This policy explains how BTWOP LTD ("B² = P", "BTWOP", "we", "us") collects, uses and protects personal data when you use btwop.app, our apps and related services (the "platform").
- Controller: BTWOP LTD, a company registered in England and Wales. Company number: [to be confirmed]. Registered office: [to be confirmed].
- ICO registration number: [to be confirmed].
- Privacy contact: support@btwop.app (subject line "Privacy"), or the Help Centre.
- EU representative (Article 27 EU GDPR): [to be confirmed], for people in the European Economic Area.
We comply with the UK GDPR, the Data Protection Act 2018, the Privacy and Electronic Communications Regulations 2003 (PECR) and, where it applies to you, the EU General Data Protection Regulation (EU GDPR) and national ePrivacy laws.
- Members who browse, buy, book, take quizzes, use AI assistants, join the community or donate.
- Specialists and creators who apply, publish content, offer services or receive payouts.
- Visitors to our public pages, newsletter subscribers and people who contact us.
Where a specialist delivers a session to you, they may also act as an independent controller of the notes and records they keep for their own professional practice. Their own privacy notice applies to that data.
- Identity and account data: name, email, display name, profile and cover photos, role, language, sign-in records and two-step verification settings.
- Contact data: phone number if you add one, and messages you send to us or through the platform.
- Well-being and health data: quiz answers and results, journal entries, AI assistant conversations, and anything you choose to share about your mental or physical health. This is special category data.
- Community content: posts, comments, reviews, reactions, follows, favourites, photos, audio and video you upload.
- Transaction data: purchases, subscriptions, bookings, event tickets, donations, wallet activity, points, referral rewards, refund requests and disputes. Full card details are handled by our payment processor, Stripe, and are never stored by us.
- Specialist data: title, qualifications, CV, verification and vetting records, services, availability, payout account references, commission and earnings records.
- Technical and usage data: device and browser type, approximate location derived from your network, IP address, session and security events, pages viewed and choices stored on your device (see our Cookie Policy).
- Referral data: who invited you, and the referral code used.
We do not knowingly collect data from anyone under 18.
- Providing the platform, your account and your purchases — performance of a contract (Article 6(1)(b)).
- Well-being features — quizzes, journal, AI assistants and sharing information with a specialist you choose — your explicit consent (Article 9(2)(a)), which you can withdraw at any time in your settings.
- Payments, bookkeeping, tax, anti-money-laundering and responding to authorities — legal obligation (Article 6(1)(c)).
- Keeping the platform safe — fraud prevention, security monitoring, sign-in alerts, moderation and enforcing our Terms — our legitimate interests (Article 6(1)(f)).
- Crisis safeguards — where there is a serious risk to someone's life, we may act to protect vital interests (Articles 6(1)(d) and 9(2)(c)) or for safeguarding purposes permitted by the Data Protection Act 2018.
- Improving the platform and analytics — your consent where non-essential storage is involved; otherwise our legitimate interests.
- Marketing emails and newsletters — your consent, or for existing customers our legitimate interests under the PECR soft opt-in. Every email includes an unsubscribe link.
- Vetting specialists — legitimate interests and, for any criminal-record or health information, the conditions permitted by the Data Protection Act 2018 Schedule 1.
Where we rely on legitimate interests, we have balanced them against your rights. You can ask us for details.
Our AI assistants (including Mentor, Nova and Clarity), quiz insights, translation, moderation and daily messages use AI models provided by third-party processors.
- AI output is general information, not medical, psychological, legal or financial advice, and may be inaccurate.
- Your conversations are processed to generate responses and to keep the service safe. We do not permit our AI providers to use your data to train their general models where we can contractually prevent it.
- Moderation tools may automatically flag content for human review. We do not make decisions with legal or similarly significant effects about you solely by automated means. If you think one has been made, you can ask for a human review.
Some of our providers process data outside the UK and the EEA, including in the United States. Where they do, we rely on:
- adequacy regulations or decisions (including the UK Extension to the EU-US Data Privacy Framework where the provider is certified); or
- appropriate safeguards — the UK International Data Transfer Agreement or the UK Addendum to the EU Standard Contractual Clauses, and the EU Standard Contractual Clauses for EEA data — supported by transfer risk assessments.
You can ask us for a copy of the relevant safeguards.
We keep personal data only for as long as we need it:
- Account and profile data: while your account is open, then deleted or anonymised after closure, except where we must keep it longer.
- Well-being data and AI conversations: while your account is open or until you delete them or withdraw consent.
- Transaction, tax and payout records: 6 years after the end of the financial year they relate to, as UK tax and company law requires.
- Security and sign-in logs: for a limited period needed to protect your account and investigate incidents.
- Moderation, dispute and legal records: for as long as needed to handle the matter and any claim, normally up to 6 years.
- Marketing preferences: until you unsubscribe, after which we keep a suppression record so we do not email you again.
Exact retention periods for each category are subject to final confirmation: [to be confirmed by counsel].
We use encryption in transit, role-based access controls, record-level permissions, optional two-step verification, sign-in and device alerts, session revocation, private file storage and staff access on a need-to-know basis.
No system is completely secure. If a personal data breach is likely to put your rights at high risk, we will tell you without undue delay, and we will notify the ICO (and any relevant EU authority) within 72 hours where required.
Under UK and EU data protection law you have the right to:
- access a copy of your data;
- correct inaccurate or incomplete data;
- erase your data ("right to be forgotten");
- restrict how we use it;
- data portability — receive it in a machine-readable format;
- object to processing based on legitimate interests, and to direct marketing at any time;
- withdraw consent at any time, without affecting processing already carried out;
- not be subject to solely automated decisions with legal or similarly significant effects.
Many of these are available directly in Account settings → Privacy, including data export, pausing and deleting your account. Otherwise email support@btwop.app. We will respond within one month, which may be extended by two months for complex requests. We may need to verify your identity. Requests are free unless they are manifestly unfounded or excessive.
Please contact us first so we can try to put things right.
You also have the right to complain to a supervisory authority:
- UK: the Information Commissioner's Office (ICO), ico.org.uk, 0303 123 1113.
- EEA: the data protection authority in the country where you live, work or where the issue occurred.
The platform is for adults aged 18 and over. If we learn that someone under 18 has created an account, we will close it and delete their data unless we must keep it to protect them or comply with the law.
Embedded players (such as YouTube or Spotify), crisis-line links, partner offers and charity sites are run by third parties with their own privacy policies. We are not responsible for how they handle your data.
We review this policy regularly. We will post updates on this page with a new version reference, and tell you about significant changes by email or in the app before they apply.