Privacy Policy
Release Date: October 20, 2026
Effective Date: October 27, 2026
Welcome to the TWT Platform (hereinafter also referred to as "the Platform", "we", "us", or "our"). TWT is operated by HIGHSOON PTE. LTD. (Registered Address: 8 Temasek Boulevard #21-03, Suntec Tower 3, Singapore 038988; hereinafter referred to as "HIGHSOON"). As a next-generation corporate product ecosystem born in Singapore and facing the world, the TWT Platform is deeply committed to meeting the global communication, collaboration, and digital service needs of enterprise teams, covering online instant messaging, team collaboration, enterprise applications (including but not limited to sub-products such as Chat, Link, Community, Domains, Mail, etc.), as well as multi-scenario SaaS products and cloud services such as AI Agents.
To provide you with accurate services and a secure network environment, we may collect and process your personal data when you use our services. We understand how important personal data is to you and are deeply aware of the importance of user data security. We strictly adhere to the requirements of the Singapore Cybersecurity Act 2018, Personal Data Protection Act 2012 ("PDPA"), Telecommunications Act 1999, Advisory Guidelines on the Personal Data Protection Act for Selected Topics, and other relevant laws, policies, and technical specifications, taking comprehensive security protection measures to safeguard your personal data.
Hereby, the Platform formulates this Privacy Policy (hereinafter also referred to as "these Terms" or "this Privacy Policy") to clarify for you how we collect, use, store, disclose, and protect your personal data during your use of the Platform and related services.
We hereby solemnly remind you that before registering and using the Platform, please read carefully and fully understand all contents of this Privacy Policy, especially the bolded terms. If you do not agree to any content hereof, you shall immediately cease registering and using the Platform and related services. If you register and use the Platform, it shall be deemed that you have fully read, understood, and agreed to our collection, storage, use, and protection of your relevant data in accordance with these Terms.
Special Notice: This Privacy Policy takes effect upon online publication. Unless we publish a revised new privacy policy in accordance with relevant laws, regulations, and platform operating requirements, these privacy terms shall remain continuously valid.
This Privacy Policy helps you understand the following contents:
I. Scope of Application of this Privacy Policy
II. How We Collect and Use Your Personal Data
III. How We Use Cookies and Similar Technologies
IV. How We Share, Transfer, and Publicly Disclose Your Personal Data
V. How You Delete and View Data and Delete Your Account
VI. How We Store and Protect Your Personal Data
VII. How We Handle Personal Data of Minors
VIII. Special Important Notice - Please Read Carefully
IX. Notifications and Revisions
X. Contact Us
I. Scope of Application of this Privacy Policy
1.1 These Terms apply to all products and services provided by HIGHSOON PTE. LTD. When you log in to and use the Platform, use products and services provided by the Platform, or log in to and use platform websites, pages, client terminals, mobile applications, API interfaces that have not independently published separate personal data protection policies (including the main website twt.com and related domains), these Terms shall apply. The products under the Platform's product ecosystem are software applications, system services, or platform infrastructure, including enterprise sub-products such as Chat, Link, Community, Domains, Mail, etc., as well as other services provided by our group companies. If you use products or services provided by the Platform but no independent personal data protection policy has been formulated, you agree to be bound by these Terms; if a specific product or service formulation has a separate personal data protection policy or both parties have signed a specific Data Processing Agreement (DPA), that specific personal data protection policy or DPA shall apply preferentially, and these Terms shall serve as a general baseline policy to supplement it.
1.2 If you have any questions, comments, or suggestions regarding this Privacy Policy, you may contact us at any time via official customer service email support@twt.com or data protection officer email legal@twt.com.
II. How We Collect and Use Your Personal Data
2.1 Definition and Scope of Personal Data
2.1.1 Personal Data refers to all types of data recorded electronically or otherwise that can identify a specific natural person alone or in combination with other data, or reflect the activities of a specific natural person. Such data includes, but is not limited to: individual full legal name, ID card/passport number, photographic and video imagery, personal mobile phone number, email address, residential address, telecommunication records and contents, account credentials and passwords, asset and financial transaction data, transaction records, etc.
