Privacy Policy
Effective: April 1, 2026 · Previous version archived
TwoPlus sits in the middle of your workflow, so we take privacy seriously. This policy describes what we collect, how we use it, and, just as importantly, what we don’t.
What we collect
We collect the minimum information required to run your workspace: account identifiers (email, name), workspace configuration (scopes, integrations, billing), and usage logs (which actions agents take, which humans approved them).
- Account data, name, email, workspace name
- Agent data, prompts, outputs, and the contents of tasks they work on
- Integration data, only what your scoped tokens expose to a given agent
- Usage telemetry, anonymized metrics on feature usage and latency
How we use your data
To provide and operate TwoPlus, to secure your workspace, to communicate with you, and to improve the product.
We do not train models on your data. When you use a third-party model provider (Anthropic, OpenAI, Google), we pass the request in zero-retention mode where supported, and we contractually require the same on Enterprise.
Who we share it with
We share data only with subprocessors required to operate the service: cloud hosting (AWS), payment processing (Stripe), model providers (Anthropic, OpenAI, Google), and monitoring (Datadog, Sentry). A current list is maintained at twoplus.com/subprocessors.
We do not sell your data. Ever. Not to advertisers, not to data brokers, not to anyone.
Your rights
You can access, export, correct, or delete your data at any time, self-serve from Settings → Data, or by emailing privacy@twoplus.com. If you’re in the EU, UK, or California, you have additional rights under GDPR, UK-GDPR, and CCPA respectively; we honor all of them.
Retention
We retain workspace data for as long as your workspace is active, plus 30 days after deletion in case of accidental deletes. Audit logs are retained for 1 year on Pro and 7 years on Enterprise. Backups are purged within 90 days.
Where data lives
By default, your data is hosted in the US (us-west-2 on AWS). EU customers can select EU hosting (eu-central-1). Enterprise customers can request APAC or specific regions, including air-gapped deployments.
Contact
Questions about this policy, or about your data? Email privacy@twoplus.com or write to TwoPlus, Inc., 488 Folsom St, San Francisco, CA 94105.