Privacy Policy

Elsa is a desktop AI agent for Windows made by Twinciti Inc. ("Twinciti", "we", "us"). You teach Elsa a task once and it repeats it for you by operating your browser and desktop apps. This policy explains what information Elsa handles, why, who we share it with and the choices you have.

Contents

• 1. What we collect
• 2. How we use information
• 3. AI models and automated processing
• 4. Google user data
• 5. Who we share information with
• 6. How long we keep information
• 7. Security
• 8. Your choices and rights
• 9. Cookies on twinciti.com
• 10. Children
• 11. International transfers
• 12. United States and California
• 13. EEA and United Kingdom
• 14. Changes to this policy
• 15. Contact

1. What we collect

Account information

• Your name, email address and password when you sign up with email. Passwords are handled by our authentication provider and are never stored in readable form.
• If you sign in with Google, your name, email address and profile picture from your Google account.
• A profile picture if you upload one.

Devices

The name and type of each device you connect to your account, and when it was last seen.

Billing information

Payments are processed by Stripe. Your card details go directly to Stripe; we do not see or store your full card number. We keep your Stripe customer ID, your plan and subscription status, your purchases, your credit balance and a record of the credits each task used.

Workflows you teach

• While you teach a workflow, the Elsa app records your screen, your microphone, and your clicks and keystrokes. The recording is saved on your computer.
• To build the workflow, Elsa sends us the recorded actions (including text you typed), the audio so your narration can be transcribed (or the whole recording file, if the audio is missing), and screen images from the recording when it needs to look at a moment of it.
• We store the workflow: its name and description, the steps Elsa learned, your conversation with Elsa about it, your answers to Elsa's questions, and the narration transcript and recorded actions it was built from.

Teaching records your microphone. If other people can be heard while you teach, you are responsible for telling them and getting any consent the law where you are requires.

Screen content while Elsa works

To decide each next action when teaching or running a workflow, Elsa takes screenshots and reads the contents of web pages and app windows. It sends these, with the results of its actions (such as data it read from a website or a Google service), to our servers and to the AI model providers in section 3. Anything visible on your screen while Elsa works can be included, so close or hide anything you do not want Elsa to see.

Voice

ElevenLabs transcribes your teaching narration. If you turn on Elsa's spoken replies, the text Elsa speaks is sent to ElevenLabs to produce the audio.

Diagnostics and security

• Crash reports sent to Sentry contain the type of error, where in the code it happened, your operating system, your app version and your computer's name. Screen content is removed before they are sent.
• Error reports sent to our own servers may include your account ID, email address, the error message and technical details of what Elsa was doing.
• We record IP addresses and failed sign-in attempts to limit abuse of sign-in and verification codes.
• Our server logs record what Elsa did and whether it worked. They do not record the content Elsa successfully read from a page or from Google services.

The Elsa app does not use advertising or third-party analytics trackers.

2. How we use information

• To provide Elsa: learn and run your workflows and show you what happened.
• To manage your account, devices, credits and payments.
• To send you sign-in and verification codes.
• To keep Elsa secure, prevent abuse and fix errors.
• To respond to you when you contact support.
• To meet legal, tax and accounting obligations.

We do not sell your personal information and we do not use it for advertising.

3. AI models and automated processing

Elsa uses AI models to understand your screen and decide what to do. Requests go through OpenRouter, which routes them to models from Google (Gemini), OpenAI (GPT), Anthropic (Claude) and xAI (Grok). Depending on the task, a request can contain:

• screenshots, and screen images from your teaching recording;
• the contents of web pages and app windows;
• your workflow's instructions, your conversation with Elsa and your answers;
• recorded actions from your teaching session and the transcript of your narration;
• the results of Elsa's actions, including data read from Google services.

These providers receive this information to return a response to Elsa. Requests are routed only to providers that do not store them or use them to train their models.

Elsa acts on your instructions. It does not make decisions about you that have legal or similarly significant effects. AI output can be wrong, so review what Elsa does and the results it reports.