In addition, the Personal Data Protection Commission of Singapore (PDPC) deems that once certain data is leaked or abused, it may cause substantial harm or adverse effects to individuals, and shall be regarded as "Highly Sensitive Data" requiring higher management standards. Such data includes: personal health and medical data, financial payment account credentials, biometric data (fingerprints, facial recognition, iris scans, voiceprints), personal data of children under 13 years of age, exact real-time geographical coordinates, religious and political beliefs, etc.
2.1.2 The personal data involved in this Privacy Policy includes the following (bolded terms involve highly sensitive data):
(1) Account Registration and Basic Data: email address, username/nickname, login password, verification code, security email, UID, avatar, country/region preference, bound mobile phone number, and optional third-party identity authentication data (such as Google account identifiers and other necessary federated authentication data);
(2) Payment Settlement and Subscription Data: subscription order records, purchased service tier (standard/professional, etc.), billing cycle (monthly/annual), payment channel (bank card payment, Alipay, cryptocurrency, etc.), masked bank card last four digits, encrypted billing token/transaction reference ID, and electronic invoices/payment vouchers (the Platform does not directly store complete bank card numbers or CVV codes, which are entirely tokenized by licensed third-party payment gateways);
(3) Marketing and Promotional Rights Data: when you participate in platform marketing activities, webpage pop-up lead generation, and claim discount vouchers, the contact phone number and name/company name you voluntarily submit, as well as voucher acquisition records, usage records, and promotion binding records;
(4) AI Agent and Smart Interactive Data: in specific platform features (such as AI Agent intelligent customer service system, human-agent collaboration, knowledge base Q&A), dialog text, Prompts, multimedia interactive audio/video, enterprise knowledge base documentation fragments, AI-generated answer contents, and system conversation interaction logs automatically processed by the system;
(5) Specific Product Configuration Data: such as custom domain configuration data: when you use platform sub-products that support custom domain features (such as the TWT Chat sub-product for binding customer service widgets or web pages), custom domain DNS resolution records (such as TXT records, _dnsauth verification values, CNAME routing values, etc.), third-party domain platform (such as Rayname, etc.) collaborative verification data, and automated system SSL/HTTPS certificate application and deployment status;
(6) Device and Environment Data: device type (mobile/PC/tablet), operating system and OS version, browser type and kernel version, screen resolution, language preference, time zone, referring URL, access date and time, mobile device manufacturer, and mobile network operator data;
(7) Log and Application Usage Data: access IP address, access port, login/logout/access/operation records, page routing path, feature usage frequency, crash logs, error dumps, system performance metrics, resource storage usage, console operations, and approximate geographic location derived from IP;
(8) Customer Support and Communication Data: communication records, consultation dialogs, feedback problem descriptions, screenshots, error logs, and verification vouchers generated when you contact us via email, online customer support, or ticketing system, as well as basic data needed to process your requests.
2.2 We Collect and Use Your Personal Data for the Following Purposes:
We collect your personal data primarily to enable you to use the Platform and related services smoothly and securely. You have the right to choose whether to authorize the collection and use of relevant data, but if you refuse to provide necessary data, you may not be able to use core business features and additional features provided by us. Among them, core features include basic functions provided by TWT to support software services, operational maintenance, and transactional security; additional features include extended services and enhanced security capabilities. If you refuse to provide data, we will not be able to provide core services, but your normal use of other basic features will not be affected.
2.2.1 Account Registration, Login, and Deletion
When you register a TWT account, you need to provide basic registration data, including email address, username, and login password. We verify your identity by sending an email verification code to your registered email to ensure the security and validity of the registration process. You may also choose to log in to the TWT Platform via supported third-party identity authentication services (such as Google account). In this process, the relevant third party will authenticate your identity, and with your authorization, share necessary personal data with us (such as email address, basic profile, third-party UID) for account binding and login.
