1. Introduction
Twist Labs SARL ("we", "us", "our"), operating the Squizz the Lemon platform at squizzthelemon.com, is committed to protecting your personal data. This Privacy Policy describes how we collect, use, share, and protect information when you use the Service.
This Policy complies with Moroccan Law No. 09-08 of 18 February 2009 on the Protection of Individuals with Regard to the Processing of Personal Data. For users located in the European Economic Area, we additionally take applicable GDPR requirements into account. For California residents, applicable CCPA rights are described in Section 13.
2. Data We Collect
2.1 Information You Provide
- Account data: name, email address, job title, company name, number of employees, website, field
- Billing data: billing address (payment card details are processed by our payment provider — we do not store card numbers)
- Brand and business data: company description, brand voice, target audience, marketing objectives, and uploaded assets
- User Content: text, images, or other materials you input into the Service
- Communications: messages to our support or sales team
2.2 Automatically Collected Data
- Usage data: pages visited, features used, clicks, session duration
- Technical data: IP address, browser type, operating system, device identifiers
- Log data: error logs, API activity, timestamps
- Cookies and similar tracking technologies (see Section 8)
2.3 Data from Third-Party Integrations
When you connect third-party accounts (Meta, Instagram, LinkedIn, TikTok, Google Analytics, and others), we receive data from those platforms as authorized by you. Such data is used solely to provide the functionality you requested and is subject to the restrictions in Section 5.
3. How We Use Your Data
- To provide, operate, and improve the Service, including generating marketing strategies, content and campaigns
- To process payments and manage your subscription
- To send account notifications and respond to support requests
- To detect and prevent fraud, abuse, and security incidents
- To analyze usage and improve the Service's performance and features
- To comply with our legal obligations under applicable law
- To send marketing communications, where you have given consent
4. AI Processing
The Service uses large language models (LLMs) and AI systems to generate marketing content, campaigns and recommendations. Regarding the use of your data in AI processing:
- Twist Labs SARL will not use, nor authorize any third-party provider to use, your User Content or data obtained via third-party API integrations to train, retrain, fine-tune, or otherwise improve any third-party AI models
- Twist Labs SARL may use aggregated, de-identified, non-reversible data to improve its own Service features, solely to provide better personalized functionality to its users
- We select AI providers whose published terms, at the time of their selection, indicate that they do not use customer data for general model training purposes. Third-party providers' terms may evolve and are beyond our contractual control.
5. Third-Party API Data
Data obtained via third-party APIs (Meta, Instagram, Facebook, LinkedIn, TikTok, Google, and equivalents) is subject to the following restrictions:
- Used solely to provide the specific functionality requested by the authorized user
- Not used for advertising or third-party profiling purposes
- Not used to train or improve any AI or ML model
- Any analytics performed on such data does not identify individual users
- Retained only for as long as necessary to fulfil the authorized purpose
5.1 Google API
Our use and transfer of information from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements. Users may revoke Google API access at any time through their Google Account settings.
6. Data Sharing
We do not sell or rent personal data. We may share data only as follows:
- Service providers: hosting, payment processing, analytics, email delivery, and AI model providers, acting under our instructions and bound by appropriate data protection agreements
- Third-party integrations: platforms you choose to connect, as authorized by you
- Professional advisors: legal and security advisors under confidentiality obligations
- Regulatory or judicial authorities: where required by applicable law or a valid legal order
- Business transfers: in the event of a merger, acquisition, or sale of assets, with prior notification to you
7. International Data Transfers
Your data may be processed outside Morocco. We ensure that appropriate safeguards are in place for such transfers, including contractual protections consistent with Moroccan Law 09-08. For EEA users, we rely on Standard Contractual Clauses where applicable.
8. Cookies
- Strictly necessary: required for Service operation — no consent required
- Functional: remember your preferences — no consent required
- Analytics: understand usage patterns — consent required
- Marketing: deliver relevant advertising — consent required
You can manage cookie preferences through our cookie banner or your browser settings. Declining non-essential cookies does not prevent use of the core Service.
9. Data Retention
We retain personal data for as long as necessary to provide the Service and meet our legal obligations. General retention periods are as follows:
| Data Category | Includes | Retention |
|---|---|---|
| Account data | Name, email, preferences | Up to 5 years after account closure |
| User Content & Generated Content | Brand data, uploaded assets, AI outputs | Up to 90 days after account closure |
| Third-party API data | Meta, Instagram, LinkedIn, Google data | Up to 90 days after disconnection |
| Usage & log data | Session data, IP, activity logs | Up to 12 months |
| Billing records | Invoices, transaction history | Up to 10 years (Moroccan law) |
| Support communications | Emails to our team | Up to 3 years from last contact |
Encrypted backups may retain data for a limited additional period during rotation cycles. Such data is not used for any active processing.
10. Data Security
We implement and maintain appropriate administrative, physical, and technical safeguards to protect personal data against unauthorized access, disclosure, alteration, and destruction. No method of transmission over the internet is completely secure, and we cannot guarantee absolute security.
In the event of a personal data breach, we will notify affected users and relevant supervisory authorities as required by applicable law.
11. Your Rights
Under Moroccan Law 09-08 and, where applicable, GDPR, you have the right to:
- Access: obtain a copy of your personal data
- Rectification: correct inaccurate or incomplete data
- Erasure: request deletion of your data (see our Data Deletion Policy at squizzthelemon.com/data-deletion)
- Restriction: limit how we process your data in certain circumstances
- Object: object to processing based on legitimate interest
- Data portability (EEA users): receive your data in a structured, machine-readable format
- Withdraw consent: where processing is based on consent, withdraw at any time
Submit requests to legal@squizzthelemon.com. We will respond within a reasonable timeframe and in any case within the period required by applicable law. Identity verification may be required.
Moroccan users may contact the CNDP at cndp.ma. EEA users may lodge a complaint with their local Data Protection Authority.
12. Children's Privacy
The Service is not directed at individuals under 18. We do not knowingly collect data from minors. Contact legal@squizzthelemon.com if you believe a minor's data has been collected.
13. California Residents — CCPA
If you are a California resident, you may have rights under the California Consumer Privacy Act (CCPA), including the right to know what personal information we collect, the right to request deletion, and the right to opt out of the sale of personal information. We do not sell personal information. To exercise your CCPA rights, contact legal@squizzthelemon.com.
14. Changes to This Policy
We may update this Privacy Policy from time to time. We will provide notice of material changes. Continued use of the Service after the effective date constitutes acceptance.
15. Contact
Twist Labs SARL
ICE: 003933917000017 | Address: Angle Rue Mozart et Bd d'Anfa, Résidence le Petit Paradis – 7ème étage, Casablanca, Maroc
Email: legal@squizzthelemon.com | Website: https://squizzthelemon.com
Morocco: CNDP — cndp.ma | EU: your local Data Protection Authority