Terms of Service, Acceptable Use Policy and Privacy Notice

1. Identity of the contracting company

1.1. The online service marketed and made available under the name Evil Twin AI is operated by CONVRO LTD, a private company limited by shares incorporated in England and Wales under company number _currently_waiting_for_actual_number.

1.2. References in these Terms to "Convro", "Company", "Evil Twin AI", "Operator", "we", "us" or "our" refer to CONVRO LTD unless the context clearly requires otherwise.

1.3. Evil Twin AI is a trading brand, product and online service operated by the Company. Evil Twin AI is not a separate natural person or separate legal entity from the Company.

1.4. The Company's registered office is 71–75 Shelton Street
Covent Garden
London
WC2H 9JQ
United Kingdom.

1.5. General electronic correspondence relating to the Service may be sent to [email protected].

1.6. The Company may operate additional products, brands, websites, applications or services. Unless expressly stated otherwise, these Terms apply only to Evil Twin AI.

2. Legal framework and international scope

2.1. The Company is incorporated in England and Wales and these Terms are drafted principally by reference to the laws applicable to a United Kingdom company supplying an online digital service internationally.

2.2. Relevant United Kingdom legislation may include, according to the nature of the transaction and the status of the User, the Consumer Rights Act 2015, the Consumer Contracts (Information, Cancellation and Additional Charges) Regulations 2013, the Digital Markets, Competition and Consumers Act 2024 to the extent its relevant provisions are in force and applicable, the Companies Act 2006, the Contracts (Rights of Third Parties) Act 1999, the Unfair Contract Terms Act 1977 where applicable to business relationships, the Data Protection Act 2018, the UK GDPR, the Privacy and Electronic Communications Regulations 2003 and amendments made by the Data (Use and Access) Act 2025.

2.3. Users located outside the United Kingdom may additionally benefit from mandatory local law which applies notwithstanding a contractual choice of English law.

2.4. In particular, Consumers in the European Economic Area may have rights arising under national legislation implementing European Union consumer law, including Directive 2011/83/EU on consumer rights and Directive (EU) 2019/770 on certain aspects concerning contracts for the supply of digital content and digital services.

2.5. Where the EU GDPR applies to processing involving an individual in the European Economic Area, the Company will process personal data subject to that regime in addition to its obligations under applicable United Kingdom data protection law.

2.6. The Company does not represent that the Service is lawfully available in every country or territory. Availability may depend on local law, sanctions, export controls, payment infrastructure, Provider restrictions and other regulatory considerations.

2.7. A User is responsible for determining whether use of the Service is lawful in the User's jurisdiction except to the extent applicable law places that responsibility on the Company.

3. Definitions and interpretation

3.1. In these Terms:

Account means an Evil Twin AI user account.

AI Output means text, code, analysis, suggestions, summaries, structured data or other machine-generated material returned through the Service.

Business User means a User acting wholly or mainly for purposes relating to that User's trade, business, craft or profession.

Consumer means an individual acting wholly or mainly outside that individual's trade, business, craft or profession.

Conversation Content means prompts, messages, supported attachments, AI Outputs, thread information, chat titles and associated conversation data.

Evil Twin ID means the Account identifier created from a username selected by a User together with an automatically generated suffix, for example username#ABCD1234.

Merchant of Record means a payment or commerce provider which is identified at checkout as the legal seller of record for the relevant transaction.

Plan means a paid Basic, Pro or other subscription or usage product displayed at checkout.

Provider means a third party supplying infrastructure, hosting, network, security, payment, tax-processing, model-inference or other functionality used in connection with the Service.

Service means Evil Twin AI and its relevant website, authenticated application, Account functionality, subscription functionality, AI chat interface, model-routing infrastructure and associated online functionality.

User means a natural person or legal entity accessing or using the Service.

3.2. Headings are for convenience and do not affect interpretation.

3.3. Words in the singular include the plural and vice versa where the context requires.

3.4. References to legislation include amendments, replacements and subordinate legislation applicable from time to time.

3.5. The words "including", "includes" and similar terms are illustrative and do not limit the generality of the preceding wording.

4. Nature and scope of the Service

4.1. Evil Twin AI is an internet-based artificial-intelligence interaction service.

4.2. The Service may include an Account system, authentication, conversation history, AI inference, model routing, paid subscription functionality, message allowances, account controls, subscription controls and related functionality.

4.3. The Service may rely on software, infrastructure and AI systems supplied by one or more external Providers.

4.4. The Company may determine which Provider, model, model version, inference route or technical architecture is used to fulfil a request unless a particular component is expressly guaranteed as a material characteristic of a Plan at checkout.

4.5. The Service is continually developed. Features may be introduced, modified, deprecated or replaced in accordance with these Terms and applicable mandatory law.

5. Contract formation

5.1. A contract for use of free Account functionality is formed when a User successfully creates an Account and accepts these Terms.

5.2. A contract relating to a paid Plan is formed when the applicable checkout process is completed, payment is successfully authorised or captured as applicable, and the purchase is accepted by the relevant seller.

5.3. Where a Merchant of Record is identified at checkout, the transaction may also create a separate contractual relationship between the User and that Merchant of Record concerning payment processing, tax, receipts, refund administration and related transaction matters.

5.4. The Company may refuse an attempted order before acceptance where reasonably necessary because of suspected fraud, sanctions, service availability, payment failure, legal restrictions, technical problems or Provider requirements.

5.5. Information displayed directly at checkout concerning price, billing frequency, Plan characteristics and usage allowance forms part of the purchase information.

5.6. Where there is an irreconcilable inconsistency between these general Terms and specific information clearly displayed at checkout for a particular Plan, the specific checkout information prevails for that purchase, subject always to mandatory law.

6. Electronic contracting

6.1. The parties agree that contracts relating to the Service may be formed electronically.

6.2. Electronic acceptance, button confirmation, checkbox confirmation, payment confirmation, Account creation and other electronic actions may be used as evidence of acceptance to the extent permitted by law.

6.3. The Company may retain records showing the version of the Terms accepted, the time of acceptance, transaction identifiers and other information reasonably required to evidence the contractual relationship.