To safeguard your personal data control rights, the Platform provides a convenient and transparent account deletion mechanism. You may submit an account deletion application at any time while logged in via "Account Settings" - "Account Info" - "Delete Account". The system will clearly prompt you on the impact of deletion (including irreversible effects on project assets, history sessions, configuration parameters, and auto-renewal subscriptions), and upon your confirmation, send a 6-digit security verification code to your bound security email. Deletion is executed after multi-factor verification. In addition, you may submit an manual account deletion application by sending an email from your bound email address to official customer service support@twt.com. Your bound email address serves as a critical credential for identity verification and account deletion, as well as an official communication channel for commercial notices and security warnings.
2.2.2 Payment Settlement, Order Processing, and Voucher Benefits
When you purchase platform paid services or products, you may select compliant third-party payment channels cooperating with us (such as bank card payment gateways, Alipay, cryptocurrency gateways, etc.) to complete payment settlement. Payment features may be hosted on encrypted third-party payment pages; we only transmit TWT-generated order numbers, purchased item details, transaction amounts, and currency types to such payment gateways to facilitate billing. With the exception of transaction reference numbers and legal transaction vouchers, we do not store your complete payment card number, CVV code, or sensitive financial authentication elements.
If you activate auto-renewal subscriptions, the system will securely store your authorized deduction token and execute fee deductions prior to the expiration of each billing cycle, sending renewal transaction notifications and electronic billing vouchers via email.
When you claim trial discount vouchers on promotional marketing pages by submitting a contact phone number, we will collect your mobile phone number and name/company name to accurately deliver voucher benefits, record voucher redemption status, and provide product selection consultation and follow-up support by our customer service team within your authorized scope.
2.2.3 AI Agent and Smart Interactive Services
The TWT Platform deeply integrates advanced AI Agent capabilities, such as smart customer service systems in Chat, providing users with intelligent customer support, knowledge base Q&A, workflow automation, and human-agent collaboration features. When you or your end users interact with the AI system, the system securely transmits dialog text Prompts, uploaded enterprise knowledge base document fragments, and session context to compliant large language model service providers (such as Alibaba Cloud Model Studio infrastructure) for real-time inference and generation.
We solemnly promise that, unless otherwise agreed in a separate written authorization agreement signed by both parties, we will never use your private business data, customer dialog records, knowledge base documents, or any user-identifiable data submitted during your use of AI Agent services to train public foundation models or third-party models.
2.2.4 Specific Product Custom Domain Services
To satisfy customized brand presentation needs in specific business scenarios, certain sub-products of the TWT Platform (such as the TWT Chat sub-product currently supporting this feature) provide custom domain binding services, allowing enterprise users to bind their own domains to dedicated customer service widget access points or chat web pages. When you use the custom domain feature of such sub-products, the system records your configured domain resolution records (such as chat domain target CNAME values and TXT verification records _dnsauth used to verify domain ownership).
If you choose to resolve through platform collaborative ecosystem providers (such as Rayname platform), the system coordinates DNS resolution settings; once DNS resolution becomes effective, collaborative edge nodes automatically sign and deploy free SSL/HTTPS certificates for your domain, ensuring end-to-end encrypted communication for sub-product access. Enabling or modifying custom domain settings will take effect within the corresponding sub-product and will not affect the infrastructure operation of other platform products.
2.2.5 Customer Support and Communication
We may contact you via internal website messages, emails, or registered phone numbers to provide you with critical notifications regarding products and services, such as system maintenance, service outage notices, bill receipts, and security alerts (such as abnormal login warnings or high-frequency access warnings). When you communicate with us (via customer service emails, online support chat, or tickets), we record your communication logs, problem screenshots, error data, and contact vouchers to resolve issues, optimize service quality, follow up on feedback, and maintain legal compliance archives when necessary.
2.2.6 Product Improvement and User Experience Optimization
To improve our products and services, we collect device and environment data, log and application usage data, etc., to analyze how you interact with the Platform, thereby enhancing service stability, UI performance, and troubleshooting system anomalies. We may also conduct aggregate usage statistics across de-identified or anonymized datasets to evaluate feature popularity and provide better user experience and functional recommendations.
2.2.7 Security Safeguards and Risk Management
To maintain the security of the Platform and its users, we use collected data to conduct risk control, security audits, and fraud prevention, such as detecting and blocking phishing attacks, malicious credential stuffing, DDoS attacks, illegal automated scraping, and account takeovers. We verify user identity during high-risk actions to safeguard transaction and operational security, and fulfill legal compliance audit obligations when required by applicable laws and regulations.
