Privacy Policy

This policy explains what personal data TwelveAI collects when you use Checked, why, and the choices you have. TwelveAI is the data controller. We process personal data in line with the Nigeria Data Protection Act 2023 and, where it applies to you, the GDPR.

What we collect

• Account data: your name, email address, password (stored only as a secure hash), and when you accepted these policies.
• Workspace content: projects, API specs, test cases, environment settings and credentials (stored encrypted), runs, results, screenshots and reports.
• Usage and security data: sign-ins, actions and pages you use in the app, IP address and browser type. We use this to secure accounts (for example sign-in alerts and blocking password guessing), support you and improve Checked.
• Billing data: your plan, payments and the last four digits and brand of your card. Full card details are handled by TwelveAI's payment service, not stored by Checked.
• Messages: what you send through the support form and the emails we exchange.

Why we use it

To provide the service you signed up for (our contract with you), to keep it secure and prevent abuse (our legitimate interest), to bill you, to send account and run emails you can control in Email settings, and to meet legal obligations. We do not sell personal data and do not use your content to train AI models.

Who we share it with

Only service providers that help us run Checked, under contracts that protect your data: our hosting provider (servers and backups), OpenAI (to generate tests, explore apps and write reports; it receives the parts of your content needed for each request), Google (to deliver our emails) and TwelveAI's payment service. We may disclose data if the law requires it. Some providers process data outside Nigeria; where they do, we rely on safeguards the law recognises.

How long we keep it

Account data is kept while your account is open. Run history is kept for as long as your plan shows it, and may be deleted after that. Activity and security logs are kept for up to 12 months. Backups are kept for 14 days. When you close your account we delete or anonymise your data within 30 days, except what we must keep for legal or accounting reasons.

Your rights

You can ask to access, correct, export or delete your personal data, object to or restrict some processing, and withdraw consent where we rely on it. You can also complain to the Nigeria Data Protection Commission. To use any of these rights, contact support; we answer within 30 days.

Security

We protect data with encryption in transit, encrypted storage for credentials, hashed passwords, limits on repeated sign-in attempts, access controls and daily backups. No system is perfectly secure; if a breach affects you, we will tell you and the regulator as the law requires.

Cookies

Checked keeps you signed in with a token stored in your browser and remembers preferences such as the theme. We do not use advertising cookies.

Changes

If we change this policy in a way that matters, we will tell you by email or in the app before the change takes effect.