Privacy Policy

Last updated: September 22, 2026

Twelve Data Pte. Ltd. ("Twelve Data", "we", "us") (UEN No. 202006058W) respects your privacy and is committed to protecting personal data across multiple jurisdictions. This Privacy Policy describes how Twelve Data collects, uses, and discloses personal data in compliance with applicable privacy laws, including but not limited to the General Data Protection Regulation (GDPR), California Consumer Privacy Act (CCPA) as amended by the California Privacy Rights Act (CPRA), Lei Geral de Proteção de Dados (LGPD), Personal Information Protection and Electronic Documents Act (PIPEDA), Personal Data Protection Act 2012 of Singapore (PDPA), Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data in the United Arab Emirates, and other US state laws such as Delaware's Personal Data Privacy Act (DPDPA, effective Jan 1, 2025), Minnesota's Consumer Privacy Act (MCPA, effective Jul 31, 2025), Nebraska's Data Privacy Act (NPDPA, effective Jan 1, 2025), New Jersey's Data Privacy Act (effective Jan 15, 2025), and Maryland's Online Data Privacy Act (MODPA, effective Oct 1, 2025).

This Privacy Policy is intended to meet the requirements of applicable data protection laws in the jurisdictions in which we operate, in addition to other international privacy regulations referenced below.

1. Personal data we collect

We adhere to data minimization principles, collecting only the personal data necessary for the purposes outlined in this policy.

Twelve Data may collect the following types of personal data, either directly or through third-party services, depending on your interaction with us:

• - Personal identifiers: First name, last name, company name, email address
• - Account information: Password, usage data, IP addresses, device information, cookies
• - Financial information: Payment details (processed via third-party payment services like Stripe)
• - Geolocation data: When you access our services, your approximate location may be determined

We collect personal data either directly from users (e.g., when signing up for services) or automatically (e.g., through cookies and analytics tools).

Legal Basis for Processing (for regions such as the EU under GDPR): We process personal data based on the following grounds:

• - Your consent
• - Performance of a contract
• - Compliance with legal obligations
• - Legitimate business interests (e.g., improving services)

For residents of California (CCPA/CPRA), other US states with similar laws (e.g., DPDPA, MCPA, NPDPA), Brazil (LGPD), Canada (PIPEDA), and other regions with similar legal requirements, you may also be entitled to specific rights outlined below.

Where required by applicable local law, including the Singapore PDPA and UAE data protection legislation, we ensure that personal data is processed only where a valid lawful basis exists under the relevant jurisdiction.

2. How we use personal data

We use personal data for the following purposes:

• - Service provision: To deliver the data feed services that you subscribe to
• - Customer support: Responding to your inquiries and providing assistance
• - Analytics and improvement: To analyze how users interact with our website and services, and to improve user experience
• - Payment processing: To process payments for subscriptions and services (e.g., via Stripe)
• - Security and fraud prevention: To protect against malicious activity, fraud, and unauthorized access
• - Marketing: With your consent, we may send you promotional materials and updates. You can opt-out at any time via unsubscribe links in emails or by contacting us.

We do not sell personal data in exchange for money. We do use advertising and analytics technologies which, under California law, count as selling and sharing personal information. This means online identifiers such as cookie IDs, device and browser details, and information about your activity on our website are made available to advertising and analytics providers, including Google and LinkedIn, who may use them to show you advertising on other websites.

You can opt out at any time using the Do Not Sell or Share My Personal Information link in our footer, or through the cookie settings link on our website.

We may also share data with trusted service providers (see Section 3) who process data on our behalf and only on our instructions.

If we use automated decision making or AI, for example for fraud detection, we ensure human oversight where required. Where a decision produces legal or similarly significant effects, you have the right to object or to request human review under Article 22 of the GDPR and equivalent provisions in other laws.

3. How we disclose personal data

We may share your personal data with the following:

• - Service providers and processors: Microsoft Azure (cloud hosting and infrastructure), Stripe and PayPal (payment processing), Cloudflare (network security and content delivery), Intercom (customer support), Segment (data routing), CookieYes (cookie consent management), Google Analytics and Microsoft Clarity (website analytics). These parties process personal data on our behalf and only for the purposes set out in this policy
• - Advertising providers: Google and LinkedIn. These parties receive online identifiers and information about your activity on our website, and may use it to show you advertising on other websites. Under California law this constitutes selling and sharing personal information. You can opt out as described in Section 2
• - Business transfers: In case of mergers, acquisitions, or any form of asset sale, your personal data may be transferred to third parties involved in the transaction
• - Legal obligations: We may disclose personal data if required to comply with a legal obligation, regulation, or governmental request

We do not control third-party websites linked from our services and are not responsible for their privacy practices. Please review their policies separately.

4. International data transfers

Where we transfer personal data internationally, we ensure appropriate safeguards are in place to protect your data, regardless of where it is transferred. This includes:

• - EU-U.S. data transfers: If we transfer personal data to countries outside the European Economic Area (EEA), we do so under appropriate mechanisms, such as Standard Contractual Clauses, binding corporate rules, or, where the recipient organisation is certified, the EU US Data Privacy Framework
• - Other jurisdictions: We comply with local privacy laws when transferring data across borders, including requirements under CCPA/CPRA, other US state laws, LGPD, PIPEDA, and other regional privacy laws
• - Where personal data originates from Singapore or the United Arab Emirates: cross-border transfers are conducted in compliance with applicable local requirements, and appropriate safeguards are implemented to ensure an adequate level of protection for the transferred personal data. For UK transfers, we use the International Data Transfer Agreement (IDTA) where applicable.

