1. Roles
TWIX is the controller (PIPA: personal information handler) for accounts, teacher profiles, employer listings, applications, messages, support tickets and payment records. The companies below act as processors on our documented instructions, under written Data Processing Agreements that require confidentiality, security measures, sub-processor control, assistance with data-subject rights, breach notification and deletion or return of data at the end of the service.
2. Sub-processors
| Sub-processor | What it does | Region | Agreement |
|---|---|---|---|
| Lovable (hosting & application platform) | Hosts the website and the server code that runs it. | EU / global edge network | DPA offered under Lovable's terms — request via the in-product privacy/legal contact. |
| Supabase (database, authentication, file storage) | Stores accounts, listings, teacher profiles, messages, uploaded documents. | Managed cloud region for this project | Supabase DPA with EU Standard Contractual Clauses. |
| Resend (transactional email) | Delivers confirmations, admin notifications and support replies. | EU / US | Resend DPA with Standard Contractual Clauses. |
| Google Analytics 4 | Anonymous usage statistics. Only runs with analytics consent. | EU / US | Google Ads Data Processing Terms + SCCs; IP anonymisation and Consent Mode enabled. |
| Toss Payments (planned) | Card and local payment processing for paid listings. | Republic of Korea | Payment data is handled by the provider as an independent controller; TWIX stores only order and receipt references. |
3. International transfers
Where data leaves Korea or the EEA, transfers rely on the EU Standard Contractual Clauses (and the UK Addendum where relevant), plus PIPA Article 28-8 consent and disclosure of the recipient, purpose, retention period and categories transferred, which are set out in the Privacy Policy.
4. Security measures
- encryption in transit (TLS) and at rest for the database and file storage;
- row-level security so each account can only read its own records;
- staff-only administrative functions behind role checks and an audit log;
- uploaded CVs and certificates stored in private buckets, never publicly listed;
- change history and moderation logs for accountability.
5. Retention
- account and profile data: while the account exists, then deleted on request;
- listings: kept while published plus 12 months for dispute handling;
- payment and tax records: 5 years, as required by Korean tax law;
- consent records: 3 years as proof of consent;
- analytics: 14 months.
6. Getting a copy of the DPA
Schools, recruiters and enterprise partners who need a signed Data Processing Agreement with TWIX (with our sub-processor list annexed) can request one from admin@twixwork.com. Our own DPAs with the platform providers above are on file and can be evidenced on request. The platform-side agreement with Lovable is requested and maintained through Lovable's legal contact; when a countersigned copy is issued, its date is recorded here.
7. Exercising rights
Use the Privacy Centre to withdraw consent, request a copy of your data, correct it or ask for deletion.