2.2.8 Other Uses Authorized by You
Beyond the above purposes, we may collect and use your personal data within the scope of your explicit additional authorization to provide you with specific extended services.
2.3 Exceptions to Obtaining Prior Authorized Consent for Data Collection and Use:
(1) Necessary for safeguarding national security, national defense, and public safety in Singapore or other applicable jurisdictions;
(2) Necessary for responding to judicial or administrative proceedings, or complying with statutory duties and legal obligations;
(3) Necessary for safeguarding public interests, public hygiene, emergency public health incidents, or academic research and news reporting;
(4) Necessary for protecting major vital interests (such as life, health, and property safety) of you or other individuals in emergencies where obtaining consent is impossible;
(5) Necessary for concluding or performing contracts entered into between you and us;
(6) Processing personal data disclosed publicly by yourself or other legally disclosed personal data within a reasonable scope in accordance with applicable laws;
(7) Other circumstances stipulated by applicable laws and regulations.
2.4 Method of Use
We collect and use your data solely to provide you with services and safeguard network security. To achieve these purposes, your data may be used for the purposes set forth herein. If we intend to use your data for purposes not stated in these Terms, or use data collected for a specific purpose for other purposes, we will notify you in a timely manner via pop-ups or messages within the application and obtain your express consent.
2.4.1 Safeguarding Account and Transaction Security
To prevent, detect, and investigate phishing, fraud, intellectual property infringement, network security threats, and illegal or unauthorized conduct that violates agreements, policies, or rules between you and us or our affiliates, and to safeguard the legitimate rights of users, the public, and us, we may use your account data, service usage data, device and log data, as well as data shared by our affiliates or partners with your authorization or in accordance with law, to comprehensively assess account and transaction risks, conduct identity verification, detect and prevent security incidents, and take necessary logging, audit, analysis, and disposal measures.
2.4.2 Third-Party Software Development Kits (SDKs) and Service Access
To ensure feature implementation and stable platform operation, we may integrate third-party Software Development Kits (SDKs), Application Programming Interfaces (APIs), or direct cloud services (including message push, network acceleration, cloud storage, AI model inference, payment gateways, etc.). Such third-party providers may collect device identifiers, network logs, and interaction signals necessary for technical implementation. We conduct strict security and compliance assessments on all integrated third-party providers, requiring them to maintain data protection standards comparable to the Singapore PDPA and subjecting their processing activities to supervision.
2.4.3 Device Permissions and Operational Instructions
To achieve platform features and provide services, we may request relevant operating system permissions, such as network access permissions, notification permissions, and multimedia storage read/write permissions. The types and purposes of permissions requested by the Platform may vary depending on product version and service features. We will inform you via system pop-ups or interface prompts when permissions are invoked. You have the right to grant or deny such permissions. If you deny permissions, you may be unable to use the corresponding features, but this will not affect your normal use of other basic features provided by the Platform.
III. How We Use Cookies and Similar Technologies
3.1 Use of Cookies
To ensure normal website operation, enhance network security, and optimize your service experience, we use Cookies and similar technologies (such as LocalStorage, Web Beacons, Pixel tags) on your computer or mobile device. Their primary purposes include: maintaining user login session state, security authentication verification, preventing Cross-Site Request Forgery (CSRF), recording UI display preferences, optimizing load balancing, and diagnostic performance analysis.
3.2 Cookie Classification and Technical Description
Cookies used on the Platform mainly fall into the following categories:
(1) Strictly Necessary Cookies: Indispensable for website operation and providing core services requested by you, such as maintaining security, identity verification, login session security tokens, and supporting distributed load balancing. If you block such Cookies, core platform functions will not operate normally;
(2) Performance & Analytics Cookies: Help us understand user access interactions (such as Google Analytics 4, Microsoft Clarity), counting visits, page dwell time, click paths, and aggregate heatmaps in a de-identified manner to identify system bottlenecks and improve product experience;
(3) Source & Attribution Cookies: Used to objectively record lawful promotional channels, referral codes, or ad campaign landing parameters to evaluate marketing reach and conversion efficacy.
