Privacy Policy

Website: linktwos.com
Last updated: 30 October 2026
Effective date: 30 October 2026

1. Who We Are

linktwos.com ("the Website") is operated by PHM Ltd, a company registered in England and Wales under company number 16960300, with its registered office at Oakwood, Hook Heath Road, Woking, England, GU22 0LE ("we", "us", "our").

We are the data controller in respect of the personal data collected through this Website. This means we determine the purposes and means of processing your personal data.

Contact details for data protection matters:
Email: info@linktwos.com
Post: PHM Ltd, Oakwood, Hook Heath Road, Woking, England, GU22 0LE

If you have any questions about how we handle your personal data, please contact us using the details above before raising a complaint with the regulator.

2. Scope of This Policy

This Privacy Policy explains what personal data we collect when you visit linktwos.com, why we collect it, the legal basis on which we process it, how long we keep it, who we share it with, and what rights you have under UK data protection law.

This policy applies to all visitors to linktwos.com. It should be read alongside our Cookie Policy, which provides additional detail about the cookies we use.

This policy also applies to the Linktwos mobile and web applications (together, the "App"). Section 4.3 describes the additional personal data we process when you create an account and use the App.

3. The Legal Framework

We are subject to:

• the UK General Data Protection Regulation ("UK GDPR") as retained in domestic law by the European Union (Withdrawal) Act 2018 and amended by the Data Protection, Privacy and Electronic Communications (Amendments etc.) (EU Exit) Regulations 2019; and
• the Data Protection Act 2018 ("DPA 2018").

The supervisory authority in the UK is the Information Commissioner's Office ("ICO"), reachable at ico.org.uk or on 0303 123 1113.

4. What Personal Data We Collect and How

4.1 Analytics Data (Google Analytics 4)

When you visit the Website, we use Google Analytics 4 ("GA4"), a web analytics service provided by Google LLC ("Google"). GA4 collects the following information automatically:

Identifiers and device information:

• A randomly generated client identifier stored in the _ga cookie on your device for approximately 2 years, used to distinguish returning visitors from new visitors
• Your browser type and version, operating system, device type, screen resolution, and browser language settings

Approximate location:

• Country, region, and city, derived from your IP address. Google uses your IP address only for the purpose of determining your approximate location and does not retain or log full IP addresses in GA4 after geo-lookup

Traffic source information:

• The URL of the page that referred you to the Website (referring URL)
• Search engine used (where applicable)
• Campaign parameters appended to URLs (e.g., utm_source, utm_medium, utm_campaign, utm_content, utm_term)

Behavioural and engagement data (collected automatically via GA4 Enhanced Measurement):

• Every page view: the URL loaded, the page title, and the referring page
• Session start and first-visit events
• Scroll depth (an event fires when you scroll to approximately 90% of a page's length)
• Outbound link clicks (clicks on links that lead to external websites)
• URL-based search queries, where the URL contains a recognised search parameter (e.g., ?q=)
• File download events, where you click a link pointing to a downloadable file (e.g., PDF, ZIP)
• Form interaction events: when you begin completing a form on the Website and when you submit a form. GA4 records only that these events occurred; it does not capture the content of any form fields, including anything you type into the question box or the name and email address you enter into our waitlist form
• Session duration, time on page, and engagement metrics

What GA4 does not collect through our current implementation:

• Your name, email address, telephone number, or any other information you enter into forms on the Website (form field values are not transmitted to GA4)
• Precise GPS or device-level location data
• Payment card or financial information
• Sensitive personal data as defined in Article 9 UK GDPR

4.2 Waitlist Submissions

Until the Linktwos app opens to the public, the sign-up buttons and the "Who would help you right now?" box on the Website add you to our waitlist. If you join the waitlist, we collect:

• your first name and email address;
• what you typed into the question box, if anything (for example "a bookkeeper for my bakery"); and
• whether you asked about running an event, and which page or button you signed up from; and
• your invite code, whose invite link you joined through (if any), and how many people have joined through yours.

When you join, we give you a personal invite link and show your place on the list. Each person who joins through your link moves you up the list. Anyone who has your invite link or code can see your place on the list and how many people have joined through it, but not your name or email address. The person whose link you used is not told who you are.

Earlier versions of the waitlist form asked for some other details. Anything you gave us through those versions is kept and used on the same terms as this section.

This information is collected and stored by Netlify, Inc., the hosting and form-processing provider for the Website, and in our own waitlist database, hosted by Railway Corp. in its European Union region, which works out places on the list. Both are kept separately from Google Analytics. We use it only to:

• tell you when Linktwos opens, and send you a link to sign up;
• contact you about your place on the waitlist, or about running an event if you asked about that;
• work out your place on the list and count the people who join through your invite link; and
• understand what people want to use Linktwos for, so we can prepare for launch.

