1. Introduction
This Privacy Policy explains how Mentortain S.R.L. (“Twelve”, “we”, “us”) collects, uses, shares and protects personal data when you use the Twelve mobile application and website, and when you communicate with us. Twelve is the data controller for the processing described in this Policy. It applies together with our Terms of Service, Cookie Policy, Community & Health Content Standards and, for Creators, the Creator Data Annex.
Twelve is an adults-only platform (18+). We do not knowingly process the data of persons under 18; accounts we reasonably believe to belong to minors are terminated and the associated data deleted.
2. Data we collect
Account and profile data — name or display name, username, email address, date of birth, password (hashed), profile photo, bio, stated interests and goals, language and country.
Content you create — videos, listings, Series, community posts, comments, reviews, and messages sent through the platform (including Order threads and direct messages).
Purchase and payout data — orders, subscriptions, amounts, refunds, disputes, and payout records. Card payments are processed by Stripe, Apple or Google; we do not store full card numbers. For Creators, identity-verification (KYC) data is collected by Stripe during onboarding, and tax data (including tax identification number and financial account identifier) is collected by us as required by law (Section 5).
Usage and engagement data — content viewed, watch time, completion rates, saves, likes, searches, quiz answers, skill-level progress, referral activity and feature usage.
Device and technical data — device type and identifiers, operating system, app version, IP address, approximate location derived from IP, crash logs and diagnostic events.
Support and correspondence — messages you send to help@twelve-app.com and reports you submit in-app.
3. Health-related data
Because Twelve is a health, nutrition and fitness platform, some data may reveal information about your health — for example, your stated goals, the health topics you engage with, quiz answers, or information you choose to share with a Creator when ordering a Service. This is special-category data under art. 9 GDPR and receives enhanced protection. We personalise your feed and recommendations on the basis of health-related interests only with your explicit consent, which you can withdraw at any time in the app’s privacy settings; if you withdraw it, personalisation falls back to non-sensitive signals. Information you share with a Creator in an Order is provided at your own initiative and is governed by Section 7 and the Creator Data Annex. We never require medical records, and Creators are prohibited from requesting them.
4. Purposes and legal bases
| Purpose | Examples of data used | Legal basis (GDPR) |
|---|---|---|
| Operating the platform: accounts, content hosting, purchases, Orders, payouts | Account, content, purchase and payout data | Art. 6(1)(b) — performance of a contract |
| Personalised feed and recommendations based on health-related interests | Stated interests, engagement with health content, quiz results | Art. 9(2)(a) and 6(1)(a) — explicit consent |
| Non-sensitive personalisation, product analytics and improvement | Aggregated usage, device and engagement data | Art. 6(1)(f) — legitimate interests |
| Safety, moderation, fraud prevention and enforcement of our Terms | Content, usage, device and report data | Art. 6(1)(f) — legitimate interests; art. 6(1)(c) — legal obligations under Regulation (EU) 2022/2065 |
| Tax, accounting and regulatory compliance (incl. DAC7 reporting to ANAF, RO e-Factura, cooperation with the CNA) | Identity, tax, transaction and, where legally required, contact data | Art. 6(1)(c) — legal obligation |
| Service communications (receipts, order updates, security and policy notices) | Account and transaction data | Art. 6(1)(b), (c) and (f) |
| Marketing communications from Twelve | Email, in-app notification preferences | Art. 6(1)(a) — consent, withdrawable at any time |
5. Legal reporting we are required to make
As a platform operator, Twelve reports Creator information annually to the Romanian tax authority (ANAF) under DAC7 (Directive (EU) 2021/514, transposed by Government Ordinance no. 16/2023): identity, tax identification number, financial account identifier, consideration paid per quarter, and fees charged. As a video-sharing platform under Law no. 504/2002, Twelve may be required to provide the National Audiovisual Council (CNA) with the contact data of a user whose posted material breaches the Audiovisual Law. We also respond to lawful requests from courts and competent authorities.
6. Automated processing and AI
We use automated systems to transcribe and tag content, generate quizzes, rank and recommend content, and detect policy violations and fraud. Moderation decisions can be appealed and appeals are always reviewed by a person (Terms of Service, Section 16). We do not make decisions based solely on automated processing that produce legal or similarly significant effects on you. We do not use Creator content to train general-purpose generative AI models.