3.3 Notice and User Management Methods
To fully respect your choices, for specific classification details, retention periods, and third-party lists regarding the Platform's use of Cookies, please refer to our independent Cookie Policy. The Platform currently does not deploy automated pop-up preference panels on site. You may manage, block, or clear Cookies and local storage data at any time through your browser or device settings (most browsers allow you to disable Cookies or clear site caches in settings).
Please note that if you choose to disable or clear all Cookies, you may be required to re-authenticate and log in each time you visit, and certain features or services that rely on Cookies may not function normally.
3.4 Web Beacons and Pixel Tags
We may embed links or tracking pixels in service notifications, billing emails, or marketing messages sent to you pointing to Platform content. When you click such links, we may record your click behavior and landing pages for service delivery confirmation, communication effectiveness assessment, and network security control.
3.5 Do Not Track Description
Unless we expressly inform you on relevant pages and obtain your explicit consent, we do not deploy third-party advertising tracking Cookies for cross-site behavioral profiling. If third-party advertising tracking is deployed in the future, we will provide clear prompts and express Opt-out options on relevant pages.
IV. How We Share, Transfer, and Publicly Disclose Your Personal Data
4.1 Sharing
4.1.1 We will not share your personal data with any company, organization, or individual other than TWT operators, except in the following circumstances:
(1) Sharing with Explicit Consent: With your explicit consent, we may share your user data with designated third parties;
(2) Sharing with Affiliates and/or Authorized Partners: We may entrust authorized partners to provide specific infrastructure and business support services. We may share certain user data with partners to provide better customer service and optimize user experience. We will only share user data for lawful, legitimate, necessary, specific, and explicit purposes, and will only share user data necessary to provide services. Our partners are not authorized to use shared user data for any other unrelated commercial purposes. You understand and agree that TWT may share necessary data with third-party service providers in the following areas:
a. Payment Settlement Service Providers: including bank card acquiring gateways, Alipay, cryptocurrency payment gateways, etc. We transmit order numbers, transaction amounts, and currency values to complete service subscription billing, deductions, and refund settlements;
b. Cloud Computing and Network Storage Providers: including Alibaba Cloud (ECS/OSS/SLB/ALB) and Cloudflare (R2 storage, CDN acceleration, WAF security protection, etc.), used to host system business servers, static multimedia files, network load balancing, and anti-DDoS security defense;
c. AI Foundation Model Service Providers: including Alibaba Cloud Model Studio foundation model platform and related AI infrastructure. When users invoke AI features, dialog prompts, uploaded texts, and multimedia contents are transmitted securely for real-time AI inference;
d. Domain Name and DNS Resolution Collaborative Providers: such as Rayname platform, GNAME, etc. When enterprise users use specific sub-products (such as TWT Chat) to configure custom domains, TXT records and CNAME resolution verification are performed collaboratively to verify domain ownership and routing;
e. Message Push and Communication Distribution Providers: such as EngageLab AppPush, etc., used to distribute business notifications, system alerts, and real-time messages to client devices;
f. Security Risk Control and Bot Verification Providers: such as Geetest Captcha 2.0. Behavioral interaction signals are collected during user registration, login, password retrieval, and high-risk operations to defend against automated brute-force attacks and bot abuse;
g. Legal Compliance and Rights Protection Agencies: to comply with applicable laws and regulations, execute agreement terms, prevent significant financial fraud, and handle disputes, necessary vouchers may be shared with judicial bodies, regulatory authorities, or professional legal and accounting institutions. Data is never sold or shared for commercial purposes violating our policies.
4.1.2 For companies, organizations, and individuals with whom we share user data, we will take reasonable measures to ensure that recipients provide data protection standards comparable to the PDPA, and execute strict confidentiality agreements and Data Processing Agreements (DPAs) with them, clarifying data processing boundaries and security obligations, requiring them to process user data strictly in accordance with our instructions, this Privacy Policy, and any other relevant confidentiality and security measures.
