1. Introduction
This Privacy Policy explains how 2Suns Pty Ltd (ABN 30 653 525 305), trading as "twocms" ("we," "our," or "Company"), collects, uses, shares, and protects personal information obtained from users ("you" or "user") of the twocms website and services.
We are committed to protecting your privacy and ensuring the security of your personal information. This Privacy Policy is designed to help you understand what information we collect, why we collect it, and how you can update, manage, and delete your information.
2. Information we collect
2.1 Personal information
We may collect the following types of personal information:
- Account Information: Name, email address, company name, job title, phone number, and billing address.
- Payment Information: Credit card details, banking information, and billing history. Note that payment processing is handled by our payment processor Stripe, and we do not store complete credit card information on our servers.
- Communication Data: Information you provide when contacting our support team, participating in surveys, or responding to communications from us.
- Content: Any information or content you upload to your website through our services.
- Technical Information: IP address, browser type and version, time zone setting, browser plug-in types and versions, operating system, and platform.
- Usage Data: Information about how you use our website and services, including page views, clicks, and feature usage.
2.2 Automatically collected information
We automatically collect certain information when you visit our website or use our services:
- Cookies and Similar Technologies: We use cookies, web beacons, and similar technologies to enhance your experience, gather information about users and visits to our websites, and improve our services. See our Cookie Policy section for more details.
- Log Files: We collect information that your browser sends whenever you visit our website or when you access our services by or through any device.
- Analytics Data: We use third-party analytics services to help analyze how users use our website and services.
3. How we use your information
We use the information we collect for various purposes, including:
- Providing, maintaining, and improving our services
- Processing transactions and sending related information, including confirmations and invoices
- Sending administrative messages, such as updates, security alerts, and support messages
- Responding to your comments, questions, and requests
- Providing customer service and technical support
- Monitoring and analyzing trends, usage, and activities in connection with our services
- Detecting, preventing, and addressing fraud, security, or technical issues
- Complying with legal obligations and protecting our rights
- Communicating with you about products, services, offers, promotions, and events, and providing other news or information about us and our partners
- Personalizing your experience on our platform
4. Legal basis for processing (for EEA users)
If you are located in the European Economic Area (EEA), we collect and process your personal information on the following legal bases:
- Performance of a Contract: Processing is necessary to provide the services you have requested or to take steps at your request before entering into a contract.
- Legitimate Interests: Processing is necessary for our legitimate interests, such as improving our services, preventing fraud, and ensuring the security of our platform.
- Consent: We process certain data based on your consent, which you can withdraw at any time.
- Legal Obligation: Processing is necessary to comply with our legal obligations.
5. Google user data
With your permission, twocms can connect to your Google Search Console and Google Business Profile accounts using Google's sign-in (OAuth). This section explains what Google user data we access, and how we use, store, share and delete it. Where it differs from the rest of this policy, this section applies to Google user data.
5.1 What we access
- Google Search Console: the websites (properties) you have access to, their search performance (search queries, pages, clicks, impressions, click-through rate and average position), indexing and URL inspection results, and sitemaps.
- Google Business Profile: the business locations you manage and their details (name, address, phone number, opening hours, categories, description, website link and photos), your reviews and our replies, your posts, and performance data such as searches, views, calls and requests for directions.
- Your Google account email address, so we can show which Google account is connected.
Google shows you the permissions we request before you agree to connect. We only request the permissions these features need. We don't access Gmail, Google Drive, your contacts or any other Google service.
5.2 How we use it
We use Google user data only to provide the features you use in twocms:
- Reporting how your website and Business Profile are performing, for example in your group chat
- Suggesting improvements, such as pages to write, search terms to target, or profile details to update
- Making changes you have approved, such as submitting a sitemap, updating your opening hours, publishing a post or replying to a review
We don't use Google user data for advertising, we don't sell it, and we don't use it to decide whether you're creditworthy or for lending.
5.3 AI agent workflows
Each twocms customer has an AI agent that works on their website and marketing. When you ask for something that needs your Google data, or when the agent prepares a report or a suggestion for you, it retrieves only the data that task needs and sends it to an AI model to analyse it and draft the result. The agent only works on your business, and your data is never used in work for another customer.
We use AI model providers, reached through OpenRouter, to run the agent. We only use providers that don't train their models on the data we send and don't keep it after processing the request. We don't use Google user data to develop, improve or train generalised AI or machine learning models, including our own.
The agent never changes your Google Business Profile or Search Console on its own. It proposes the change in your group chat, and only makes it after someone from your business approves it.
5.4 How we store it
We store the access tokens Google gives us encrypted on our servers. We fetch Google data when a task needs it rather than copying your whole account. Results the agent produces from it, such as reports and suggestions, are stored with your business's other twocms data. Records of the agent's work, which can include Google data it retrieved, are kept for up to 30 days so we can fix problems, then deleted. All Google user data is encrypted in transit and at rest.