6.4. The Terms are made available in a format capable of being stored or reproduced using ordinary browser functionality.

7. Eligibility and minimum age

7.1. The Service is intended exclusively for persons aged 18 years or older.

7.2. By creating an Account, purchasing a Plan or using authenticated functionality, a User represents and warrants that the User is at least 18 years old and has legal capacity to enter into the relevant agreement.

7.3. Where a person uses the Service on behalf of a company, partnership, organisation or other legal entity, that person represents that the person has authority to bind that entity.

7.4. The Company may request reasonable evidence of eligibility where legally necessary or reasonably required to investigate suspected abuse.

8. Account registration and identity model

8.1. A standard Evil Twin AI Account does not require the User to provide an email address unless the registration interface expressly states otherwise.

8.2. Registration requires creation of a username and password.

8.3. Following registration, the Service creates an Evil Twin ID which is used as an Account identifier.

8.4. Passwords are not intended to be stored in plaintext. Authentication information is stored using one-way password hashing appropriate to the Service's authentication architecture.

8.5. Unless expressly introduced in the future, Evil Twin AI does not require Google, Apple, Facebook or other social-login authentication for a standard Account.

8.6. A User must provide accurate information where the Service specifically requests information for a legal, payment, security or contractual purpose.

8.7. A User must not impersonate another person or organisation, unlawfully appropriate another person's identifier or falsely claim legal authority.

9. Credential responsibility and Account recovery

9.1. Users are responsible for maintaining the confidentiality and security of their passwords, Evil Twin IDs and devices.

9.2. Because the standard Account model may intentionally omit conventional identity information such as an email address, loss of credentials may make recovery difficult or impossible.

9.3. The Company is not required to restore access where it cannot reasonably verify that a recovery requester is entitled to control the Account.

9.4. Any recovery mechanism expressly supplied by the Service is subject to its own security requirements.

9.5. Users must notify the Company without undue delay if they reasonably believe an Account has been compromised.

10. Technical requirements

10.1. The Service requires a functioning internet connection, compatible hardware, JavaScript, TLS support and browser storage technologies necessary for authentication and session continuity.

10.2. The User bears ordinary costs relating to internet connectivity and compatible hardware.

10.3. The Company may impose minimum browser, device, application or security requirements reasonably necessary for the Service.

10.4. Failure of a User's device, browser, network, firewall, content blocker or other local environment does not by itself establish a defect in the Service.

11. Artificial intelligence and probabilistic output

11.1. Users acknowledge that AI systems generate responses probabilistically.

11.2. AI Output may be incorrect, incomplete, fabricated, inconsistent, outdated, offensive, biased, unsafe, legally unsuitable or otherwise unreliable.

11.3. Apparent certainty, confidence, detail or citation by an AI system does not establish factual correctness.

11.4. Users must apply independent judgement and appropriate verification before relying on an AI Output where accuracy, legality, financial consequence, physical safety or another material interest is involved.

11.5. The Company does not represent that every AI Output reflects the views, opinions or policies of the Company.

12. No professional relationship

12.1. Unless expressly agreed in a separate written instrument executed by the Company, use of Evil Twin AI does not establish a solicitor-client, doctor-patient, accountant-client, fiduciary, investment-advisory, engineering-consultancy or other regulated professional relationship.

12.2. AI Output concerning legal, medical, tax, investment, accounting, engineering, cybersecurity or other specialist matters is informational machine-generated material and not a substitute for professional advice where professional advice is required.

12.3. The Service is not an emergency service.

12.4. Users must not rely on the Service where delay, interruption or error could itself create an immediate serious risk to life or physical safety.

13. Promotional language and brand character

13.1. Evil Twin AI intentionally uses provocative, unconventional, satirical or exaggerated branding.

13.2. Marketing expressions including "uncensored", "no filters", "no refusals", "unrestricted", "anything", "evil", "forbidden", "sketchy" and similar language describe the intended positioning and conversational style of the product.

13.3. Such expressions must not be interpreted as an absolute representation that every conceivable prompt will receive every conceivable form of answer.

13.4. Promotional branding does not override law, Provider restrictions, security controls or these Terms.

13.5. Fictional crime imagery, humour, satire and promotional statements do not constitute an offer, invitation, authorisation or encouragement to commit an unlawful act.

14. Refusals and restrictions

14.1. The Service may refuse, redirect, truncate, filter, block, delay, rate-limit or otherwise restrict a request or AI Output.

14.2. Such action may arise from law, sanctions, security controls, abuse prevention, Provider requirements, intellectual-property concerns, privacy considerations, automated classification, fraud prevention, technical limitations, capacity limitations or other legitimate operational reasons.

14.3. Purchase of a Plan does not create a contractual guarantee that a particular prompt will receive a particular answer.

14.4. The Company may modify the technical means by which requests are routed or moderated where reasonably necessary to continue operating the Service.

15. User responsibility for instructions and downstream use

15.1. The User is responsible for prompts, instructions, submitted content, decisions taken using AI Output and downstream use of AI Output.

15.2. The User must obtain any consent, permission, licence or other authority required before submitting third-party personal information, confidential material, copyrighted content, trade secrets or protected information.

15.3. A User who deploys generated code, commands, financial calculations, legal language, system configurations or other potentially consequential material is responsible for conducting appropriate review and testing.

15.4. The Company is not responsible for an unlawful or negligent act by a User merely because an AI Output formed part of the User's decision-making process, subject to liabilities which applicable law does not permit the Company to exclude.

