Visitor Privacy Notice

You're reading this because a website you visited uses a Toran widget: a chat window or message form that lets you contact the business behind the site. This page explains what information the widget handles, who handles it, and what rights you have. It is written to meet the transparency rules of the EU and UK GDPR (Articles 13 and 14), Israel's Protection of Privacy Law and similar laws.

Toran's own privacy policy, for people who use Toran's website and dashboard, is at /privacy. This notice covers only the widget on other businesses' websites.

1. Who handles your information

The site owner is the business that runs the website and added the widget. It is the data controller (in Israeli law, the database controller). It decides why your information is collected, what it is used for and how long it is kept.
Toran runs the widget for the site owner. We are the processor (in Israeli law, the holder). We store your information and pass it to the site owner, only on their instructions and under a contract with them. Who operates Toran is listed on our Trust Center.

Identifying the site owner. The chat header and the assistant's first message show the name the site owner chose, usually their business name. Their full legal name and contact details should be in their own privacy policy, usually linked at the bottom of their website. If the site owner has added a link to their privacy policy, the widget's message form links to it. If you cannot tell who the site owner is, email privacy@toranhq.com with the website address. We will pass your request to them within 5 working days and can tell you who they are.

2. What we collect

When a page with the widget loads, your browser sends Toran some technical information, even if you never open the widget. If you chat or send a message, we also receive what you choose to share.

Message content: what you type into the chat or the message form, and the assistant's replies.
Contact details: the email address or phone number you choose to give, and your name if you add it.
Technical information: your IP address, browser and device details, the page you are on, your language and the time. From your IP address we also work out your approximate location (such as country, region and city) and the name of the network or company the address belongs to.
Usage information: whether you open the chat or tap a contact option, how far you scroll, how long you stay on the page, and whether you have contacted this business through the widget before.
AI-written details: if you leave your contact details, a short summary of what you asked and a score that helps the site owner decide which enquiries to answer first. No decision with legal or similarly significant effects on you is made automatically.

Your browser's storage. The widget does not set cookies. It keeps a few items in your browser's storage: your language choice and whether you closed the widget, a cached copy of the widget's settings, a random visitor ID once you use the widget, and, depending on the site owner's setting, a copy of your chat so you can pick up where you left off. To block spam, the widget may run a Cloudflare Turnstile check when you open the chat or the message form.

Do you have to provide this information? No. You do not have to use the widget to use the site. If you don't send a message, the site owner gets no contact details from you, only the technical and usage information above. If you send a message, the email or phone field is required so the site owner can reply; your name is optional. Please don't share health, financial or other sensitive information in the chat.

3. Why we use it

To show you the widget and run the chat, including the AI assistant's answers.
To deliver your message and contact details to the site owner through the channels they chose, so they can reply.
To help the site owner understand and prioritise enquiries, using the summary, score, location and usage information above.
To keep the widget secure and to prevent spam and abuse.
To produce statistics: counts for the site owner (for example, how many messages came in this week), and de-identified records of how enquiries turn out, which Toran uses to improve lead scoring for all its customers. These records contain no names, contact details, message text, IP addresses or exact times.

We do not use your information for advertising, we do not sell it, and we do not use your messages or contact details to train AI models.

Legal basis (GDPR). The site owner decides the legal basis. Usually it is taking steps you asked for before a contract, such as a quote or a booking (Article 6(1)(b)), or their legitimate interest in answering enquiries and understanding how visitors use their site (Article 6(1)(f)). The widget does not ask for your consent, and you can object to the site owner's use of your information at any time (see §6).

4. Who else sees it

Besides the site owner and Toran, these service providers handle your information for Toran, each only for the job described:

Supabase (data stored in France): our database, where your messages and details are stored.
Cloudflare (global): hosts the widget, runs the spam check, and works out your approximate location from your IP address.
OpenAI (USA), with Google Gemini (USA) as backup: generate the AI assistant's replies. Google Gemini also writes the summary and score for the site owner. Neither uses this data to train its models; each may keep it for a limited time to monitor for abuse.
IPinfo (USA): looks up the name of the network or company your IP address belongs to.
Resend (USA), Slack (USA) and Telegram (UAE): deliver notifications about your enquiry to the site owner, when the site owner uses them.
Sentry (USA): error monitoring. When something breaks, it receives technical details such as the error and the widget involved. We filter out message text, names, email addresses and phone numbers first.

If the site owner hasn't added a photo for a team member, the widget shows an initials image from ui-avatars.com. Your browser fetches that image directly, so that service sees your IP address and browser details.

The site owner may also send your enquiry to their own tools, such as their email, CRM or WhatsApp. The full, current list of Toran's service providers is at /legal/subprocessors.

Transfers abroad. Toran operates from Israel, which the EU, the UK and Switzerland recognise as protecting personal data adequately. For providers outside those places, transfers from the EU, UK and Switzerland rely on adequacy decisions (including the EU-US Data Privacy Framework for certified companies) or the European Commission's Standard Contractual Clauses. For information from Israel: our database is in France, which Israeli transfer rules accept, and our US providers are bound by written commitments to protect your information and use it only to provide their service.

5. How long we keep it

Each site owner chooses how long Toran keeps the text of your chat: 30 days(the default), 7 days, or until the chat ends (about 30 minutes after your last message). When that time is up, the text of your messages is erased from our servers by a scheduled job - not hidden, not archived. Only bare records with no message text (for example, when a message was sent) remain until our 30-day clean-up removes them. Aggregate counters (e.g. number of messages by week) remain because they hold no identifying information.

The widget can also keep a copy of the chat in your own browser so you can pick up where you left off. It follows the same setting: if the site owner chose "until the chat ends", the copy is gone when you close the tab.

Messages you send through the message form are deleted automatically after 30 days.

If you leave your contact details so the business can get back to you, they are saved as an enquiry in the site owner's Toran account, together with a short summary of what you asked. The enquiry stays there until the site owner deletes it or you ask for it to be erased (see §6).

Technical and usage information is deleted after 30 days. Error logs, which can include the page address and your browser details, are deleted after 90 days.

If the site owner copies your message into their own CRM or inbox, what happens next is up to them, under their own privacy policy.

6. Your rights

Start with the site owner, because they control your information. You can also email privacy@toranhq.com and we will pass your request on (see §1). Toran helps site owners answer requests, ordinarily within 30 days.

In the EU and UK (GDPR): you can ask to access, correct or delete your information, restrict its use, get a portable copy, and object to its use (Articles 15 to 18, 20 and 21). Where the legal basis is consent, you can withdraw it at any time (Article 7(3)). You can complain to the data protection authority where you live or work; in the UK, that is the Information Commissioner's Office (ICO).
In Israel: under the Protection of Privacy Law you can ask to see the information held about you (section 13), and ask for it to be corrected or deleted if it is wrong, incomplete, unclear or out of date (section 14). You can complain to the Privacy Protection Authority.
In California and other US states: you can ask to know what information is held about you and to correct or delete it, and you will not be treated differently for asking. Toran does not sell your personal information or use it for targeted advertising.

Elsewhere, you may have similar rights under local law, and the same contact routes apply.

7. How to reach us

For questions about Toran's role, email privacy@toranhq.com. We will pass requests to the site owner where they belong, or handle them ourselves if they concern Toran's own systems.

Toran has not appointed a Data Protection Officer. Messages to privacy@toranhq.com reach the person responsible for privacy at Toran.

8. Changes to this notice

We version this notice (see the top of the page) and give it a new version number whenever we change what it says about your information. Earlier versions are available on request from privacy@toranhq.com.