7. Who we share data with
Service providers (processors) — cloud hosting and storage, content delivery, transcription and AI-processing providers, analytics and crash reporting, and customer-support tooling, each bound by data-processing agreements and acting on our instructions. The providers currently engaged are:
- Stripe: payment processing, Creator identity verification (KYC) and payouts.
- Apple and Google: in-app purchases of Series and Subscriptions.
- Bunny CDN: video storage, delivery and streaming.
- Firebase (Google): push notification delivery.
- OpenAI: video transcription (audio from uploaded videos is sent for speech-to-text).
- Anthropic: content tagging and quiz generation from video transcripts.
- Sentry: error tracking and crash reporting.
- Mailgun: transactional email delivery.
Payment partners — Stripe (payments, Creator onboarding and payouts) and Apple / Google (in-app purchases), each acting as an independent controller for its own compliance, fraud-prevention and KYC processing under its own privacy policy.
Creators — when you order a Service, the Creator receives your username, the Order requirements and the messages you send them. Creators act as independent controllers for this data and are bound by the Creator Data Annex: they may use it only to perform the Order, must keep it secure and confidential, and must not use it for marketing or retain it beyond need.
Other users — your public profile, public content, reviews and platform statuses are visible to other users as part of how the platform works.
Authorities and advisers — tax, audiovisual, consumer-protection, data-protection and law-enforcement authorities where legally required, and our professional advisers under confidentiality.
Corporate transactions — in a merger, acquisition or reorganisation, data may transfer as part of the transaction, with notice to you.
We do not sell personal data and we do not share it with third parties for their own advertising.
8. International transfers
Where our providers process data outside the European Economic Area, we rely on an adequacy decision of the European Commission (including, for certified US providers, the EU–US Data Privacy Framework) or on the Standard Contractual Clauses, together with supplementary measures where needed. You can request a copy of the relevant safeguards at help@twelve-app.com.
9. Retention
Account and profile data — for the life of the account and up to 30 days after deletion, while our systems complete the deletion pipeline.
Transaction, invoicing and payout records — for the periods required by Romanian fiscal and accounting legislation (generally 5 years, or the longer period required for specific records).
DAC7 and other regulatory reporting records — for the statutory retention periods applicable to each report.
Content and messages — until you delete them or your account is deleted, subject to legal holds and to copies needed to resolve disputes or enforce our Terms.
Moderation and security records — for as long as needed to enforce our Terms, handle appeals and meet legal obligations.
Technical logs — typically up to 12 months.
10. Your rights
Under the GDPR you have the right to access your data; to rectification; to erasure; to restriction of processing; to data portability; to object to processing based on legitimate interests; and to withdraw any consent at any time, without affecting prior processing. You can exercise these rights in the app’s privacy settings or by writing to help@twelve-app.com; we respond within one month and free of charge, except in the cases allowed by law. You also have the right to lodge a complaint with the Romanian supervisory authority: Autoritatea Națională de Supraveghere a Prelucrării Datelor cu Caracter Personal (ANSPDCP), B-dul G-ral Gheorghe Magheru 28-30, Sector 1, Bucharest, Romania, www.dataprotection.ro — or with the supervisory authority of your place of residence.
You can request deletion of your account and associated data in the app or at twelve-app.com/delete-account. Reviews you left may be anonymised rather than deleted, to preserve the integrity of Creator ratings, and records we are legally required to keep are retained under Section 9.
11. Security
We apply technical and organisational measures appropriate to the risk, including encryption in transit, access controls and logging, environment separation, and vendor due diligence. No system is perfectly secure; if a breach affecting your rights occurs, we will notify you and the supervisory authority as required by arts. 33–34 GDPR.
12. Changes and contact
We will notify you of material changes to this Policy in the app or by email before they take effect. Questions and requests: help@twelve-app.com, or by post to Mentortain S.R.L., Sat Bucov, Comuna Bucov, Strada Dacia nr. 78, Județul Prahova, Romania.