16. Acceptable Use Policy

16.1. The Service must not be used to commit, procure, materially facilitate, organise or conceal unlawful conduct.

• credible targeted threats, terrorism, murder, kidnapping, assault or other unlawful physical violence;
• unlawful manufacture, procurement, acquisition or deployment of weapons, explosives, incendiary devices, toxic agents, chemical agents, biological agents or poisons;
• unauthorised system intrusion, credential theft, malicious phishing, malware deployment, ransomware, botnet activity, destructive exploitation, unlawful data exfiltration or denial-of-service attacks;
• fraud, scams, payment-card fraud, forged identity documents, deceptive impersonation for unlawful gain, laundering of criminal proceeds, sanctions evasion or deliberate tax evasion;
• unlawful manufacture, trafficking or distribution of controlled substances;
• sexual exploitation, trafficking, grooming, sexual abuse or sexual content involving minors;
• stalking, identity theft, unlawful surveillance, unlawful interception, doxxing or unauthorised disclosure of private information;
• concealing or assisting continuation of active criminal conduct for the purpose of defeating lawful investigation or enforcement;
• fraudulent advertising, deceptive mass outreach, unlawful direct marketing or spam;
• knowing unlawful infringement of copyright, trademarks, trade secrets or other intellectual-property rights;
• automated decision-making or prohibited processing in violation of applicable employment, housing, credit, insurance, biometric, equality, AI or data-protection law;
• conduct prohibited by applicable sanctions, export-control requirements or a binding order of a competent authority;
• any other use which is itself unlawful in the relevant circumstances.

16.2. Sensitive subject matter is not prohibited merely because it is sensitive.

16.3. Lawful journalism, fiction, historical analysis, academic discussion, defensive cybersecurity, compliance work, safety research and legitimate analysis may concern topics which would be unlawful if carried out for a different purpose.

16.4. Context, intent and reasonably apparent downstream use may therefore be considered when technical restrictions are applied.

17. Attempts to evade Service controls

17.1. Repeated attempts to defeat security or abuse controls through prompt fragmentation, obfuscation, encoding, proxy Accounts, automated Account creation, prompt injection or comparable techniques may result in temporary or permanent restrictions.

17.2. The Company may use automated systems to detect suspicious patterns.

17.3. The Company is not obliged to disclose technical details which would materially facilitate circumvention of security or abuse controls.

18. Intellectual property belonging to the User

18.1. As between the User and the Company, the User retains ownership of rights the User lawfully possesses in material submitted to the Service.

18.2. Submission of material does not transfer ownership merely by reason of submission.

18.3. The User grants the Company a worldwide, non-exclusive, royalty-free and limited licence to host, reproduce, transmit, transform and process submitted material solely to the extent reasonably necessary to provide, maintain, secure, troubleshoot and lawfully operate the Service.

18.4. The User represents that the User possesses any rights or permissions reasonably necessary to submit the relevant material.

19. AI Output and intellectual-property rights

19.1. Subject to mandatory law and third-party rights, the Company does not claim ownership of AI Output merely because the Output was generated for a User.

19.2. The Company does not promise exclusivity.

19.3. Similar or identical Outputs may be generated independently for other Users.

19.4. The existence and scope of copyright, database rights, patent rights or other protection in machine-generated content varies between jurisdictions.

19.5. The Company does not warrant that AI Output is unique, non-infringing, registrable, patentable or suitable for trademark registration.

20. Intellectual property in Evil Twin AI

20.1. Rights in the Evil Twin AI brand, software, interfaces, original artwork, design, documentation, databases and other proprietary Service materials are owned by or lawfully licensed to the Company.

20.2. No provision of these Terms transfers ownership of the Company's intellectual property to a User.

20.3. Except where law expressly permits otherwise, Users must not reproduce, sell, commercially sublicense, scrape, decompile, reverse engineer or create confusingly similar branding from protected Service materials.

21. Plans, prices and included usage

21.1. The table above describes the standard Plans at the effective date of these Terms.

21.2. The price and material characteristics displayed at checkout control for a specific transaction.

21.3. Prices may include or exclude indirect tax according to the checkout, customer location, Merchant of Record arrangement and applicable law.

21.4. Promotional pricing, credits or other offers may be subject to additional conditions clearly disclosed with the offer.

21.5. No free trial is provided unless a particular offer expressly states otherwise.

22. Usage accounting

22.1. Message usage is measured by the Service's internal usage-accounting system.

22.2. Failed generations, Provider failures, duplicate submissions, retries, technical errors, promotional corrections or fraud-prevention events may cause usage records to be adjusted.

22.3. The Company may restore or disregard usage reasonably determined to have been consumed because of a technical failure.

22.4. The Company will not use usage-adjustment mechanisms to arbitrarily reduce the core allowance purchased by a User.

22.5. Unused monthly message allowance expires at the end of the relevant billing period.

22.6. Unused allowance is not money, electronic money, stored value or a financial instrument and has no cash-redemption value.

23. Recurring subscriptions

23.1. Basic and Pro are recurring monthly subscriptions unless checkout expressly states otherwise.

23.2. The applicable payment method may be charged automatically for successive billing periods until renewal is cancelled.

23.3. Cancellation of renewal ordinarily takes effect at the end of the already-paid billing period.

23.4. A User who cancels renewal ordinarily retains access for the remainder of the period already purchased unless the Account is separately terminated for a breach or applicable law requires another result.

23.5. Cancellation of future renewal is not the same legal act as exercising a statutory cooling-off or withdrawal right in relation to a particular transaction.

23.6. Where new United Kingdom statutory rules concerning subscription contracts become applicable to the Service, including applicable provisions of the Digital Markets, Competition and Consumers Act 2024 and implementing regulations, the Company will provide notices, cancellation rights and renewal procedures required by those rules.

24. Payment processing and Merchant of Record arrangements

24.1. Checkout may use Stripe, Link, Stripe Managed Payments or another authorised payment product.

24.2. The legal seller for a particular payment is the entity identified at checkout.

24.3. Where Stripe, Link or another Provider acts as Merchant of Record, that Provider may be responsible for collecting the transaction price from the User, issuing transaction receipts, administering applicable indirect taxes, processing refunds and managing certain payment disputes.

24.4. Where CONVRO LTD is identified as seller, the Company is seller for that transaction.

24.5. A Merchant of Record arrangement does not make that Provider the operator of Evil Twin AI and does not transfer responsibility for operation of the underlying product except to the extent expressly provided in the applicable payment arrangement.

24.6. Merchant of Record terms may apply in parallel with these Terms in relation to payment-specific matters.

25. Payment information and taxation

25.1. Evil Twin AI does not store full payment-card numbers or card security codes in its ordinary application database.

25.2. Payment information may be entered directly into infrastructure operated by Stripe, Link or another payment Provider.

25.3. The Company may receive transaction identifiers, subscription identifiers, payment status, Plan information and other limited metadata necessary to administer access.

