Privacy Policy

1. Introduction

Welcome to Toran ("we," "our," or "us"), available at toranhq.com. Toran is an AI chat and lead-capture widget that businesses add to their websites. This policy explains what personal data we collect, why, who helps us process it, how long we keep it, and the rights you have. It covers our website, the chat on our own site, our waitlist and updates list, the Toran dashboard at app.toranhq.com, and our support channels.

Toran is a service operated by Erez Avital, a registered business in Israel trading as 'Toran'. This is the "we" in this policy and the data controller described in section 2. Our mailing address is available on request. For anything in this policy, email privacy@toranhq.com.

If you are chatting with a business that uses Toran on its own website, that business is responsible for your data (see section 2). Our Visitor Privacy Notice explains how the widget handles it.

2. Data Controller vs. Data Processor

We are the Data Controller for Toran accounts, including the teammates a business adds; for people who visit toranhq.com, chat with us there, or join our waitlist or updates list; and for anyone who contacts our support. We decide how this data is used, and this policy describes it.
We are a Data Processor for the visitor data a business collects with its Toran widget on its own website. That business is the controller: it decides what its widget asks for and, within the settings we offer, how long chats are kept. We process that data only to provide Toran to the business, under our Data Processing Agreement. Businesses keep full ownership and control of their visitors' data.

If you chatted with a business through Toran and want to use your privacy rights, please contact that business. If you write to us instead, we will pass your request on and help the business respond.

3. Data We Collect

What we collect depends on how you use Toran. Most of it comes from you. The rest comes from your browser, from a sign-in provider you choose, from our payment provider, or from the business whose website you are on.

If your business has a Toran account

Account details: your email address and password (we store only a secure hash of it). If you sign in with Google, Microsoft or GitHub, we receive your name, email address and, where available, profile picture from that provider. We also keep your security settings, such as two-factor authentication.
Business and widget settings: your business name and website, the content you add to your knowledge base or ask us to read from your site, and your widget and notification settings.
Teammates: the names, email addresses and phone numbers of people you add to your team. The names and contact details your widget uses to connect visitors with your team are part of the widget's public settings file, which visitors' browsers download.
Billing: your plan, subscription status and billing country. Paddle, our merchant of record, handles payment, so we never see your full card details.
How you found us: the campaign tags in the link you arrived on, the referring site, your first landing page and any partner referral code. We save these with your account when you sign up.
Usage and device data: your IP address, browser and device type, usage counts for your plan, security logs of actions in your account, and error reports from the dashboard. We use the country your IP address points to for regional pricing and to check that we can offer Toran where you are.

If you visit toranhq.com

Waitlist and updates: your email address and the plan you are interested in, if you join a waitlist or subscribe to updates.
Chatting with us: the chat on our site is a Toran widget, so the visitor data listed below applies, with us as the controller.
Site analytics: page views and page-speed measurements from Cloudflare Web Analytics, which uses no cookies. When you click a sign-up or pricing button, we also record the page you were on and the page that referred you.
Security data: your IP address and browser details, used for bot checks and to stop abuse of our forms (see section 7), and error reports if a page breaks.

If you chat with a business that uses Toran

We collect this on behalf of the business whose website you are on:

Your conversation: your messages and the AI assistant's replies.
Details you share: such as your name, email address, phone number or company, and anything else you type.
Visit details: the page you are on, the page that referred you, campaign tags in the link, your browser language and time zone, browser and device type, how far you scroll and how long you stay on the page, and actions such as opening the chat, tapping a contact button or clicking repeatedly in one spot.
Location and network: your approximate location (country, region and city) and the name of the network or company your IP address belongs to, both worked out from your IP address.
Identifiers and security data: a random visitor ID once you open the chat or send something, your IP address, and one-way scrambled (hashed) versions of it. We use these to keep a chat together and to stop spam and abuse.
AI insights: a lead score and a short AI-written summary of the conversation, so the business can decide how to follow up.

If you contact support

Your name, your email address and whatever you tell us.

Why we use it

Each use has a legal basis under EU and UK data protection law:

Providing Toran to businesses that sign up, including support and service emails: our contract with you.
Keeping Toran secure, stopping spam, fraud and abuse, and fixing errors: our legitimate interest in running a safe, reliable service.
Understanding and improving our site and product with limited analytics, and helping new customers finish setting up: our legitimate interests.
Waitlist news and product updates you asked for: your consent, which you can withdraw at any time.
Business, tax and legal records, and answering lawful requests: our legal obligations.
Visitor data on a business's website: processed on that business's instructions. The business chooses the legal basis.

