Privacy

Who we are

tewo is operated by Tewo Saas Solutions, 201, D15, Shree Ji Valley, Bicholi Mardana, Indore, Madhya Pradesh 452016, India. For anything on this page, write to hello@amionyx.com.

Two kinds of people use tewo

A company signs up and runs its workspace here — its staff records, leave, timesheets, projects, clients and so on. For everything that company puts in, the company decides what is collected and why; we hold and process it on their instructions. If you are an employee asking why your employer records something, they are the ones who can answer, and we will help them do it.

Everyone else — somebody applying for a job through a company’s public page, filling in an enquiry form, or answering a form they were sent a link to. There, what is collected is whatever that form asks, and it goes to the company that put the form up.

What we hold

Your account

Name, email address, and the workspaces you belong to. There is no password — signing in sends a six-digit code to your email, so we never hold one.

What your employer records about you

Whatever they fill in: role, department, dates, contact details, documents they upload, leave taken, timesheets filed, assets issued, performance reviews written.

What you write in the product

Chat messages, comments on tasks, notes on a client or a lead, and files you upload. Voice notes are transcribed to text (see below).

Applications and enquiries

If you apply for a job: your CV, the answers to the questions the role asked, and the contact details you gave. If you fill in a company’s enquiry or lead form: whatever that form asked for.

Technical records

Server logs with IP addresses and request paths, kept for security and to work out what broke. Rate limits count requests per IP address so one visitor cannot flood a form. Your IP address also tells us which country you are in, so prices show in rupees in India and US dollars elsewhere. That lookup happens on our own server, using IP geolocation by DB-IP; the address is not sent to anyone and the answer is not stored.

tewo Mail

If your company uses tewo Mail, your mailbox — the mail in it, its folders, your signature and settings — is kept on a mail server we run ourselves, with the same hosting provider as the rest of tewo. Your company decides who has a mailbox and is responsible for what happens to them; we hold them on its behalf and do not read them.

Whether your company can see mail you send outside it depends on where the company is.

• In the EU, EEA, UK and Switzerland this is off unless your company’s Admin turns it on — and to turn it on they must confirm that you have been told in writing, that a data protection impact assessment has been done, and that the works council or staff representatives have agreed where the law asks for it.
• Everywhere else it is on unless the Admin turns it off.

When it is on, Mail tells you so on every screen. The Admin sees a list of mail sent to addresses outside the company — who sent it, to whom, the subject and the names of any attachments — kept for 90 days. To open one, the Admin has to write down why first, and that is added to a reading record that nobody, the Admin included, can change or delete. Mail inside the company is never listed. When it is off, none of this is recorded: only a count of outside recipients is kept for the day, so that one mailbox cannot be used to send hundreds of messages, and it is gone within two days.

When you leave a company, your mailbox is closed to you and kept, unread by us, for your company — which can forward new mail to a colleague. It is deleted when the workspace is.

Cookies

Three, all strictly necessary, and no advertising or tracking cookies at all:

• gs_session — keeps you signed in. Unreadable by JavaScript.
• gs_csrf — stops another website submitting a form as you.
• gs_seeker — the same as gs_session, for a job seeker’s own account.

Visits to a company’s public page are counted without a cookie. We cannot tell one visitor from another there, and we do not try.

Where it is kept

On our own server in Mumbai, India (AWS, ap-south-1), with the database reachable only from that machine. Uploaded files — documents, photos, CVs — are stored with Cloudflare R2, some of them in a private bucket that can only be read through a signed link that expires.

Who else touches it

We use these, and only for the job named:

• Cloudflare R2 — storing uploaded files.
• Hostinger — sending sign-in codes, invitations and notifications from noreply@tewo.in.
• Anthropic and Google (Gemini) — reading a CV into fields, screening an application against a role, reading a lead form’s answers or a pasted enquiry into the right columns, summing up a recorded call, drafting text you ask for, and suggesting a task’s acceptance criteria. Only what that feature needs is sent, and only when it runs.
• Groq — turning a voice note or a recorded call into text.
• LiveKit Cloud — carrying audio and video between the people in a call, through the region nearest them. Calls are not recorded unless somebody in the call starts a recording.
• Google — only if a company chooses to connect its Google Business Profile, and only for that profile.
• Razorpay — taking payment. They receive the billing contact and the amount, never anything from inside a workspace, and your card details go to them and never to us.
• Amazon Web Services — the server and the database themselves, in Mumbai.

The full list with what each one does and where it sits is in our data processing terms, and we give 30 days’ notice before adding or replacing any of them.

We do not sell anything to anybody, and we do not share your data with advertisers. There are none.

We do not sell it, and we do not share it

We have never sold data and we will not. Not to advertisers, not to data brokers, not to anybody. There is no arrangement under which a third party pays us for access to what is in your workspace, and there will not be one — if that ever changed, it would be a different company and you would be told long before it happened, not in a quiet edit to this page.

One company’s data is never shown to another. Every query the product makes is scoped to the workspace asking, and we do not pool records across companies to build anything — no benchmarks, no industry averages, no training sets. Your salary bands do not become somebody else’s market data.

The only outsiders who touch any of it are the suppliers listed above, who are paid to run a piece of the service and may use it for nothing else. We also hand things over if a court or the law requires it, which nobody can contract out of; where we are allowed to tell you that it happened, we will.