We do not create a Linktwos account for you from your waitlist entry. You choose whether to sign up when we tell you Linktwos is open. We do not share your waitlist data with third parties for their own marketing purposes, and we do not send it to the AI providers listed in Section 7.

Voluntary nature of providing data: Joining the waitlist is entirely voluntary. If you choose not to, the only consequence is that we will be unable to tell you when Linktwos opens. You may leave the waitlist at any time by emailing info@linktwos.com or using the "Leave the waitlist" link at the bottom of any waitlist email, after which we will securely delete your waitlist data. We keep only your email address, on a list of people we must not email again, so that you stay off every copy of the list.

4.3 The Linktwos App

When you create an account and use the App, we collect and process:

• Account data: your email address, username, and password (stored as a salted hash; we never see or store your password in plain text).
• Profile content: the information you choose to add to your profile: display name, headline, location, biography, roles, education, skills, interests, links, and any CV or résumé you choose to upload.
• Conversations with the Linktwos assistant: what you tell our in-app assistant about who you are looking to meet, which we use to build and refine your matching preferences.
• Messages: messages you exchange with other users, so we can deliver them and display your conversation history.
• Device push token: if you enable notifications, an identifier issued by Apple (on iPhone) or by Google Firebase Cloud Messaging (on Android) that lets us deliver them. You can disable notification types in the App at any time.
• QR code scanning: on Android, the scanner that reads Linktwos contact codes uses Google ML Kit on your device. The camera image is processed on the device and is not sent to us or to Google; ML Kit may send Google anonymous diagnostic and performance information about the scanner.
• Events: the events you join, and whether you checked in at an event venue (shown to other attendees as "Here now" during the event). If you host an event, the event details you enter and the list of people who joined it.
• Match feedback: when you rate a suggested match (for example, thumbs up or down and the reason you choose), so we can improve future suggestions.
• Error reports: if our servers hit an error, technical details of that error and where in our code it happened. We set these reports up to leave out your name, email address, messages and profile content.
• Photos: a profile photo, and any photos you send in messages.
• Contacts and events activity: people you add by scanning or sharing a Linktwos code, and, after speed networking, whether you would like to keep in touch with each partner.
• Activity used for matching: when you were last active and how often you reply, so we introduce people who are likely to answer.
• Service emails: your email address and the content of account emails we send you, such as password-reset links.

AI processing. The App is built around AI-assisted matching. Your conversations with the in-app assistant, any CV you upload, and the matching-relevant parts of your profile are processed by artificial-intelligence models to build your profile, generate and refine your matching preferences, and suggest professional connections. This processing is performed on our behalf by Anthropic, PBC as our data processor (see Section 7.3). Data submitted this way is not used by Anthropic to train its models. To compare people with each other, short text descriptions of what you are looking for or offering, your listed skills, and job titles are also converted into numerical representations ("embeddings") by OpenAI as our data processor (see Section 7.6); OpenAI does not use this data to train its models. We do not use your data to make any decision producing legal or similarly significant effects about you: match suggestions are recommendations you are always free to accept, skip, or redirect.

Payments. Subscription purchases are made through Apple's App Store. Plans can't currently be bought in the Android app. Apple processes your payment; we never receive your payment card details. We receive only the subscription status needed to provide your plan (product, tier, expiry, and renewal state).

Blocking and reporting. If you block or report another user, we record that action to enforce it (and, for reports, to review the reported behaviour). The blocked or reported user is not told who blocked or reported them.

5. Legal Basis for Processing

We are required by UK GDPR Article 13 to identify the legal basis on which we process your personal data. The applicable bases are as follows:

Note on consent for analytics cookies: Under Regulation 6 of the Privacy and Electronic Communications Regulations 2003 ("PECR"), we require your prior informed consent before placing non-essential cookies (including GA4 analytics cookies) on your device. See our Cookie Policy for how we manage consent.

6. Cookies

We use cookies on the Website. Please see our Cookie Policy for full details of the cookies we set, their purpose, duration, and how you can control them.

7. Sharing Your Personal Data

We do not sell your personal data. We share your data with the following categories of third parties only to the extent necessary for the purposes described in this policy:

7.1 Google LLC (Google Analytics 4)

Analytics data is processed by Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, United States. Google processes data collected via GA4 in accordance with its own privacy policy, available at https://policies.google.com/privacy. Google acts as a data processor in respect of analytics data collected on our behalf, subject to Google's Measurement Controller-Controller Data Protection Terms and/or Data Processing Terms (as applicable).