You don't have to give us personal data, but we need an email address to open an account, and a business needs your contact details to reply to you.

AI and automated decisions

Toran's AI writes chat replies, and scores and summarizes leads so businesses can decide whom to contact first. Toran makes no decisions with legal or similarly significant effects on anyone: the business decides how to follow up. We do not use conversations to train AI models. We do not sell personal data, and we do not share it for cross-site or targeted advertising.

4. Trusted Third-Party Service Providers

We do not sell your data. We share it only with providers that help us run Toran, and only what each one needs:

Cloudflare: Hosting, content delivery, security, bot checks (Turnstile), location lookup from IP addresses, and cookie-free site analytics (US, global network)
Supabase: Database, sign-in, file storage and server functions (data stored in the EU: Paris, France)
Paddle: Payments, tax and invoicing, as our merchant of record (UK)
Resend: Email delivery: sign-in and account emails, lead alerts, and follow-up emails a business turns on (US)
Sentry: Error monitoring for the dashboard and toranhq.com (EU: Germany). Email addresses, phone numbers and IP addresses are removed in your browser before a report is sent.
OpenAI: AI chat replies and knowledge-base processing (US)
Google (Gemini API): Lead scoring and summaries, backup chat replies, and setup helpers that read a business's website (US)
IPinfo: Looks up the network or company an IP address belongs to (US)
Slack: Lead alerts, only for businesses that connect Slack (US)
Telegram: Alerts to our team about sign-ups, waitlist requests and service health, and lead alerts for businesses that connect Telegram (UAE, global). Works under Telegram's own terms.
Zoho Desk: Support tickets and our replies to enquiries (US)

For the authoritative current list with transfer mechanisms and locations, see our Sub-processors page.

AI providers: OpenAI and Google process chat and knowledge-base content for us. Under the API terms we use, neither uses it to train its models, and each may keep it for a limited time to detect abuse (OpenAI for up to 30 days).

Other services: if you sign in with Google, Microsoft or GitHub, that provider handles your sign-in under its own privacy policy. If a business connects its own tools, such as Slack, Telegram, a webhook or browser notifications, we send lead details there on the business's instructions; browser notifications travel encrypted through the browser maker's push service (for example Google, Apple or Mozilla). The dashboard also loads fonts from Google Fonts and placeholder profile pictures from ui-avatars.com, which receives the name it draws. Both see your IP address.

Paddle is responsible in its own right for the payment data it handles as merchant of record. We give businesses at least 30 days' prior notice before a new sub-processor starts handling their visitors' data.

International transfers

Our main database is in the EU (Paris, France). Toran is run from Israel, which the European Commission recognizes as providing adequate protection for personal data. Several providers above are based in the US or elsewhere. Where personal data from the EU, EEA or UK goes to them, we rely on the EU-US Data Privacy Framework where the provider is certified, or on the European Commission's standard contractual clauses (with the UK addendum for UK data). The Sub-processors page lists the safeguard for each provider.

5. Data Retention

Account Data: 7-Day Deletion Cooldown

We keep your account, widget configuration and notification settings for as long as your account is open. When you ask us to delete your account, a 7-day cooldown runs before anything is erased:

Immediately, your widgets are switched off and stop collecting visitor data.
For 7 days, you can cancel from the banner in your dashboard or from the link in the confirmation email we send you. Changes to your email address, password, phone number and two-factor settings are blocked during this time, so someone who has taken over your account cannot lock you out of cancelling.
After 7 days, an automatic job permanently erases your account from our live systems, including your widgets, leads and chats. This normally happens within 24 hours.

The cooldown protects you from account takeover. If you need immediate erasure for a documented legal reason, email privacy@toranhq.com with the supporting documentation. After erasure we keep only a record that the deletion happened, the security log of changes made to your account (kept to investigate misuse and to show how we handled your request), and, if you came to us through a partner, the payment references we need to settle that partner's commission.