4.2 Transfer
We will not transfer your personal data to any company, organization, or individual, except in the following circumstances:
(1) Transfer with Explicit Consent: With your explicit consent, we may transfer your user data to designated third parties;
(2) In the event of a merger, acquisition, asset transfer, or bankruptcy liquidation involving TWT operators, if the transfer of user data is involved, we will require the new company or organization holding your user data to continue to be bound by these Terms; otherwise, we will require such company or organization to re-obtain your authorized consent.
4.3 Public Disclosure
We will publicly disclose your personal data only under the following circumstances:
(1) With your explicit consent or based on your voluntary choice, we may publicly disclose your user data;
(2) Mandatory disclosure under legal regulations or requests by law enforcement and judicial authorities: In accordance with statutory requirements, mandatory law enforcement, or judicial procedures, we may publicly disclose your personal data based on the requested data types and disclosure methods. Subject to legal compliance, when we receive requests for disclosure of your data, we will require corresponding legal documentation, such as court subpoenas or investigative orders. We adhere strictly to transparency within statutory boundaries, thoroughly reviewing each request to ensure lawful authority and that data is limited to what law enforcement has legitimate authority to obtain for specific statutory purposes.
4.4 Exceptions to Obtaining Prior Authorized Consent for Sharing, Transfer, and Public Disclosure:
In the following circumstances, sharing, transferring, and publicly disclosing your personal data does not require your prior authorized consent:
(1) Necessary for safeguarding national security, national defense, and public safety in Singapore or other applicable jurisdictions;
(2) Necessary for responding to judicial or administrative proceedings, or complying with statutory duties and legal obligations;
(3) Necessary for safeguarding public interests, public hygiene, emergency public health incidents, or academic research and news reporting;
(4) Necessary for protecting major vital interests (such as life, health, and property safety) of you or other individuals in emergencies where obtaining consent is impossible;
(5) Necessary for concluding or performing contracts entered into between you and us;
(6) Processing personal data disclosed publicly by yourself or other legally disclosed personal data within a reasonable scope in accordance with applicable laws;
(7) Other circumstances stipulated by applicable laws and regulations.
In accordance with legal provisions, sharing and transferring personal data that has undergone de-identification processing, ensuring that the data recipient cannot restore and re-identify the personal data subject, does not constitute external sharing, transfer, or public disclosure of personal data, and the preservation and processing of such data does not require separate notification to you or your consent.
V. How You Delete and View Data and Delete Your Account
In accordance with relevant laws, regulations, and standards in Singapore and your country/region, you have the right to access, view, correct, delete, and withdraw consent regarding your personal data. We will process and respond to your requests within 15 business days upon receiving your request and verifying your identity.
5.1 Deletion and Correction of Personal Data
In the following circumstances, you may request us to delete your personal data:
(1) Our processing of personal data violates legal regulations;
(2) We collect and use your personal data without obtaining your authorized consent;
(3) Our processing of personal data constitutes a serious breach of agreement with you;
(4) You have lawfully deleted your TWT Platform account and our service relationship has terminated.
If we decide to grant your deletion request, we will also notify entities that obtained your personal data from us to delete it in a timely manner, unless otherwise provided by laws or regulations.
5.2 Exercise of Account Deletion and Related Rights
Account deletion is a primary way to exercise control over personal data processing rights and right to erasure. To facilitate the convenient exercise of your rights, the Platform provides automated self-service and manual customer support channels:
(1) Self-Service Deletion: You may log in to the TWT console at any time, navigate to "Account Settings" - "Account Info" - "Delete Account", and submit an application. To prevent unauthorized deletion by malicious actors, the system enforces multi-factor security verification: verifying current login status and sending a 6-digit dynamic verification code to your bound security email. After you confirm and pass verification, account deletion takes effect immediately.
(2) Manual Assistance Channel: If you are unable to log in due to lost devices or special issues, you may submit a request by sending an email from your bound email address to customer service support@twt.com. We will complete verification and assist in deletion within 15 business days after verifying your identity.