25.4. Where a Merchant of Record service provides indirect-tax administration, the Merchant of Record may calculate, collect, report and remit applicable VAT, GST, sales tax or similar taxes.

25.5. A User remains responsible for taxes which applicable law places directly on that User and which are not collected by the seller or Merchant of Record.

26. Immediate activation and provisioning

26.1. Paid access is designed to begin immediately following successful payment confirmation rather than after expiration of a cooling-off period.

26.2. Successful purchase may immediately cause a sequence of automated and third-party operations including:

• creation or alteration of subscription records;
• activation of paid Account entitlements;
• allocation of message allowance;
• creation of payment and Merchant of Record records;
• fraud and risk screening;
• reservation or allocation of infrastructure capacity;
• allocation of AI inference capacity;
• activation of Provider-side services;
• creation of billing and tax records;
• payment-processing operations and associated Provider charges;
• other technical operations required to place the Plan into an immediately usable state.

26.3. A material part of these operations is performed automatically and may result in costs, liabilities or Provider charges becoming irrevocably incurred by the Company or the applicable Merchant of Record at or shortly after successful activation.

26.4. Cancellation by a User after activation does not necessarily reverse, cancel or refund costs already incurred by the Company in provisioning the Plan.

26.5. The fact that the User subsequently changes their mind does not itself cause upstream infrastructure, inference, processing or transaction charges already incurred by the Company to cease to exist.

26.6. This commercial reality forms part of the basis for the Company's ordinary policy that successfully activated subscription periods are non-refundable except where these Terms, the Merchant of Record or mandatory law provide otherwise.

27. Express request for immediate performance

27.1. Where applicable consumer law provides a statutory cancellation or withdrawal period, the Company may ask the Consumer to make an express request for the Service to begin during that period.

27.2. Where the legal classification of a supplied component requires an acknowledgement concerning loss or limitation of a statutory cancellation right, the Company may require the legally prescribed acknowledgement before that component is supplied.

27.3. The Company intends the relevant checkout to obtain affirmative consent rather than relying solely on passive acceptance of these Terms.

27.4. Where appropriate to the applicable transaction and law, the checkout acknowledgement may substantially state:

I expressly request and consent to immediate activation and performance of the paid Service before the expiry of any statutory cancellation or withdrawal period that may apply. I understand that performance and digital supply may begin immediately following successful payment. I acknowledge that, depending on the legal classification of the supplied component and the law applicable to me, beginning or completion of performance may result in loss of a cancellation right or an obligation to pay for the proportion of the Service already supplied.

27.5. The exact checkout language may be adapted where reasonably necessary to comply with the mandatory law applicable to the transaction.

27.6. Nothing in this section is intended to create a loss of statutory rights in circumstances in which applicable law does not permit those rights to be lost.

28. Provisioning values and non-recoverable costs

28.1. For commercial transparency, the current Plan structure attributes a substantial proportion of the purchase price to immediate activation, provisioning, Provider access, infrastructure availability and related performance supplied upon or immediately following successful purchase.

28.2. These figures reflect the Company's current commercial allocation of the value and cost associated with immediate activation and provisioning of the relevant Plan.

28.3. They may reflect, amongst other things, infrastructure reservation, Provider availability, inference-related commitments, payment-processing activity, fraud-prevention activity and technical provisioning.

28.4. These amounts are not described as a contractual penalty.

28.5. They are not liquidated damages payable merely because a User elects to cancel.

28.6. They do not automatically override any statutory right of cancellation, refund, price reduction or other mandatory consumer remedy.

28.7. Where mandatory law requires any amount retained following statutory withdrawal to correspond proportionately to performance actually supplied, the Company or Merchant of Record will retain only the amount legally permissible under that rule.

28.8. Where applicable law permits loss of the withdrawal right following supply of a relevant digital component after the Consumer's prior express consent and acknowledgement, the Company may rely on that rule where all conditions required by law have been satisfied.

29. Ordinary refund policy

29.1. Subject to sections 30 to 33 and mandatory law, successfully activated subscription periods are final and non-refundable.

29.2. A User is not entitled to a refund merely because the User:

• changed their mind after purchasing;
• did not use all available message allowance;
• did not use the Service at all after activation;
• forgot to cancel automatic renewal before the renewal occurred;
• disagreed with a particular AI Output;
• encountered a lawful refusal or restriction contemplated by these Terms;
• expected a particular upstream model which was not expressly guaranteed at checkout;
• deleted the Account after purchase.

29.3. Nothing in section 29.2 applies where mandatory consumer law gives the User a right to a refund or other remedy in the circumstances.

29.4. The Company may nevertheless grant discretionary refunds or credits on a case-by-case basis without creating an obligation to grant the same remedy in other cases.

30. United Kingdom statutory cancellation rights

30.1. Where a Consumer Contracts Regulations 2013 cancellation right applies, the Consumer may have a statutory period within which the Consumer may cancel a distance contract.

30.2. The effect of beginning supply during that period depends on the legal classification of what is supplied and whether the legally required information, request, consent and acknowledgement have been obtained.

30.3. In the case of a service which begins during the statutory cancellation period at the Consumer's express request, applicable law may require the Consumer to pay an amount proportionate to what has been supplied before the Consumer communicates cancellation.

30.4. Where a relevant service has been fully performed and all statutory conditions for loss of cancellation rights have been satisfied, the statutory right may cease where applicable law so provides.

30.5. In relation to qualifying digital content not supplied on a tangible medium, applicable law may provide for loss of the cancellation right once supply begins where the Consumer has given prior express consent and the required acknowledgement.

30.6. If the Company or Merchant of Record has not satisfied a legal precondition required to impose a charge during the statutory cancellation period, the User will not be charged merely because these Terms state a commercial non-refund policy.

31. European Economic Area consumer withdrawal rights

31.1. Consumers habitually resident in the European Economic Area may have withdrawal rights under national law implementing Directive 2011/83/EU and related legislation.

31.2. Those rules may distinguish between services, digital services and digital content.

31.3. The Company will not rely on contractual terminology to remove a mandatory withdrawal right which the law governing the Consumer's transaction does not permit to be removed.

