply with the rules applicable to minors.

20. Modification of the Privacy Policy

Tweeksy may modify this Privacy Policy to take into account:

• changes to the service;
• legal or regulatory developments;
• changes in providers;
• new features;
• the need for clarification.

The new version is published with an effective date.

Where the changes are significant, Tweeksy may inform users or request renewed acknowledgment.

21. Language of the Privacy Policy

This Privacy Policy is originally drafted in French.

Tweeksy may provide an English version to make it easier for users to understand.

When a user acknowledges having read the Privacy Policy, Tweeksy stores the version, date and language of the version that was presented to the user.

In the event of any discrepancy between the French version and a translation, the French version shall prevail, unless a mandatory legal provision applicable to the consumer provides otherwise.

22. Contact

For any question regarding this Privacy Policy or the exercise of rights relating to personal data, the user may contact Tweeksy at: privacy@tweeksy.com

For other requests:

• General support: support@tweeksy.com
• Legal questions: legal@tweeksy.com
• Reporting abuse or illegal content: abuse@tweeksy.com
• Security reporting: security@tweeksy.com

Publisher address:

Wazo SRL 5, Ellerwee 8523 Beckerich Luxembourg