2to2 Privacy Policy

This policy explains how Datapolis.com Sp. z o.o. handles personal data in 2to2, our platform for process applications and digital workers, available at 2to2.ai. It covers the platform itself: your account, signing in (including Sign in with Google and Sign in with Microsoft) and the data you keep in 2to2. Our company website, datapolis.com, has its own privacy policy.

Who is responsible

2to2 is provided by Datapolis.com Sp. z o.o., ul. Dzielna 21/121a, 01-029 Warsaw, Poland (KRS 0000003324, NIP 5272336739). Datapolis is the controller of the data you give us to create and use your 2to2 account. In any matter concerning your personal data, write to office@datapolis.com.

If you use 2to2 in a workspace set up by your employer or another organisation, the content kept in that workspace is processed on behalf of that organisation, which decides what it is used for. For that content we act as a processor under our agreement with the organisation, and questions about it are best addressed to the organisation first.

What we collect

Your account. Your e-mail address, your name, the language you choose, and the workspaces and organisations you belong to together with your role in them. If you sign up with an e-mail address and a password, we keep the password only as a one-way hash; nobody at Datapolis can read it.

Sign in with Google. When you sign in or sign up with Google, Google sends us, with your permission, a signed token containing your Google account identifier, your e-mail address and whether Google has verified it, your name, and the address of your Google profile picture. We ask only for the basic openid, email and profile permissions. We never receive your Google password, and 2to2 has no access to your Gmail, Google Drive, Google Calendar, contacts or any other data in your Google account.

Sign in with Microsoft. In the same way, Microsoft sends us your Microsoft account identifier, e-mail address and name. Signing in gives 2to2 no access to your mailbox, OneDrive, calendar or other Microsoft 365 data.

What you keep in 2to2. Applications, workflows, forms, documents, files, records and messages that you or other members of your workspace create or upload, including any personal data they contain.

Billing. If you buy a paid plan: the billing name and address, tax identification number, the plan you bought and the invoices issued. Card payments are handled by Stripe; we do not receive or store your card number. To show prices in your currency, we derive your approximate country from your IP address.

Technical data. IP address, browser and device information and the time of each request, recorded in server logs. Your browser also keeps some 2to2 data in its local storage, such as your sign-in session and chosen language. 2to2 does not use advertising or analytics cookies.

AI features. When you use AI features, for example AI Creator or digital workers, the instructions and content you send to them are processed by the AI model provider chosen for your workspace: a model Datapolis provides through OpenRouter, or a provider your organisation connected with its own key (such as OpenAI, Anthropic, Google or DeepSeek).

Why we use it

To create and maintain your account, sign you in and provide the platform you use — performance of our contract with you (Art. 6(1)(b) GDPR).
To send account e-mails, such as the confirmation link you receive when you sign up — performance of the contract (Art. 6(1)(b) GDPR).
To charge for paid plans, issue invoices and keep accounting records — performance of the contract and our legal obligations (Art. 6(1)(b) and 6(1)(c) GDPR).
To keep 2to2 secure, prevent abuse and fix faults — our legitimate interest in a safe and reliable service (Art. 6(1)(f) GDPR).

We do not sell personal data, we do not use it for advertising, and we do not profile you or make automated decisions that have legal or similarly significant effects on you.

How we use data received from Google

We use the information we receive from Google only to create your 2to2 account, to sign you in, and to show your name and profile picture inside 2to2 — to you and to the people you work with in your workspaces. Your account is matched by your Google account identifier, not by your e-mail address.

We do not sell this information, do not use it for advertising, do not transfer it to anyone except the service providers listed below that run the platform for us, and do not use it to develop, improve or train artificial intelligence or machine learning models. 2to2’s use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements.

Where the data is kept and who processes it

The data is kept in the 2to2 database and file storage. Service providers that process it for us, each only to the extent needed for its task:

Railway — servers running the platform, its database and file storage.
Vercel Inc. — delivery of the 2to2 web application to your browser.
Stripe — card payments for paid plans.
Fakturownia — issuing invoices.
Our e-mail delivery provider — sending account e-mails.
AI model providers — only when AI features are used, as described above.
Google and Microsoft — confirming your identity when you choose to sign in with them.

Some of these providers are established outside the European Economic Area or process data there. Such transfers are based on the European Commission’s standard contractual clauses or another safeguard required by the GDPR.

How we protect it

Connections to 2to2 are encrypted (HTTPS). Passwords are stored only as one-way hashes. Every token from Google or Microsoft is checked against the provider’s signature before we accept it. Each organisation’s data is kept separate from that of other organisations, and access to production systems is limited to authorised Datapolis staff.

How long we keep it

We keep your account data, including the data received from Google or Microsoft, for as long as your account exists. When you ask us to delete your account, we delete it within 30 days, except for data we must keep by law — such as invoices, which we keep for the period required by Polish tax and accounting law. Content in an organisation’s workspace is kept for as long as the organisation’s agreement with us provides. Server logs are kept only as long as needed to keep the service secure.

Disconnecting Google and deleting your account

Disconnect Google: in 2to2, open Profile → Sign-in methods and remove Google. You can also remove 2to2’s access in your Google Account, at myaccount.google.com/connections.
Delete your account: write to office@datapolis.com from the e-mail address of your 2to2 account. We will confirm the request and delete the account, together with the data received from Google or Microsoft, within 30 days.

Your rights

You have the right to access your data and receive a copy, to have it corrected or erased, to restrict or object to its processing, and to receive it in a portable format. Write to office@datapolis.com.

If you believe we are handling your data improperly, you may lodge a complaint with the President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych), ul. Stawki 2, 00-193 Warsaw.

Changes to this policy

We will publish any changes on this page and update the date below.

Last updated: 9 November 2026