31.4. Where local law allows immediate performance following an express request and permits proportionate payment for performance supplied before withdrawal, the Company or Merchant of Record may rely on those provisions.

31.5. Where local law permits loss of a withdrawal right following commencement of supply of digital content after prior express consent and acknowledgement, the Company or Merchant of Record may rely on that exception when all statutory requirements are fulfilled.

32. Statutory conformity and defective Service remedies

32.1. The ordinary non-refund policy does not prevent a Consumer from invoking mandatory remedies where the paid digital service itself fails to conform to the contract.

32.2. Under applicable consumer law, potential remedies may include repeat performance, restoration of conformity, repair, price reduction, termination or refund depending on the nature and seriousness of the failure.

32.3. A factual inaccuracy in an individual AI-generated response does not automatically mean that the underlying digital Service is legally non-conforming, particularly where these Terms expressly disclose the probabilistic nature and limitations of AI Output.

32.4. This section does not limit rights which the Consumer Rights Act 2015 or another mandatory law gives to a Consumer.

33. Cancellation form for statutory withdrawal

33.1. Where a statutory right of cancellation exists, a Consumer may exercise it by any clear statement which applicable law recognises as sufficient.

33.2. Where applicable, the following model may be used for convenience:

33.3. Use of this exact format is not mandatory where applicable law permits a Consumer to cancel by another clear statement.

34. Subscription cancellation

34.1. A User may cancel future renewal using the subscription-management functionality made available for the relevant subscription.

34.2. Cancellation should be completed before the next renewal transaction if the User does not wish to incur that renewal.

34.3. Cancellation of renewal ordinarily does not reverse the current paid period.

34.4. The Service may provide a cancellation confirmation or the applicable payment Provider may provide such confirmation.

34.5. Where mandatory subscription legislation imposes additional reminder, renewal, cooling-off or cancellation requirements, those requirements prevail.

35. Account deletion is different from billing cancellation

35.1. Deleting an Evil Twin AI Account does not necessarily cancel a subscription held within an independent payment or Merchant of Record system.

35.2. Users wishing both to terminate Account data and prevent future renewal should complete both processes where the interfaces treat them separately.

35.3. Account deletion does not reverse transactions already completed.

35.4. Account deletion does not itself create a right to reimbursement.

36. Failed payments

36.1. If a recurring payment fails, paid access may be suspended, downgraded or terminated.

36.2. Stripe, Link or another payment Provider may retry failed payments where permitted by its terms and applicable law.

36.3. The Company is not required to continue supplying paid functionality while the applicable subscription fee remains unpaid.

37. Chargebacks and payment disputes

37.1. Nothing in these Terms prevents a User from making a legitimate payment dispute or exercising a lawful chargeback right.

37.2. Knowingly false, fraudulent or abusive payment disputes may constitute a material breach of these Terms.

37.3. The Company may provide transaction records, acceptance records, usage records and other relevant evidence to a Merchant of Record, bank or payment network in response to a payment dispute.

37.4. Accounts associated with fraudulent payment activity may be suspended or terminated.

38. Changes to prices

38.1. The Company may change prices for future purchases or future renewal periods.

38.2. A price increase does not retroactively increase the price of a billing period already purchased.

38.3. Where mandatory law requires advance notice before a recurring subscription price increase, the required notice will be provided.

38.4. Continued renewal after a validly notified price change may constitute acceptance where applicable law permits that mechanism.

39. Service modifications

39.1. The Company may modify the Service for legitimate reasons including security, improvement, Provider changes, legal compliance, interoperability, cost management, model availability and technical development.

39.2. Changes may include replacement of models, infrastructure, interfaces, routing mechanisms, abuse controls and usage-accounting implementation.

39.3. The Company will not rely on this clause to remove the essential character of an already purchased Plan where doing so would violate mandatory consumer law.

39.4. Material changes to an ongoing Consumer digital service will be handled in accordance with applicable mandatory rules.

40. Availability and maintenance

40.1. The Service may occasionally be unavailable because of maintenance, Provider outages, software failures, network failures, cybersecurity events, capacity constraints or events outside the Company's reasonable control.

40.2. The Company may conduct emergency maintenance without advance notice.

40.3. Where reasonably practicable, planned material maintenance may be scheduled to reduce disruption.

40.4. No service-level agreement applies unless separately agreed in writing.

41. Third-party dependencies

41.1. Evil Twin AI relies on third-party infrastructure which is not completely controlled by the Company.

41.2. Provider policy changes, API limits, service interruptions, pricing changes, regional restrictions or capacity shortages may affect operation.

41.3. The Company may substitute Providers without the User's consent where the substitution does not unlawfully reduce the contracted Service.

41.4. A User has no contractual entitlement to a specific upstream provider unless the applicable purchase expressly states otherwise.

42. Suspension

42.1. The Company may temporarily suspend access where reasonably necessary to:

• investigate suspected compromise;
• prevent fraud;
• protect the Service or other Users;
• comply with law or a binding order;
• address sanctions restrictions;
• stop prohibited use;
• respond to material payment abuse;
• perform urgent security action.

42.2. Where reasonably practicable and legally appropriate, the Company may notify the User of the reason for suspension.

43. Termination by the Company

43.1. The Company may terminate an Account for material or repeated breach of these Terms.

43.2. Immediate termination may occur where continued access would create a material legal, security, fraud or abuse risk.

43.3. Termination for User misconduct does not automatically create a refund right for a validly supplied paid period.

43.4. Mandatory Consumer rights remain unaffected.

44. Termination by the User

44.1. A User may stop using the Service at any time.

44.2. A User may delete the Account using available controls.

44.3. Stopping use or deleting an Account does not itself unwind contractual obligations or payment transactions already validly incurred.

45. Sanctions and export controls

45.1. The Service may not be supplied where doing so would cause the Company or a Provider to violate applicable sanctions, trade restrictions or export controls.

45.2. The Company may restrict transactions, territories or Accounts where reasonably necessary to comply with those requirements.