5.3 Legal Consequences and Data Processing Post-Deletion
(1) Complete Deletion of Operational Data: Once account deletion takes effect, we will immediately terminate all daily business features of such account. Unless otherwise provided by mandatory laws, all personal data, historical session records, customer visitor lists, uploaded multimedia files, AI Agent custom prompt words, knowledge base fragments, API keys, and communication credentials under the account will be permanently deleted and cannot be recovered;
(2) Statutory Retention and Security Isolation: In accordance with the Singapore Companies Act, Goods and Services Tax (GST) Act, Anti-Money Laundering/Countering the Financing of Terrorism regulations, and cybersecurity compliance requirements, we may be required to archive historical transaction records, billing statements, tax invoices, and necessary system security audit logs generated prior to account deletion for a statutory retention period (typically 5 years following transaction completion). Such retained data is strictly physically/logically isolated, encrypted, and sealed, accessible only to respond to regulatory tax audits, judicial investigations, or dispute defense, and will never be used for daily commercial operations. Upon expiration of the retention period, the system will irreversibly delete such data;
(3) Contractual and Commercial Effects: Legal consequences of account deletion regarding unexpired service periods, fee settlements, automatic subscription termination, and forfeiture of voucher benefits shall be governed strictly by Sections 2.4 and 2.5 of the Platform's Terms of Service. You are advised to download and back up all necessary data prior to deletion.
VI. How We Store and Protect Your Personal Data
6.1 Storage and Retention Period of Personal Data
We retain your personal data only for the period necessary to achieve the purposes stated in this Privacy Policy, unless an extended retention period is required or permitted by law. If the Platform ceases operations, we will promptly cease activities collecting your personal data, notify you in advance via announcements or notifications in accordance with applicable laws, and delete or anonymize your personal data held by us, except for transaction logs required by law to be retained for statutory periods. Upon expiration of the retention period, we will promptly execute irreversible physical destruction or logical anonymization.
6.2 Data Security Protection Measures
We attach utmost importance to personal data security, maintaining dedicated cybersecurity and compliance teams and adopting industry-standard security measures to safeguard your personal data:
6.2.1 Technical Security Measures: Employing Transport Layer Security protocols (TLS 1.2/1.3) for high-strength end-to-end transport encryption; implementing AES-256 high-standard encryption algorithms for databases and object storage at rest; hashing passwords and authentication tokens with salted algorithms; deploying network micro-segmentation, Web Application Firewalls (WAF), and DDoS protection in cloud environments;
6.2.2 Organizational and Administrative Measures: Establishing strict Role-Based Access Control (RBAC) adhering to the principle of least privilege; executing confidentiality agreements with all personnel accessing personal data; conducting regular data security compliance audits; holding employee security awareness training;
6.2.3 Security Reminders: The internet is not an absolutely secure environment. Emails and instant messaging are not encrypted by default end-to-end. We strongly urge you to use complex passwords, properly safeguard API credentials, and enable Two-Factor Authentication (2FA).
6.3 Cross-Border Transfer Protection of Personal Data
To provide highly available, low-latency distributed cloud services to global users, our core server infrastructure is located in Singapore, while certain technical support, edge computing acceleration, and cloud infrastructure partners (such as Cloudflare's global edge nodes) are distributed outside Singapore. Consequently, under certain scenarios, your personal data may undergo cross-border transfer.
We strictly adhere to the Transfer Limitation Obligation under Singapore PDPA. When transferring personal data outside Singapore, we ensure that overseas recipients provide a standard of protection comparable to Singapore PDPA. To this end, we execute legally binding Data Processing Agreements (DPAs) or adopt ASEAN Model Contractual Clauses (ASEAN MCCs) and standard contractual clauses with data recipients, clearly delineating security responsibilities to ensure that data transferred across borders receives equal and continuous legal protection.
6.4 Security Incident Response and Legal Notification
6.4.1 In the unfortunate event of a personal data security incident, we will immediately activate contingency plans in accordance with statutory requirements, organize professional teams to investigate and remediate, control risks, and notify the Singapore Personal Data Protection Commission (PDPC) and affected users within statutory time limits (no later than 72 hours after confirming a notifiable data breach under Singapore PDPA). Notifications may be delivered via announcements, emails, or on-site messages, covering basic circumstances, data types involved, remediation measures taken, and risk mitigation advice.