7.2 Netlify, Inc.

Waitlist form submissions are processed and stored by Netlify, Inc., 44 Montgomery Street, Suite 300, San Francisco, CA 94104, United States. Netlify acts as our data processor in respect of form data submitted through the Website. Netlify's privacy policy is available at https://www.netlify.com/privacy/.

7.3 Anthropic, PBC

Assistant conversations, uploaded CVs, matching-relevant profile content, and any reason you give for skipping a match are processed by Anthropic, PBC, 548 Market Street, San Francisco, CA 94104, United States, which provides the AI models used for profile building and matching. Anthropic acts as our data processor and, under its commercial API terms, does not use data submitted via the API to train its models. To write the short note that comes with an introduction, Anthropic also receives the other person's first name, headline and what they are looking for or offering. Anthropic's privacy policy is available at anthropic.com/legal/privacy.

7.4 Apple Inc.

If you enable notifications, notification content is delivered through the Apple Push Notification service. Subscription purchases in the App are processed by Apple as merchant of record under Apple's own terms and privacy policy, available at apple.com/legal/privacy.

7.5 Google Firebase Cloud Messaging

On Android, if you allow notifications, notification content and your device's push token are delivered through Google Firebase Cloud Messaging, operated by Google LLC (or Google Ireland Limited) as our data processor. Firebase's privacy information is available at firebase.google.com/support/privacy.

7.6 OpenAI

Short text descriptions of what you are looking for or offering, your listed skills, and job titles are converted into numerical representations ("embeddings") by OpenAI, L.L.C., which we use to compare people for matching. OpenAI acts as our data processor and, under its API terms, does not use data submitted via the API to train its models. OpenAI's privacy policy is available at openai.com/policies/privacy-policy.

7.7 Sentry (Functional Software, Inc.)

Error reports from our servers are processed by Sentry, operated by Functional Software, Inc., acting as our data processor. Reports are stored in Sentry's European Union data region (Germany) and are set up to contain only technical details, not your name, email address, messages or profile content. Sentry's privacy policy is available at sentry.io/privacy.

7.8 Resend

Account emails, such as password-reset links, are sent through Resend, acting as our data processor, from its European Union region (Ireland). Resend processes your email address and the content of the email in order to deliver it. Resend's privacy policy is available at resend.com/legal/privacy-policy.

7.9 Hosting providers

App data is stored on servers operated by our hosting provider, Railway Corp., acting as our data processor, in its European Union region (Amsterdam, the Netherlands). Website waitlist submissions are handled by Netlify as described in Section 7.2, and copied to our waitlist database on the same Railway servers; Netlify also keeps standard server logs for the Website, including IP addresses.

Our email inboxes, including anything you send to info@linktwos.com, are provided by Microsoft (Microsoft 365). When someone reports a member, a copy of the report is emailed to our moderators so it can be reviewed quickly.

7.10 Legal and regulatory disclosures

We may disclose your personal data to law enforcement agencies, regulatory bodies, or courts where we are required to do so by law, or where doing so is necessary to protect our rights, the safety of any person, or to detect or prevent fraud or criminal activity.

8. International Transfers of Personal Data

Railway Corp., Google LLC, Netlify, Inc., Anthropic, PBC, Apple Inc., OpenAI, L.L.C., Functional Software, Inc. (Sentry), Resend and Microsoft are headquartered in the United States. App data is stored in the European Union, but these providers may access or process some data from the United States. Any transfer of personal data from the UK to the United States is an international transfer under UK GDPR.

We rely on the following transfer mechanisms to ensure an adequate level of protection:

• Google Analytics 4: Google LLC participates in and has certified its compliance with the UK Extension to the EU-US Data Privacy Framework and/or relies on the UK International Data Transfer Agreement ("IDTA") or UK Addendum to the EU Standard Contractual Clauses ("SCCs"), as applicable, which provide appropriate safeguards for the transfer of personal data to the United States. Further details are available in Google's data transfer documentation.
• Netlify: Netlify relies on the UK Addendum to the EU SCCs or equivalent transfer mechanism for transfers of data from the UK to the United States. Details are available in Netlify's DPA.
• Sentry and Resend: error reports are stored in Sentry's EU data region and account emails are sent from Resend's EU region. Where either provider accesses data from the United States, the transfer relies on the UK Extension to the EU-US Data Privacy Framework, the UK Addendum to the EU SCCs, or an equivalent transfer mechanism, as set out in each provider's data processing terms.
• Railway, Anthropic, OpenAI, Apple, Microsoft and Google (Firebase and ML Kit): transfers to Railway Corp., Anthropic, PBC, OpenAI, L.L.C., Apple Inc., Microsoft and Google LLC rely on the UK Extension to the EU-US Data Privacy Framework, the UK Addendum to the EU SCCs, or an equivalent transfer mechanism, as set out in each provider's data processing terms.