45.3. Users must not knowingly use the Service to circumvent a legally binding sanctions or export-control restriction.

46. Representations by the User

46.1. The User represents that:

• the User has capacity to accept these Terms;
• information supplied for a legal or payment purpose is materially accurate;
• the User will not intentionally use the Service in violation of section 16;
• the User has necessary rights in material submitted to the Service.

47. Warranties and statutory guarantees

47.1. To the maximum extent permitted by law, the Service is provided without any representation that every AI Output will be accurate, complete, current, unique or suitable for a particular purpose.

47.2. The Company does not warrant that the Service will answer every prompt.

47.3. The Company does not warrant that a particular Provider or model will remain available indefinitely.

47.4. Nothing in this section excludes any warranty, statutory term or guarantee which applicable law implies and does not permit the parties to exclude.

48. Consumer liability provisions

48.1. Nothing in these Terms excludes or limits liability for death or personal injury caused by negligence where such exclusion is prohibited.

48.2. Nothing excludes liability for fraud or fraudulent misrepresentation.

48.3. Nothing excludes liability which mandatory consumer law prohibits the Company from excluding.

48.4. Consumer liability is therefore subject to the mandatory law applicable to the relevant Consumer.

49. Business User limitation of liability

49.1. This section applies only to Business Users.

49.2. Subject to section 48 and to the maximum extent permitted by law, the Company is not liable to a Business User for:

• loss of profit;
• loss of revenue;
• loss of business;
• loss of anticipated savings;
• loss of opportunity;
• loss of goodwill;
• indirect or consequential loss.

49.3. Subject to section 48, aggregate contractual liability to a Business User arising out of the Service during any rolling 12-month period is limited to the fees actually paid by that Business User for the Service during the preceding 12 months.

49.4. The limitations in this section apply only insofar as they satisfy any reasonableness or other mandatory requirements imposed by applicable law, including the Unfair Contract Terms Act 1977 where applicable.

50. Business User indemnity

50.1. This section applies only to Business Users.

50.2. To the maximum extent permitted by law, a Business User will indemnify the Company against third-party claims and reasonable direct costs arising from:

• the Business User's unlawful submitted material;
• knowing unlawful use of the Service;
• material infringement of third-party rights by content supplied by that Business User;
• material breach of section 16.

50.3. This indemnity does not apply to the extent a claim results from the Company's own unlawful conduct or liability which cannot lawfully be transferred.

51. Force majeure

51.1. To the extent permitted by law, the Company is not liable for delay or failure caused by circumstances outside its reasonable control.

51.2. Such circumstances may include major internet outages, war, civil disorder, natural disasters, governmental action, Provider outages, cybersecurity incidents, power failures and failure of telecommunications infrastructure.

51.3. This provision does not eliminate mandatory remedies where applicable law provides otherwise.

52. Complaints

52.1. Complaints concerning Account access, billing, subscription functionality, privacy or Service conformity may be submitted to [email protected].

52.2. A complaint should include information reasonably sufficient to identify the relevant Account or transaction.

52.3. The Company may request additional information reasonably necessary to investigate.

52.4. Complaints will be handled without undue delay and within any applicable mandatory statutory time limit.

53. Governing law

53.1. These Terms and any non-contractual obligations arising out of or in connection with them are governed by the law of England and Wales.

53.2. This choice of law does not deprive a Consumer of mandatory protections which apply to the Consumer under the law of the country of habitual residence where applicable conflict-of-laws rules prohibit such deprivation.

53.3. The parties intend the choice of English law to apply to the maximum extent legally permissible.

54. Courts and dispute jurisdiction

54.1. A Consumer may bring proceedings in any court which applicable mandatory jurisdiction rules make available to that Consumer.

54.2. Nothing in these Terms requires a Consumer to waive a mandatory right to bring proceedings in the Consumer's home jurisdiction.

54.3. Business Users agree, to the maximum extent permitted by law, that the courts of England and Wales have exclusive jurisdiction over disputes arising out of or connected with the Service or these Terms.

55. No waiver

55.1. Failure or delay by the Company in exercising a contractual right does not permanently waive that right.

55.2. A waiver concerning one breach does not constitute a waiver concerning a later breach.

56. Severability

56.1. If any provision is found invalid, unlawful or unenforceable, that provision is to be interpreted or reduced to the minimum extent necessary to make it enforceable where law permits.

56.2. If such interpretation is not possible, the affected provision is severed and the remaining Terms continue in effect.

57. Assignment and corporate reorganisation

57.1. The User may not assign an Account or contractual rights without the Company's prior written consent where such restriction is lawful.

57.2. The Company may assign or transfer its contractual rights and obligations in connection with a merger, group reorganisation, financing, acquisition or sale of all or substantially all of the relevant business, subject to applicable law.

57.3. No transfer may lawfully remove mandatory Consumer rights.

58. No partnership or agency

58.1. Nothing in these Terms creates a partnership, joint venture, employment relationship or fiduciary relationship between the Company and a User.

58.2. A User has no authority to bind the Company.

59. Third-party rights

59.1. Except where expressly stated otherwise, a person who is not a party to the agreement has no right under the Contracts (Rights of Third Parties) Act 1999 to enforce these Terms.

59.2. This does not affect any right or remedy independently available to a third party.

60. Changes to these Terms

60.1. The Company may amend these Terms for legitimate reasons including changes in law, Providers, billing systems, product functionality, security or business operations.

60.2. A material change affecting an ongoing paid Consumer relationship will be notified where and to the extent required by applicable law.

60.3. Updated Terms apply prospectively from the stated effective date unless law requires otherwise.

61. Language

61.1. The authoritative version of these Terms is drafted in English.

61.2. A translation may be provided for convenience.

61.3. Where legally permissible, the English version prevails in the event of an inconsistency between translations.

62. Entire agreement

62.1. These Terms together with information incorporated through the relevant checkout constitute the agreement concerning the Service.

62.2. They do not supersede a separate written agreement expressly executed by the Company and a particular User.

62.3. Mandatory statutory terms remain incorporated where applicable whether or not reproduced in this document.

63. Privacy Notice and identity of the controller

63.1. This Privacy Notice explains the Company's processing of personal data in connection with Evil Twin AI.

63.2. For processing for which the Company determines purposes and means, CONVRO LTD, company number _currently_waiting_for_actual_number, acts as controller.