5. Your rights and choices

Depending on your location and applicable privacy laws, you may have the following rights. We process requests within 30 days under GDPR (extendable to 60 days), 45 days under CCPA/CPRA (extendable), or as required by other laws. Use our dedicated email: dpo@twelvedata.com for rights requests.

For European Union residents (GDPR):

• - Right to access: Request a copy of your data
• - Right to rectification: Correct any inaccuracies in your data
• - Right to erasure (right to be forgotten): Request deletion of your data
• - Right to data portability: Receive your data in a machine-readable format
• - Right to restriction of processing: Request that we limit the processing of your data
• - Right to object: Object to certain types of processing, such as marketing
• - Right to withdraw consent: Withdraw your consent at any time, where consent is the basis for processing
• - Right to lodge a complaint: Lodge a complaint with the data protection supervisory authority in your country of residence, place of work, or where the alleged infringement took place

For US residents (CCPA/CPRA and other state laws, e.g., DPDPA, MCPA, NPDPA, NJDPA, MODPA):

• - Right to know: Request disclosure of categories and specific pieces of personal data collected, sold, or shared
• - Right to delete: Request deletion, subject to exceptions
• - Right to opt out: Opt out of the selling or sharing of your personal information, of targeted advertising, and of certain processing of sensitive personal information. You can do this using the Do Not Sell or Share My Personal Information link in our footer, or the cookie settings link on our website.
• - Right to correct: Correct inaccurate data
• - Right to limit: Limit use of sensitive personal information
• - Right to non-discrimination: No discriminatory treatment for exercising rights

For Brazilian residents (LGPD):

• - Right to confirmation: Request confirmation of whether your data is processed
• - Right to access and correction: Request access to or correction of your personal data
• - Right to anonymization, blocking, or deletion: Request anonymization or deletion of unnecessary or excessive data
• - Right to data portability: Receive your data in a structured, commonly used format

For Canadian residents (PIPEDA):

• - Right to access: Request access to your personal information
• - Right to correction: Correct inaccurate or incomplete data
• - Right to withdraw consent: Withdraw consent for processing
• - Right to challenge compliance: Challenge our compliance with PIPEDA

For Singapore residents (PDPA):

• - In accordance with the Singapore Personal Data Protection Act (PDPA), you may request access to personal data we hold about you and request correction of any inaccurate or incomplete personal data, subject to applicable legal exceptions.

For United Arab Emirates residents:

• - We process personal data in accordance with applicable UAE data protection laws, including Federal Decree-Law No. 45 of 2021 on the Protection of Personal Data, where applicable. Individuals may have rights relating to access, correction, deletion, or withdrawal of consent, subject to legal and regulatory requirements.

To exercise these rights, contact legal@twelvedata.com. We do not discriminate against users exercising rights.

Right to appeal: If we decline a rights request, you may appeal by emailing legal@twelvedata.com with "Appeal" in the subject line. We will respond within 45 days with our decision and the reasons for it. If we decline your appeal, we will tell you how to contact your state attorney general.

6. Security and data retention

We implement industry-standard security measures to protect personal data from unauthorized access, alteration, disclosure, or destruction. These include encryption, firewalls, secure access controls, multi-factor authentication, regular vulnerability scans, employee privacy training, and controls aligned to recognised frameworks including ISO 27001 and NIST.

In the event of a personal data breach, we will assess the incident and notify relevant supervisory authorities (e.g., within 72 hours under GDPR) and affected individuals without undue delay, in accordance with requirements under the Singapore PDPA, UAE laws, and other applicable regulations.

Data retention: Personal data will be retained only for as long as necessary to fulfill the purposes outlined in this policy or as required by law. Examples:

• - Account information: Retained for 2 years after account closure
• - Financial information: Retained for 7 years for tax compliance
• - Usage data: Retained for 1 year for analytics

Upon expiration, data will be securely deleted or anonymized.

7. Children's privacy

Our services are not intended for individuals under the age of 16 (or 13 under US COPPA where applicable). If you are a parent or guardian and believe your child has provided us with personal data, please contact us, and we will take steps to delete such data.

We do not sell or share the personal information of anyone under 16 years of age.

8. Cookies and tracking technologies

Twelve Data uses cookies and similar tracking technologies to provide functionality and analyze service usage. Some of these technologies support advertising, as described in Section 2. You can manage your preferences at any time using the cookie settings link in our footer, or through your browser settings. For details, refer to our Cookie Policy.

9. Updates to this Privacy Policy

We may update this Privacy Policy to reflect changes in our personal data practices or applicable laws. The "Last updated" date indicates the last revision. Significant changes (e.g., new data uses) will be notified via website postings, email to active users, or direct contact.

10. Contact us

For questions or concerns regarding this Privacy Policy or our data protection practices, contact us at:

Twelve Data Pte. Ltd.
20A Tanjong Pagar Road
Singapore 088443
Website: https://twelvedata.com
Email: legal@twelvedata.com
Support: support@twelvedata.com

Privacy-related inquiries, including requests to exercise data protection rights, are handled by our data protection function.