We take steps to ensure that any transfer of personal data outside the UK is subject to appropriate safeguards as described above, so that your rights and the protections afforded by UK data protection law continue to apply.

9. How Long We Keep Your Data

We will not retain your personal data for longer than is necessary for the purposes for which it was collected.

10. Your Rights Under UK GDPR

As a data subject under UK GDPR, you have the following rights. You can exercise these rights free of charge by contacting us at info@linktwos.com. We will respond within one calendar month of receiving a valid request (this period may be extended by up to two further months in complex cases, in which case we will notify you).

Right of access (Article 15): You have the right to obtain confirmation of whether we process your personal data and, if so, to receive a copy of that data and information about how it is processed.

Right to rectification (Article 16): You have the right to require us to correct inaccurate personal data we hold about you, and to complete incomplete personal data.

Right to erasure (Article 17): You have the right to request that we delete your personal data in certain circumstances, including where the data is no longer necessary for the purpose for which it was collected, where you withdraw consent, or where the data has been unlawfully processed.

Right to restriction of processing (Article 18): You have the right to request that we restrict our processing of your personal data in certain circumstances, including while the accuracy of the data is contested or while you have objected to processing.

Right to data portability (Article 20): Where processing is based on consent or contract and carried out by automated means, you have the right to receive your personal data in a structured, commonly used, and machine-readable format, and to have it transmitted to another controller where technically feasible.

Right to object (Article 21): Where we rely on legitimate interests as our legal basis, you have the right to object to our processing of your personal data on grounds relating to your particular situation. We will stop processing unless we can demonstrate compelling legitimate grounds that override your interests, rights, and freedoms, or unless processing is necessary for legal claims.

Right to withdraw consent (Article 7(3)): Where we process your data on the basis of consent (including for analytics cookies), you have the right to withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before the withdrawal. To withdraw consent for analytics cookies, see Section 11 below.

Right to object to direct marketing (Article 21(2)–(3)): You have an unconditional and absolute right to object at any time to the processing of your personal data for direct marketing purposes, including any profiling carried out for direct marketing. Where you exercise this right, we will immediately cease processing your data for those purposes, we are not permitted to refuse or to weigh competing interests against this right. To exercise it, contact us at info@linktwos.com or use the unsubscribe link included in any email we send you.

Rights related to automated decision-making: We do not make any decisions about you solely by automated means that produce legal or similarly significant effects.

11. Withdrawing Consent for Analytics and Opting Out

You may withdraw your consent for analytics data collection at any time by:

• Cookie preferences: Manage your cookie preferences: this will re-open the consent banner so you can change your choice.
• Browser settings: Most browsers allow you to delete and block cookies through their settings menus. Deleting the _ga cookie from your browser will reset your analytics identifier. Note that blocking all cookies may affect the functionality of some websites.
• Google Analytics Opt-out Browser Add-on: Google provides a browser extension that prevents GA4 from collecting data about your visits. You can download it at https://tools.google.com/dlpage/gaoptout.
• Google's privacy settings: You can manage Google's use of your data at https://myaccount.google.com/data-and-privacy.

12. Security

We take appropriate technical and organisational measures to protect your personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure, or access. These measures include HTTPS encryption on all pages of the Website.

However, no transmission over the internet is completely secure. While we take reasonable steps to protect your data, we cannot guarantee the security of data transmitted to or from the Website.

13. Third-Party Links

The Website may contain links to third-party websites. This Privacy Policy applies only to linktwos.com. We have no responsibility for the privacy practices of third-party websites and encourage you to review their privacy policies before providing them with any personal data.

14. Children

This Website is not directed at children under the age of 13, and we do not knowingly collect personal data from children under 13. If you believe we have inadvertently collected personal data from a child under 13, please contact us immediately at info@linktwos.com and we will take steps to delete it.

The App is for people aged 18 and over, as set out in our Terms of Use.

15. Changes to This Privacy Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, legal requirements, or for other operational reasons. When we make material changes, we will update the "Last updated" date at the top of this page. We encourage you to review this page periodically.

Where required by law, we will notify you of significant changes (for example, by placing a notice on the Website).

16. How to Complain

If you have a concern about how we handle your personal data and are not satisfied with our response, you have the right, without prejudice to any other administrative or judicial remedy, to lodge a complaint with the Information Commissioner's Office ("ICO"):

Information Commissioner's Office
Wycliffe House
Water Lane
Wilmslow
Cheshire
SK9 5AF

Website: https://ico.org.uk/make-a-complaint/
Helpline: 0303 123 1113

We would, however, appreciate the opportunity to address your concerns before you contact the ICO, and ask that you contact us in the first instance.