5.5 How we share it
We share Google user data only:
- With the service providers that process it for us to provide the features above: our hosting providers and the AI model providers described in section 5.3
- If the law requires it
- With your explicit consent, including if twocms is merged with or acquired by another company
5.6 Who at twocms can see it
Our staff don't read your Google user data unless you ask us to (for example, to look into a problem with your account), it's needed for security (such as investigating abuse), or the law requires it.
5.7 Disconnecting and deleting your data
You can disconnect Google at any time by:
- Asking us in your group chat or emailing support@twocms.com
- Removing twocms from your Google Account at myaccount.google.com/permissions
When you disconnect, or when you stop using twocms, we revoke our access, stop retrieving your Google data and delete the Google user data we have stored within 30 days. Messages already sent to your group chat remain in your chat history.
5.8 Limited Use
twocms's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.
6. Data sharing and disclosure
We may share your personal information with:
6.1 Service providers
We share information with third-party service providers who help us operate our business and deliver services to you, such as:
- Payment Processors: We use Stripe to process payments. When you make a payment, you provide your payment information directly to Stripe, and their use of your personal information is governed by their Privacy Policy.
- Hosting Providers: We use cloud infrastructure providers to host our platform.
- Analytics Providers: We use analytics services to help us understand how users interact with our services.
- Customer Support Tools: We use third-party tools to provide customer support services.
6.2 Legal requirements
We may disclose your information if required to do so by law or in response to valid requests by public authorities (e.g., a court or government agency).
6.3 Business transfers
If we are involved in a merger, acquisition, or sale of all or a portion of our assets, your information may be transferred as part of that transaction.
6.4 With your consent
We may share your information with third parties when we have your consent to do so.
7. Data retention
We retain your personal information for as long as necessary to provide the services you have requested, comply with our legal obligations, resolve disputes, and enforce our agreements. If you delete your account, we may retain certain information as required by law or for legitimate business purposes.
8. Data security
We implement appropriate technical and organizational measures to protect the security of your personal information. However, please be aware that no method of transmission over the Internet or method of electronic storage is 100% secure. While we strive to use commercially acceptable means to protect your personal information, we cannot guarantee its absolute security.
9. International data transfers
Your information may be transferred to, and maintained on, computers located outside of your state, province, country, or other governmental jurisdiction where the data protection laws may differ from those in your jurisdiction. If you are located outside Australia and choose to provide information to us, please note that we transfer the information to Australia and process it there.
10. Your rights and choices
Depending on your location, you may have certain rights regarding your personal information:
10.1 Access and update
You can access and update certain information through your account settings.
10.2 Data subject rights
Depending on your location, you may have the right to:
- Access the personal information we hold about you
- Correct inaccurate or incomplete data
- Request deletion of your personal information
- Restrict or object to processing of your personal information
- Data portability (receive your data in a structured, commonly used format)
- Withdraw consent where processing is based on consent
- Lodge a complaint with a supervisory authority
To exercise these rights, please contact us using the information provided in the "Contact Us" section.
11. Cookies and tracking technologies
11.1 Cookies
We use cookies and similar tracking technologies to track activity on our website and hold certain information. Cookies are files with a small amount of data which may include an anonymous unique identifier.
11.2 Types of cookies we use
- Essential Cookies: Required for the basic functionality of our website.
- Analytical/Performance Cookies: Allow us to recognize and count the number of visitors and see how visitors move around our website.
- Functionality Cookies: Used to recognize you when you return to our website.
- Targeting Cookies: Record your visit to our website, the pages you have visited, and the links you have followed.
11.3 Cookie control
Most web browsers allow you to control cookies through their settings preferences. However, if you limit the ability of websites to set cookies, you may impact your overall user experience.
12. Children's privacy
Our services are not intended for children under the age of 16, and we do not knowingly collect personal information from children under 16. If we learn that we have collected personal information from a child under 16, we will take steps to delete such information as quickly as possible.
13. Third-party links
Our website and services may contain links to third-party websites. We have no control over and assume no responsibility for the content, privacy policies, or practices of any third-party websites or services. We encourage you to read the privacy policy of every website you visit.
14. Changes to this privacy policy
We may update our Privacy Policy from time to time. We will notify you of any changes by posting the new Privacy Policy on this page and updating the "Last Updated" date. You are advised to review this Privacy Policy periodically for any changes. Changes to this Privacy Policy are effective when they are posted on this page.
15. Contact us
If you have any questions about this Privacy Policy or our data practices, please contact us at:
2Suns Pty Ltd
ABN: 30 653 525 305
Email: support@twocms.com
Website: twocms.com