Privacy Policy

1. Introduction

TwoSuns (operated by AEPG Inc., "we", "us", or "our") is committed to protecting the privacy and security of all personal and organisational data entrusted to us. This Privacy Policy explains what information we collect, why we collect it, how we use it, and the rights available to you under applicable privacy legislation including Canada's Personal Information Protection and Electronic Documents Act (PIPEDA) and the European Union's General Data Protection Regulation (GDPR).

By accessing or using the TwoSuns platform, website, or any related services ("Services"), you agree to the practices described in this Policy. If you do not agree, please discontinue use of the Services and contact us to have your data removed.

2. Data We Collect

We collect only the data necessary to deliver and improve the TwoSuns Services. This includes:

2.1 Account and Identity Information

• Full name, work email address, job title, and organisation name provided during registration or discovery calls
• Enterprise licence credentials including authorised user accounts managed by your organisation's administrator
• Billing and invoice contact details for enterprise subscription management

2.2 Platform Usage Data

• Log data including IP address, browser type, operating system, referring URLs, and pages visited
• Session duration, feature interaction patterns, and navigation flows used to improve the platform experience
• Error logs and diagnostic data used to identify and resolve technical issues

2.3 Market Data Queries

• Queries submitted to TwoSuns's AI intelligence capabilities, including commodity, energy, and financial market search inputs
• Saved reports, watchlists, and dashboard configurations associated with your account
• Export and download activity of market intelligence outputs

2.4 Communications

• Email correspondence, support requests, demo booking information, and newsletter subscriptions
• Feedback and survey responses submitted voluntarily through the platform or our website

3. How We Use Your Data

We process personal data only for legitimate, disclosed purposes:

• Service delivery: Provisioning and maintaining your platform access, processing queries, and delivering AI-generated intelligence outputs
• Account management: Managing enterprise licences, authorised user roles, billing, and subscription renewals
• Platform improvement: Aggregated, anonymised analytics are used to improve platform performance, refine AI models, and develop new features
• AI training opt-out: We do not use your individual query data or proprietary organisational inputs to train our AI models without explicit written consent. You may request confirmation of this at any time by contacting privacy@twosuns.ai
• Communications: Sending service notifications, security alerts, product updates, and where you have subscribed our market intelligence newsletter
• Legal and compliance: Maintaining audit records, responding to lawful requests, and meeting our obligations under applicable law
• Security: Detecting and preventing fraud, unauthorised access, and abuse of the platform

4. Data Sharing and Disclosure

We do not sell your personal data. We do not share your data with third parties for advertising purposes. Data may be disclosed only in the following circumstances:

4.1 Trusted Processors

We engage a limited number of sub-processors to operate our infrastructure and deliver Services. These include cloud hosting providers (AWS), analytics tools, and payment processors. All sub-processors are contractually bound to process data only on our instructions and to maintain appropriate security standards.

4.2 Legal Requirements

We may disclose personal data where required by law, court order, or regulatory authority, including to respond to lawful requests from Canadian or international authorities. We will notify you where legally permitted to do so.

4.3 Business Transfers

In the event of a merger, acquisition, or asset sale, personal data may be transferred to the succeeding entity. You will be notified of any such transfer and your rights thereunder.

4.4 With Your Consent

We may share data with third parties for other purposes only with your explicit prior consent.

5. Data Retention

We retain personal data for as long as necessary to fulfil the purposes described in this Policy, subject to the following standards:

• Active accounts: Data is retained for the duration of your enterprise licence agreement plus a reasonable post-termination period for billing reconciliation and dispute resolution
• TwoSuns Core: Audit records and orchestration logs are retained for a minimum of 7 years in compliance with our TwoSuns Core archival standards, regulatory audit requirements, and enterprise risk governance obligations
• Marketing communications: Retained until you unsubscribe or request deletion, whichever is earlier
• Security and fraud logs: Retained for up to 24 months from the date of collection
• Anonymised aggregates: May be retained indefinitely for platform analytics and AI model quality assurance

Upon expiry of the applicable retention period, data is securely deleted or anonymised in accordance with our data lifecycle policy.

6. Your Privacy Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

6.1 Under GDPR (EEA residents)

• Right of access: Request a copy of all personal data we hold about you
• Right to rectification: Request correction of inaccurate or incomplete personal data
• Right to erasure: Request deletion of your personal data where we have no lawful basis to retain it
• Right to restriction: Request that we limit processing of your data in certain circumstances
• Right to data portability: Receive your data in a structured, machine-readable format
• Right to object: Object to processing based on legitimate interests or direct marketing
• Rights related to automated decision-making: Request human review of any automated decisions that significantly affect you

6.2 Under PIPEDA (Canadian residents)

• Right of access: Request access to your personal information and be informed of how it is used and disclosed
• Right to correction: Request amendment of inaccurate or incomplete personal information
• Right to withdraw consent: Withdraw consent to processing where consent is the lawful basis, subject to legal or contractual limitations

To exercise any of these rights, submit a written request to privacy@twosuns.ai. We will respond within 30 days. Identity verification may be required before processing your request.

7. Security Measures

TwoSuns implements enterprise-grade technical and organisational security controls to protect your data:

• TLS 1.2+ encryption for all data in transit; AWS KMS encryption for all data at rest
• Schema-per-tenant PostgreSQL isolation ensuring structural separation of client data
• OIDC authentication and JWT-based authorisation with enterprise Identity Provider (IdP) integration
• Role-based access controls (RBAC) enforced at the application and infrastructure layers
• Immutable event-level audit logging with WORM (Write Once, Read Many) storage compliance
• Regular vulnerability assessments and penetration testing by qualified third-party security auditors
• Incident response procedures with notification protocols compliant with PIPEDA Breach of Security Safeguards Regulations and GDPR Article 33

8. International Data Transfers

TwoSuns is headquartered in British Columbia, Canada. If you access our Services from the European Economic Area or other jurisdictions with data transfer restrictions, your personal data may be transferred to and processed in Canada, which the European Commission has recognised as providing adequate data protection.

Where transfers occur to jurisdictions without an adequacy decision, we implement appropriate safeguards including Standard Contractual Clauses (SCCs) or binding corporate rules as applicable.

9. Cookies and Tracking Technologies

We use cookies and similar tracking technologies to operate and improve our Services. For a full description of the cookies we use and how to manage your preferences, please see our Cookie Policy.

10. Children's Privacy

The TwoSuns platform is an enterprise B2B service intended exclusively for use by professionals. We do not knowingly collect personal data from individuals under the age of 18. If you believe a minor has provided us with personal data, please contact us immediately at privacy@twosuns.ai.

11. Changes to This Policy

We may update this Privacy Policy periodically to reflect changes in our practices, legal requirements, or Services. When we make material changes, we will notify you by email (to the address associated with your account) and by posting the updated Policy on this page with a revised "Last Updated" date. Continued use of the Services after the effective date constitutes acceptance of the updated Policy.