63.3. The controller's registered office is: 71–75 Shelton Street
Covent Garden
London
WC2H 9JQ
United Kingdom.

63.4. Privacy requests may be sent to [email protected].

63.5. Depending on the circumstances, Providers may act as processors, sub-processors, independent controllers or separate service providers.

64. Applicable data-protection regimes

64.1. The Company's United Kingdom processing is subject, where applicable, to the UK GDPR, Data Protection Act 2018, Privacy and Electronic Communications Regulations 2003 and relevant amendments introduced by the Data (Use and Access) Act 2025.

64.2. Where the territorial scope of Regulation (EU) 2016/679 applies, the Company will also process relevant personal data in accordance with the EU GDPR.

64.3. Other national privacy legislation may apply to Users in other jurisdictions.

65. Data-minimisation model

65.1. Evil Twin AI is deliberately designed to minimise conventional identity information required for ordinary Account creation.

65.2. A standard Account does not require a real name, postal address, Google account, social-media identity or email address unless the Service expressly states otherwise.

65.3. This design does not mean that no personal data is processed.

65.4. Conversation data, authentication information, technical logs, usage records, support information and limited payment metadata may still constitute personal data.

66. Categories of data processed

67. Sources of personal data

67.1. Personal data may be collected directly from the User.

67.2. Technical information may be generated automatically when a User interacts with the Service.

67.3. Subscription and payment metadata may be received from Stripe, Link or another Provider.

67.4. Security information may be generated by Cloudflare, hosting infrastructure or other security systems.

68. Purposes and lawful bases

69. Legitimate interests

69.1. Where the Company relies on legitimate interests, those interests may include maintaining Service security, protecting Accounts, preventing fraud, preventing abuse, investigating technical failures, defending legal claims and operating reliable infrastructure.

69.2. Reliance on legitimate interests is subject to applicable balancing and necessity requirements.

70. Special-category and sensitive personal information

70.1. The Service does not require special-category personal information for ordinary Account creation.

70.2. Users may nevertheless voluntarily include sensitive information in Conversation Content.

70.3. Users should not submit information they are not comfortable transmitting to the systems and Providers technically required to generate an AI response.

70.4. Where applicable data-protection law requires an additional condition for processing particular categories of information, the Company will rely on such a condition only where legally available.

71. Conversation processing

71.1. Conversation Content is processed to generate responses and provide chat history.

71.2. Prompt content must ordinarily be transmitted to an AI inference Provider or equivalent inference system in order to generate a response.

71.3. Depending on architecture, different requests may be routed to different Providers.

71.4. The Company does not promise that all conversations are processed by one particular upstream AI model or infrastructure provider.

72. Conversation history

72.1. Conversation Content is stored in the Company's primary application database to provide chat-history functionality.

72.2. Users may delete individual chats using available controls.

72.3. Where a chat is deleted using that functionality, it is removed from the primary application database rather than intentionally preserved in a user-accessible soft-delete archive.

72.4. Under the current production architecture described in this Notice, the Company does not maintain a separate long-term backup copy of deleted conversation history.

73. Administrative access to Conversation Content

73.1. Authorised technical administration may make it technically possible for authorised personnel to access stored Conversation Content.

73.2. Such access may occur where reasonably necessary for security, troubleshooting, service operation, support expressly requested by a User, fraud investigation or legal compliance.

73.3. The Company does not routinely inspect conversations for advertising profiling or personal curiosity.

74. IP addresses and technical logs

74.1. Evil Twin AI does not intentionally maintain an application-level historical IP-address profile attached to the Evil Twin ID.

74.2. Infrastructure and web-server logs may contain IP addresses as an ordinary consequence of internet communication and server security.

74.3. The Company's own server-side access logs containing network addresses are retained for up to 3 days under the current production configuration and are subsequently removed through log rotation.

74.4. Providers including Cloudflare, OVHcloud and Stripe may independently process network identifiers under their own systems and retention policies.

74.5. The Company does not use these network addresses for third-party behavioural advertising.

75. Payment privacy

75.1. The Evil Twin AI application does not store full card numbers or card verification values.

75.2. Stripe, Link or another payment Provider may independently request email addresses, billing information, payment details, network information and device information.

75.3. Information requested independently by a Merchant of Record is subject to that entity's separate controller or processor role as applicable.

75.4. An email address supplied to Stripe or Link is not ordinarily imported into the Evil Twin AI Account database merely because it was used at checkout.

76. Random checkout references

76.1. The Service may generate a random reference before checkout.

76.2. That reference may be used to associate a payment event with the Account which initiated checkout.

76.3. The reference is not intended to contain the Account password or full card information.

77. Cookies and storage technologies

77.1. Evil Twin AI uses cookies or equivalent storage technologies required for authentication, session continuity and security.

77.2. The Company does not currently use Google Analytics, Meta Pixel, TikTok Pixel or comparable behavioural advertising trackers in the Evil Twin AI application.

77.3. Stripe, Link and other independently operated services may use their own cookies and storage technologies.

77.4. If the Company introduces non-essential tracking in the future, it will update applicable notices and implement consent or other controls where required by law.

77.5. Applicable United Kingdom rules include the Privacy and Electronic Communications Regulations 2003 as amended, including relevant changes made through the Data (Use and Access) Act 2025.

78. Providers and recipients

78.1. The following categories of recipients may process information where reasonably necessary to provide the Service:

• OVHcloud, for hosting and server infrastructure;
• Cloudflare, for DNS, proxying, delivery, network security and related infrastructure;
• Stripe and Link, for payment processing, subscriptions, Merchant of Record functionality where applicable, fraud prevention, transaction support and tax functions;
• AI inference Providers, for processing prompts and returning machine-generated responses;
• technical and professional service providers where reasonably necessary for Service operation or legal compliance;
• courts, regulators, law-enforcement bodies, tax authorities or other competent public authorities where disclosure is required or otherwise lawful.

78.2. Provider relationships may change over time.

78.3. Where transparency law requires additional information concerning a recipient, the Company will provide that information to the extent legally required.

79. International transfers

79.1. The global nature of the Service means that personal information may be processed in countries outside the United Kingdom or the User's country of residence.