Keeping it safe — and what we cannot promise

What we do: your data sits with established providers rather than on a machine under somebody’s desk, traffic is encrypted, there are no passwords to steal because signing in uses a one-time code to your email, every company’s records are separated from every other’s, and files are served through links that expire rather than public addresses.

What we are not going to pretend about: tewo is a new product run by a small team, and we hold no third-party certification yet — we have not been through an independent security audit. The safeguards above are real and we maintain them, but if your organisation requires a certified supplier, we are not one today. We would rather you knew that before you decide what to put here than after.

No system is safe from everything. If somebody breaks in, or data is exposed despite all of the above, we will tell you what happened, what it affected and when — and we will notify the authorities where the law requires it. Beyond that, and to the fullest extent the law allows, we are not liable for what follows — see our terms. Some duties cannot be signed away and we are not claiming otherwise.

How long we keep it

Deleting something inside tewo moves it to Recently deleted, where it can be put back. After 30 days it is removed for good, along with its files. Everything else is kept while the workspace exists; when a workspace is closed, its data is removed.

Who is answerable for what

This is the distinction the law turns on, and getting it the wrong way round is how companies end up answering for something that was never theirs.

• For a company’s own data — its roster, reviews, invoices, candidates — that company decides, and we only hold it. They are the data fiduciary under India’s DPDP Act, and the controller under the GDPR. We act on their instructions. If you work somewhere that uses tewo and you want your record changed, they are the ones who can decide it; we will pass your request to them and tell you we have.
• For the account itself — who signed up, the billing details, how the product is used — we decide. That part is ours to answer for, and the rights below apply to us directly.

Why we are allowed to hold it

Where the GDPR applies, every piece of this rests on one of three grounds, and no other:

• To do what we agreed. You asked for a workspace; running it means holding the records in it. This covers almost everything on this page.
• Because we have to by law. Invoices and tax records, kept for as long as the law says and no longer.
• Because it is reasonable and you would expect it. Keeping the service secure, and stopping abuse. We weighed this against your interests before relying on it, and you can object — see below.

Where India’s DPDP Act applies, the ground is the one it sets out: the data is processed for the purpose it was given for, and nothing else. We do not sell data, and we do not use anybody’s data to train an AI model. Where a model reads a CV, it reads it to answer one question about one posting and keeps nothing.

Your rights

You can ask for a copy of what we hold about you, ask for it to be corrected, or ask for it to be deleted. Write to hello@amionyx.com and we will answer within 30 days.

If the data belongs to a company’s workspace — your employment record, for instance — we will pass the request to that company, because it is theirs to decide. We will tell you that we have.

Deleting data that arrived from another platform

If a company connects an advertising account and leads reach tewo that way, the same applies: write to hello@amionyx.com with enough to identify the record — the email address or phone number given on the form — and it will be deleted, along with anything stored against it.

Under India’s DPDP Act, 2023

You may ask what we hold and who it has been shared with, ask for it to be corrected or completed, ask for it to be erased, and nominate somebody to exercise these for you if you cannot. You may withdraw consent as easily as you gave it.

If you are not satisfied with our answer, write to our grievance officer. Complaints reach them at Tewo Support, hello@amionyx.com, and they must answer you — tell us it is a grievance and it will not be treated as an ordinary support request. If you are still not satisfied, you may complain to the Data Protection Board of India. We will not ask you to go through us first.

Under the GDPR and the UK GDPR

You may ask for access, correction, erasure, a copy in a portable form, a restriction on what we do with it, and you may object to anything we do on the “reasonable and expected” ground above. Where we rely on consent you may withdraw it, and that does not undo what was lawful before.

We answer within one month. You may complain to your supervisory authority without asking us first — in Ireland the DPC, in the UK the ICO, and in every other member state the authority for where you live.

If your data leaves the country it was given in

Workspaces are hosted in India by default, and India has not been given an adequacy decision by the European Commission — so a transfer out of the EU or the UK needs a legal basis of its own.

Ours is the European Commission’s Standard Contractual Clauses with the UK Addendum, which are built into our data processing terms and apply automatically to any customer who needs them — there is nothing for you to chase. If you want them signed as a separate document as well, ask and we will sign them with you.

A company that needs its data to stay in a particular country can ask, and we will put in writing where it sits. Today the honest answer for every workspace is India, with files at Cloudflare R2 and the AI services named above reached from there.

In the United States

If you live in California or another US state with its own privacy law (Virginia, Colorado, Connecticut, Utah, Texas and others), you have the right to know what we hold about you, to have it corrected or deleted, and to take a copy. We do not sell personal information, and we do not share it for advertising — there is nothing to opt out of, and we will not treat you differently for asking about any of this. For the records a company keeps in tewo about its own people, we act as that company’s service provider and use them only to run the service for it. Write to us and we will answer within 45 days.

Somewhere else entirely

Other countries give people similar rights under other names — among them Brazil’s LGPD, Canada’s PIPEDA, Australia’s Privacy Act, South Africa’s POPIA, Saudi Arabia’s PDPL and the UAE’s data protection law. We do not make you work out which one covers you. Write to us with what you want done and we will treat it under whichever law gives you the most, rather than the least.

Children

tewo is a tool for running a company. It is not for anybody under 18, and we do not knowingly hold their data.

Changes

When this page changes, the date at the top changes with it. If a change matters to you — a new processor, a new kind of data — we will say so by email rather than quietly editing the page.