Other Data

Leads (contact details, lead score and summary): until the business deletes them, deletes the widget, or closes its account. A business can also erase a single visitor's data from that visitor's lead.
Messages left for a team while it is offline (the visitor's name, contact details and message): deleted automatically after 30 days.
Widget activity records (visit details, IP address, browser details and approximate location): 30 days.
Widget event and error logs (page address, browser details and approximate location, without the IP address): 90 days. Button-click records from our own site are kept for the same period.
Security records: rate-limit records that include an IP address are deleted once their time window ends, and logs of blocked visitors keep only a hashed IP address, for 30 days.
Waitlist and updates list: until you unsubscribe or ask us to remove you. If you unsubscribe, we keep your address only so we don't email you again.
Support emails: as long as we need them to help you and to keep a record of your request.
Lead statistics: de-identified records of lead outcomes, such as the score a lead received and whether it converted, with no contact details or message text. We keep these to improve lead scoring.
Payment records: Paddle, our merchant of record, keeps payment and invoice records for as long as tax and anti-money-laundering laws require. To use your rights over those records, contact Paddle directly.

Your account and lead data is backed up nightly, encrypted before it leaves our systems, and held in independent off-site storage with a tested recovery process. We do not use backups to restore an individual's deleted records. Once data is erased from our live systems, any copy that remains in a backup is isolated from any further use and is deleted as our backups roll over, within 90 days. Raw chat transcripts are never written to these backups: the backup fails if it finds any.

AI Chat Conversation Data

Message text is deleted automatically after 30 days. A business can shorten this in its widget's Chat history setting to 7 days, or to the end of each chat (about 30 minutes after its last message); the text, and any contact details typed into the chat, are then erased on that schedule. The rest of a chat's record, such as when it started and the visitor's country, device and referring page, is deleted about 30 days after the chat's last message, whatever the setting. When a conversation becomes a lead, the visitor's contact details and a short AI-written summary are kept with the lead, so the business can follow up, until the lead is deleted.

6. Security

Connections to our website, dashboard and database are encrypted with TLS 1.2 or higher, and stored data is encrypted with AES-256, including files in Cloudflare R2 object storage. Our main database is in the EU (Paris, France). All administrative access requires two-factor authentication: the server rejects any admin session that has not passed it, so a stolen password or single-factor session is not enough. Our full technical and organizational measures are documented at the Trust Center.

7. Cookies and local storage

We do not use advertising cookies or cookies that track you across other websites. On toranhq.com we set no cookies at all unless you choose a language. This is what we keep in your browser, and what the services we load keep.

On toranhq.com

Your theme: whether you chose light or dark mode, in local storage (toran-theme).
Your language: if you pick a language in the language menu, we set one cookie (toran_locale, kept for one year) so the site opens in that language next time. If you never pick one, no cookie is set.
The sign-up bar: if you close it, we remember that until you close the tab (session storage).
Site analytics: Cloudflare Web Analytics counts visits and measures how fast pages load. It sets no cookies and stores nothing in your browser, and Cloudflare says it does not fingerprint visitors or store their IP addresses for this. When you click a sign-up or pricing button, we record the page and the page that referred you, without a cookie or ID.
Bot checks (Cloudflare Turnstile): when you submit a waitlist or updates form, or open the chat on our site, we run Cloudflare Turnstile. It is an invisible check that tells people apart from bots, so you don't have to solve a puzzle, and it loads from Cloudflare (challenges.cloudflare.com) only at that point. Turnstile looks at signals such as your IP address and browser and device details; it does not read what you type into the form. It sets no cookies on our site. Inside its own frame, Cloudflare keeps one small item in local storage. Our server then confirms the result with Cloudflare, passing on your IP address. Cloudflare runs the check for us and also uses these signals to improve its bot detection, as set out in its Turnstile privacy addendum. We use Turnstile only on Toran's own website, not in the chat widgets businesses add to their sites.

The chat widget (on our site and on businesses' sites)

The widget sets no cookies. It uses your browser's local storage, which stays until you clear it, and session storage, which is cleared when you close the tab:

Widget settings: a cached copy of the widget's own configuration, so it loads faster. It contains nothing about you.
Return visits: a "seen before" marker (just the value 1, not an ID), so the greeting can change for returning visitors, and a count of greetings you have closed, so they stop appearing.
This visit: how many pages you have viewed, the campaign tags in the link you arrived from, and which button you used to start, kept only until you close the tab.
Visitor ID: a random ID (toran_vid), saved only once you open the chat or send something, so your later messages stay connected to the same conversation.
Your chat: a copy of your conversation, kept according to the business's chat history setting: up to 30 days, up to 7 days, or, when the business deletes chats when they end, only until you close the tab.
Unsent details: if your connection drops while you are sending your details or a message, a copy is kept for up to 48 hours so it can be delivered when you are back online.
Preferences: small choices such as the language you picked, or that you moved, minimized or closed the widget.

On a business's website, that business is responsible for telling you about this storage and for asking your consent where its local law requires it.