4. Google user data

Connecting a Google account is optional. If you connect one, Elsa can work with Gmail, Google Drive, Google Sheets, Google Docs, Google Slides, Google Calendar and Google Tasks on your behalf. Elsa accesses this data only when a workflow you taught or started needs it. Your Google sign-in tokens are stored encrypted on your computer and are not sent to our servers.

We limit our use of Google user data as follows:

• Use. We use it only to carry out the tasks you ask Elsa to do. To do that it may be sent to our servers and to the AI model providers in section 3.
• Transfer. We do not transfer it to anyone except as needed to provide those tasks, to comply with the law, or as part of a merger, acquisition or sale of assets.
• Advertising. We do not sell it or use it for advertising.
• Human access. No person at Twinciti reads it unless you ask us to (for example, for support), it is needed for security, or the law requires it.

Google user data is not used to develop, improve or train generalized AI or ML models.

Elsa's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Google at any time from your Google account's third-party access settings.

5. Who we share information with

We share information only with the service providers that run Elsa for us, as needed for their part of the service:

We may also disclose information if the law requires it, to protect the rights or safety of users or others, or as part of a merger, acquisition or sale of assets, in which case this policy will continue to apply.

6. How long we keep information

7. Security

We use standard safeguards to protect your information. It is sent to our servers over encrypted connections, Google sign-in tokens are encrypted on your computer, and card details are handled by Stripe.

8. Your choices and rights

Deleting workflows. Deleting a workflow or chat in the app erases it from our servers, including its runs, learned steps and attached files.

Your account and data. You can delete your account in the desktop app (Account page), after confirming a code sent to your email. This erases your profile, workflows, chats, runs, files, credits and error reports straight away, cancels any subscription and removes your saved card from Stripe. The app also removes the Elsa files it keeps on your computer, such as teaching recordings. Unused credits and paid time are not refunded. Server logs that may contain your email expire within 30 days. To get a copy of your data, email support@twinciti.com from the email address on your account. You can update your name and profile picture in the app.

Depending on where you live, you may have the right to access, correct, delete or receive a copy of your personal information, to object to or restrict how we use it, and to withdraw consent. We will respond within the time the law requires.

9. Cookies on twinciti.com

Our website does not set its own cookies and does not use analytics or advertising trackers. Cloudflare, which hosts the site, may set cookies that are strictly necessary for security and performance. Because we do not track you across sites, we do not respond to Do Not Track signals differently.

10. Children

Elsa is not intended for anyone under 16, and we do not knowingly collect information from them. If you believe a child has given us information, contact us and we will delete it.

11. International transfers

We are based in the United States. We store and process information in the United States, and our providers may process it in other countries. Where the law requires, we protect these transfers with appropriate safeguards, such as the standard contractual clauses approved by the European Commission.

12. United States and California

In the last 12 months we collected these categories of personal information, for the purposes in section 2:

• Identifiers: name, email address, account ID, IP address and device name.
• Account login: email address and password, used only to sign you in.
• Commercial information: plan, purchases, credit balance and credit use.
• Internet and electronic activity: screen content, recorded actions, workflow activity and diagnostics.
• Audio: microphone audio from teaching sessions.
• Any other information you give Elsa access to, including data from Google services if you connect them.

We disclose these categories only to the providers in section 5 for business purposes. We do not sell or share personal information, as those terms are defined in California law, and we do not use sensitive personal information for anything beyond providing Elsa.

You can ask to know, access, correct or delete your personal information by emailing support@twinciti.com from the email address on your account. We verify your request by confirming it comes from that address. You may use an authorized agent, and we may ask for proof of their authority. We will not treat you differently for exercising these rights.

13. EEA and United Kingdom

Twinciti Inc. is the controller of your personal information. We rely on these legal bases:

Transfers outside the EEA and UK are protected by appropriate safeguards, as described in section 11. You have the rights listed in section 8 and the right to complain to your local data protection authority.

14. Changes to this policy

We may update this policy. We will post the new version here with a new effective date, and tell you in the app or by email before material changes take effect.

15. Contact

Twinciti Inc., 1901 Cornwall Ave 1196, Bellingham, WA 98225, United States.
Email: support@twinciti.com