79.2. A transfer from the United Kingdom which constitutes a restricted transfer under UK data-protection law will be made using a legally available transfer mechanism.

79.3. Depending on the circumstances, such a mechanism may include United Kingdom adequacy regulations, the International Data Transfer Agreement, the UK Addendum to approved Standard Contractual Clauses or another safeguard or exception permitted by applicable law.

79.4. Where the EU GDPR applies, an international transfer may rely on a European Commission adequacy decision, Standard Contractual Clauses or another mechanism permitted by Chapter V of the EU GDPR.

79.5. Where required, the Company will carry out the relevant assessment of the transfer mechanism and destination.

80. Data retention

80.1. Retention periods may be extended where a legal hold, regulatory requirement, fraud investigation or legal claim requires preservation.

80.2. Providers may independently retain information for periods determined by their own legal obligations and policies.

81. Account deletion and privacy consequences

81.1. Users may delete an Account using available Account controls.

81.2. Account deletion removes Account and associated Conversation Content from the Company's primary application database subject to information which the Company must lawfully retain.

81.3. Account deletion cannot retroactively delete information independently held by third parties such as Stripe, Cloudflare, OVHcloud or AI Providers.

81.4. Account deletion does not eliminate transaction or tax records which applicable law requires a seller, Merchant of Record or payment Provider to retain.

82. Security

82.1. The Company uses technical and organisational measures intended to provide security appropriate to risk.

82.2. Current measures include transport encryption, password hashing, access controls, input validation, session protections, restricted administrative access and limited infrastructure-log retention.

82.3. Measures may be modified in response to changes in architecture, technology or threats.

82.4. No internet-connected system can guarantee absolute security.

83. Personal-data breaches

83.1. Where a personal-data breach occurs, the Company will assess the nature, scope and likely consequences of the incident.

83.2. The Company will notify the relevant supervisory authority where notification is required by applicable law.

83.3. Affected individuals will be notified where applicable law requires direct notification.

84. Automated processing

84.1. AI generation necessarily involves automated processing of prompts.

84.2. Automated systems may additionally be used for rate limiting, security, fraud detection, abuse prevention and Service integrity.

84.3. Evil Twin AI is not intended to make solely automated decisions producing legal or similarly significant effects concerning Users unless such functionality is separately disclosed and lawfully implemented.

84.4. Where United Kingdom data-protection law requires safeguards relating to significant automated decisions, the Company will provide those safeguards to the extent required.

85. Data-subject rights

85.1. Depending on applicable law and the processing concerned, an individual may have rights including:

• access;
• rectification;
• erasure;
• restriction;
• data portability;
• objection;
• withdrawal of consent where consent is relied upon;
• rights relating to qualifying automated decision-making.

85.2. Requests may be sent to [email protected].

85.3. Rights are not absolute and may be subject to statutory exceptions, legal obligations, competing rights, fraud prevention and preservation of legal claims.

86. Verification of privacy requests

86.1. Because Evil Twin AI intentionally collects little conventional identity information, the Company may not possess a person's legal name or email address.

86.2. The Company may therefore request information reasonably necessary to establish that a requester controls or is genuinely associated with the relevant Account.

86.3. The Company will seek to avoid collecting unnecessary additional identity information solely for verification.

87. Privacy complaints

87.1. Privacy complaints may be sent to [email protected].

87.2. The Company will investigate privacy complaints in accordance with applicable data-protection requirements.

87.3. Relevant changes introduced by the Data (Use and Access) Act 2025 may impose additional procedural requirements concerning complaints, and the Company will comply with such requirements to the extent applicable.

88. Information Commissioner's Office

88.1. Individuals whose processing is subject to United Kingdom data-protection law may have the right to complain to the Information Commissioner's Office (ICO).

88.2. The ICO is the United Kingdom's independent data-protection supervisory authority.

88.3. A complaint to the Company does not remove a statutory right to complain to the ICO.

89. European supervisory authorities

89.1. Where the EU GDPR applies, a data subject may have the right to lodge a complaint with a competent European supervisory authority.

89.2. Depending on applicable law, this may include the authority in the individual's habitual residence, place of work or place of the alleged infringement.

90. European Union representative

90.1. Where Article 27 of the EU GDPR requires the Company to appoint a representative in the European Union, the Company will designate such a representative and publish the relevant contact information.

90.2. Appointment of a representative does not alter the Company's identity as controller.

91. Children's data

91.1. Evil Twin AI is an adults-only Service.

91.2. The Company does not intentionally offer standard Accounts to persons under 18.

91.3. If the Company reasonably determines that an Account is operated by a person under the required age, the Company may terminate or restrict that Account.

92. Business transfers

92.1. Personal data may form part of a corporate transaction including a merger, acquisition, restructuring or sale of the relevant business.

92.2. Any recipient of personal data in such circumstances must process the information subject to applicable data-protection law.

92.3. Where legally required, Users will be notified of a material change in controller.

93. Legal disclosure and preservation

93.1. The Company may disclose information where required by a valid legal obligation, court order or lawful request from a competent authority.

93.2. The Company may challenge a request where reasonably appropriate and legally permitted.

93.3. Information may be preserved beyond an ordinary retention period where reasonably necessary for litigation, fraud investigation, regulatory compliance or another lawful hold.

94. No sale of personal data for advertising

94.1. Evil Twin AI does not operate a business model based on selling Account or Conversation Content to advertisers.

94.2. The Company does not currently use Conversation Content to construct third-party behavioural advertising profiles.

95. Changes to this Privacy Notice

95.1. The Privacy Notice may be amended to reflect changes in processing, Providers, architecture, law or regulatory guidance.

95.2. Material changes will be communicated where required by law.

95.3. The effective date at the beginning of the document identifies the current version.

96. Company disclosures

96.1. Evil Twin AI is operated by CONVRO LTD.

96.2. CONVRO LTD is a private company limited by shares registered in England and Wales under company number _currently_waiting_for_actual_number.

96.3. Its registered office is: 71–75 Shelton Street
Covent Garden
London
WC2H 9JQ
United Kingdom.

96.4. General legal, support and privacy correspondence may be sent to [email protected].