The Toran dashboard (app.toranhq.com)

Signing in: the dashboard keeps you signed in with a session token in local storage. Signing out removes it, along with the dashboard's other saved settings.
How you found us: campaign tags, the referring site, your landing page and any partner referral code, kept in local storage until you sign up and then saved to your account.
Pricing country: your verified country for regional pricing, kept for the browser session.
Payments: the dashboard loads Paddle's checkout script. Paddle's network may set a short-lived security cookie (__cf_bm) on paddle.com to filter out bots.
Analytics: Cloudflare Web Analytics runs on the dashboard too, without cookies.

You can clear all of this at any time in your browser settings. If you block storage, the chat may not remember your conversation and the dashboard cannot keep you signed in. We don't sell personal data, share it for advertising, or track you across sites, so there is nothing for a Do Not Track or Global Privacy Control signal to switch off: our sites work the same either way.

8. Regulated data & what Toran is not built for

Not HIPAA-eligible. Toran is not configured to handle Protected Health Information (PHI). If you operate a medical practice or healthcare service, do not configure your widget to elicit diagnoses, treatment details, or other PHI from visitors. Use Toran for contact intent only ("book an appointment", "request a callback") and route the medical conversation through your own HIPAA-compliant stack. We are not in a position to sign a Business Associate Agreement (BAA) at this time.

Toran is also not built to receive payment-card data (no PCI scope), government identifiers as a primary input, or content moderated under specific regulated regimes (KYC / AML). If your use case touches any of those, contact trust@toranhq.com before deploying - there is usually a routing pattern that keeps Toran out of the regulated data flow entirely.

9. Your privacy rights

Wherever you live, you can ask us to:

show you the personal data we hold about you and give you a copy, including in a portable format;
correct it if it is wrong or incomplete;
delete it;
stop or limit a use of it, including any use based on our legitimate interests;
stop using it where you gave consent, such as for updates emails.

If you have a Toran account, you can do much of this yourself in the dashboard: download your account data from your profile settings, erase a single visitor's data from that visitor's lead, and delete your account. For anything else, email privacy@toranhq.com. We may need to confirm your identity first. We reply within one month, and if the law lets us take longer for a complex request, we will tell you. If you chatted with a business through Toran, please contact that business first; if you write to us, we will pass your request on and help them respond.

EU, EEA and UK

You can complain to the data protection authority where you live or work or where you think the problem happened, or in the UK to the Information Commissioner's Office. We would welcome the chance to help first.

Israel

Under the Privacy Protection Law, you can ask to review the data we hold about you, ask us to correct or delete it, and ask to be removed from any list we use for direct mail or marketing. You can also complain to the Privacy Protection Authority.

United States, including California

We do not sell your personal information or share it for cross-context behavioral advertising. We use sensitive personal information, such as your password, only to provide and secure your account. Depending on where you live, you can ask to know what we collect and why, to get a copy, to correct it and to delete it. You can use an authorized agent; we will verify the request. We will not treat you differently for using your rights.

India: DPDP Act and grievance contact

Under the Digital Personal Data Protection Act 2023, you can ask for information about your data (§11), ask us to correct, complete, update or erase it (§12), have your grievances addressed (§13), and nominate someone to use your rights if you die or become unable to (§14). Our grievance contact is reachable at privacy@toranhq.com with the subject line "DPDP grievance". We aim to reply within 7 business days and to resolve most requests within 30 days. If you are not satisfied, you can then complain to the Data Protection Board of India. Indian law allows personal data to be transferred outside India unless the government restricts a destination; as of the date of this policy, none of the places we use is restricted.

10. Trust Center & data-processing agreements

For procurement and security questions - encryption details, sub-processor list, DPA signing, breach-response SLA, certifications & roadmap - see the Trust Center and the public Data Processing Agreement / Sub-processor list.

11. Contact Us

If you have any questions about this Privacy Policy, or want to use your rights, contact us at privacy@toranhq.com. For trust & security topics, use trust@toranhq.com. For vulnerability disclosure, use security@toranhq.com. Mailing address available on request via trust@toranhq.com.

12. Children and changes to this policy

Toran is built for businesses and is not aimed at children. We do not knowingly collect personal data from children through our website or dashboard. If you believe a child has given us personal data, email privacy@toranhq.com and we will delete it.

We update this policy when Toran changes, and the date at the top shows the latest version. If a change significantly affects how we use account holders' data, we will tell account holders by email or in the dashboard before it takes effect.