6.4.2 If you discover that your personal data has been leaked, or your account credentials have been compromised, please contact us immediately via support@twt.com or legal@twt.com so that we can promptly take containment and emergency protection measures.
VII. How We Handle Personal Data of Minors
7.1 We attach great importance to the protection of minors' personal data. You understand and acknowledge that the Platform is an enterprise-oriented digital collaboration SaaS software system and does not target minors under the age of eighteen (18) to provide products, websites, or services. We do not intentionally collect personal data from minors. In enterprise registration and business billing processes, we verify user qualifications through enterprise domain verification and corporate payment methods.
7.2 If we discover and verify that a user is a minor under the age of eighteen (18), we will immediately cease providing platform services to such user and delete collected identifiable personal data within a reasonable timeframe (except as otherwise required by law).
7.3 Before you start using this product, website, and service, you shall ensure that you have full civil capacity under the laws of Singapore and your country of residence. If you lack full civil capacity, you and your guardian shall bear all legal liabilities arising therefrom.
VIII. Special Important Notice - Please Read Carefully
8.1 You shall carefully read and fully understand all contents of this Privacy Policy, especially the bolded terms regarding authorizations and liabilities. By logging in to or using the Services, you shall be deemed to have fully agreed to all terms hereof, authorizing us to collect, use, store, and disclose your personal data in accordance with these Terms. If you do not agree to any term hereof, you shall immediately cease logging in to or using the Services.
8.2 This Privacy Policy constitutes a legally binding agreement between you and us. You shall agree to this Privacy Policy at the same time as accepting the Terms of Service to use our services.
8.3 Please understand that the internet is not an absolutely secure environment. Communications via email, instant messaging, social platforms, and other third-party software cannot be fully guaranteed to be encrypted end-to-end. Please exercise caution when sharing sensitive personal data.
8.4 Please understand that with the rapid advancement of technology and the internet industry, malicious attack methods and hacking technologies continuously evolve. Although we take high-standard security measures to safeguard your personal data, we cannot guarantee absolute data security against unpredictable security risks.
8.5 Please understand that we cannot control the hardware, operating systems, and network communication channels you use when accessing our services. Please ensure your personal data security independently. We specifically remind you: to safeguard your account security, do not disclose your financial status, banking passwords, or personal identity credentials over unverified public networks or to unverified third parties.
IX. Notifications and Revisions
To provide you with better services and accommodate our business development, this Privacy Policy may be updated accordingly. Without your explicit consent, we will not diminish your rights under this Privacy Policy. For major changes, we will provide prominent notices (such as website banners, console pop-ups, internal system messages, or email notifications sent to your registered security email). You may also check our website periodically for the latest version. Your continued use of the Platform after revisions take effect shall constitute your acceptance of the revised Privacy Policy. Major changes referred to herein include, but are not limited to:
(1) Material changes to our service models, such as processing purposes, types of personal data processed, and data usage methods;
(2) Material changes in ownership structure or organizational structure, such as business restructuring, bankruptcy, or mergers;
(3) Material changes to main entities of data sharing, transfer, or public disclosure;
(4) Material changes to your rights regarding personal data processing and their exercise methods;
(5) Changes to our responsible department, contact channels, or complaint mechanisms for personal data security;
(6) High risks indicated in personal data security impact assessment reports.
X. Contact Us
To strictly implement the legal compliance requirements of the Singapore Personal Data Protection Act 2012 (PDPA) regarding Data Protection Officers (DPOs), TWT has designated a professional data protection and legal compliance team. If you have any questions, comments, or suggestions regarding this Privacy Policy or your personal data processing activities, or wish to exercise your rights of access, correction, deletion, or withdrawal of consent, you may contact us via the following official channels:
Platform Operating Entity: HIGHSOON PTE. LTD.
Registered Address: 8 Temasek Boulevard #21-03, Suntec Tower 3, Singapore 038988
Official Customer Support Email: support@twt.com
Data Protection Officer (DPO) Email: legal@twt.com
We will review your request upon receipt, verify your user identity, and provide a formal reply or explanation within fifteen (15) business days. If your request involves complex issues requiring extended review time, we will notify you in advance of the reasons and estimated completion time.