Data processing agreement
Counsel reads a consultant’s calendar, so most of what it holds is about his clients — people who never signed up for anything. This sets out how that data is handled, who touches it, and what happens when you leave. It applies automatically to every paid account; nothing needs signing for it to be in force.
Who is what
You are the Data Fiduciary for the personal data of the people you meet. TwelfthKey (OPC) Private Limited is the Data Processor, acting on your instructions.
For your own account details — your name, email, billing information — we are the fiduciary in our own right, and the privacy policy governs those.
This agreement is between you and TwelfthKey (OPC) Private Limited, 6/1704 DB Ozone, Ketkipada, Dahisar East, Mumbai 400068, Maharashtra, India, CIN U70200MH2026OPC465581. It takes effect when you first connect a calendar and continues while your account exists.
What is processed, and why
- Providing Counsel: reading a connected calendar, deriving client relationships and cadence from it, and holding what you enter yourself.
- While your account exists, and no longer — except tax invoices, which GST requires for 72 months.
- Your clients and anyone else on a meeting invitation; your colleagues where you have seats.
- Names, email addresses, meeting titles, times, durations, invitation responses, and whatever you type into a commitment or a note.
- None asked for. A meeting title is free text, so anything can end up in one; Counsel does not seek or infer sensitive data.
Our obligations
We process this data only to provide Counsel and only on your instructions, which are these terms and what you do in the software. We do not sell it, do not use it for advertising, and do not use it to build profiles for anyone other than you. It is not used to train any model.
Anyone with access is bound by confidentiality. We do not read your calendar data in the ordinary course: access is for a support request you have made, or where the law compels it, and either is logged.
Security
- Enforced at the database, not in application code. Row-level security is enabled and forced on every table holding account data, so a query without an account context returns nothing rather than everything.
- Your Google refresh token is encrypted with AES-256-GCM under a key held separately from the session key, so either can be rotated alone. It is never displayed, logged or exported.
- Server-side and revocable immediately. The cookie value is stored only as an HMAC-SHA256 hash, so reading the database yields nothing replayable.
- The application connects as a restricted database role that cannot bypass those policies.
- TLS throughout, to us and to every processor below.
- An audit log of significant actions and a ledger of every model call.
Sub-processors
These, and no others. Each receives only what it needs to do its job.
- The calendar itself, read-only, and sign-in identity.
- Stores all account data.
- Runs the application; every request passes through it.
- Phrasing for the Monday brief, meeting prep and command-bar answers. Meeting prep includes client email addresses. Not used for training.
- Sends the Monday brief and payment emails; receives the recipient address and the message.
- Payments. Card details go to Razorpay directly and never reach Counsel.
- Calls one scheduling endpoint; receives no personal data.
We will tell account holders by email at least 30 days before adding or replacing a sub-processor, so there is time to object or to leave.
Where the data is
Primarily Singapore: the database and the application both run in ap-southeast-1, chosen for latency to India. Anthropic, Resend and Upstash process in the United States, and Google according to its own terms. India permits transfer outside the country except to jurisdictions the government restricts; none of these is currently restricted.
If something goes wrong
If we become aware of a personal data breach affecting your data, we will tell you without undue delay and in any case within 72 hours, with what we know: what happened, whose data, what we are doing, and what you may need to do. We will help you meet your own obligations to the Data Protection Board and to the people affected.
Helping you answer your clients
If one of your clients asks you what you hold about them, or asks you to erase it, you can answer without us: the export gives you everything Counsel holds, removing a client stops it matching new meetings, and deleting your account removes all of it. Where you need something narrower, write to privacy@twelfthkey.com and we will do it within 30 days. Our Grievance Officer is Aditya Anil Mayekar.
Return and deletion
You can export at any moment, on every plan, whatever the state of your billing. Deleting your account deletes everything held about it — the detail is in the privacy policy — with two stated exceptions: tax invoices, kept for 72 months with the account link severed, and backups, which expire on their own schedule.
Audit
On reasonable notice, no more than once a year, we will answer a written security questionnaire and provide what we hold about our own controls. We do not currently hold an ISO 27001 or SOC 2 report, and say so rather than implying otherwise.
Signing it
This agreement applies to every paid account as it stands; using Counsel is acceptance, and nothing needs signing for it to bind us.
If your own compliance process needs a countersigned copy, write to privacy@twelfthkey.com and we will sign this document as it is. We are a small company and would rather sign something we can honour than negotiate something we cannot.