Privacy policy

1. Who we are

TwoKeys is operated by [legal entity name and registration number], [physical address], South Africa (“TwoKeys”, “we”, “us”).

Information Officer: [name], contactable at [privacy email address]. We will register our Information Officer with the Information Regulator before launch.

2. What we collect on this website

• Waitlist: your email address, your confirmation that you're 18 or older and agree to hear from us, the date and time you joined, and the version of the consent wording you saw.
• That's it. We don't ask for your name, phone number, location or anything about your relationship to join the waitlist.

3. What we don't do

• No analytics, advertising or tracking tools, pixels or session recording on this website.
• No cookies, apart from any that are strictly necessary for the website to work. Right now we set none.
• We don't store your IP address with your waitlist entry, and we don't build profiles of you or your partner.
• We never sell or rent your personal information.

4. Why we use it (purpose and lawful basis)

We use your email address only to tell you about TwoKeys early access and launch. Our lawful basis is your consent (POPIA section 11(1)(a)), and electronic direct marketing is opt-in only (section 69). You can withdraw your consent at any time, and withdrawing is as easy as giving it.

5. How long we keep it

We keep your waitlist entry until you unsubscribe, ask us to delete it, or TwoKeys launches and you have either created an account or not responded to our invitation within [12 months], whichever happens first. Then we delete it.

6. Who we share it with

We may use a small number of service providers (operators under POPIA) to store the waitlist and send emails, such as Vercel (website hosting), Upstash (waitlist data, stored in Cape Town, South Africa) and Resend (email delivery; processed in the United States). They may only process your information on our instructions and must keep it secure (sections 20 and 21).

Resend, which sends our emails, stores and processes information (including your email address) in the United States. If any provider stores information outside South Africa, we will only use one that offers an adequate level of protection or is bound by an agreement that does, as section 72 requires. [Hosting region to be confirmed.]

7. Keeping it safe

We use reasonable technical and organisational measures to protect your information, including encryption in transit and limited access (section 19). If we ever have a security compromise that affects you, we will tell you and the Information Regulator as section 22 requires.

8. Your rights

• Ask whether we hold your information and get a copy of it.
• Ask us to correct or delete it.
• Object to us using it, or withdraw your consent, at any time. Every email will include an unsubscribe link.
• Complain to the Information Regulator (South Africa): inforeg.org.za. We'd appreciate the chance to sort it out first at [privacy email address].

9. Under 18s

TwoKeys is for adults only. We don't knowingly collect information from anyone under 18. If you think a child has joined the waitlist, contact us and we'll delete it.

10. The TwoKeys app (preview)

The app will be built on the same principles: each partner opts in feature by feature, nothing is shared without both of you agreeing, either of you can leave on your own at any time, and shared data is permanently deleted within 30 days of leaving. Some app features, like mood check-ins, may involve special personal information (sections 26 and 27), which we will only process with your explicit consent. The full app policy will set this out in detail.

11. Changes

We'll update this page if anything changes and show the date at the top. If a change affects how we use your waitlist email, we'll tell you first.