Legal
Privacy Policy
Last updated October 7, 2026
What we collect
- Account data: name, email address and a hashed password.
- Workspace content you create: projects, tasks, fields and comments.
- Billing data handled by Stripe; we store only customer and subscription identifiers, never card numbers.
- Technical data needed to run the Service: session cookies, your browser’s timezone, and IP addresses for security and rate limiting.
How we use it
To provide and secure Torvany, process payments, send service emails (such as invitations), and improve the product. We do not sell personal data or use it for third-party advertising.
Sharing
We share data only with processors that help us run the Service (hosting, Stripe for payments, our email provider, and an AI provider for AI features), under contracts that protect it, or when required by law. When you use an AI feature, only the content you asked about (for example one task's description and comments) is sent to produce the result. Workspace owners can turn AI features off in Settings.
Retention and your rights
We keep data while your account is active and delete it within 30 days of account closure, except where the law requires longer retention (for example, invoices). If your organisation uses single sign-on, we receive only your email address and name from its identity provider. Files you attach to tasks and comments are stored with the workspace and visible to people who can see that task; deleting a file, task or project removes the file within a day. Workspace audit log entries record who made administrative changes; they keep the person's name for up to 365 days, even after account closure, so workspace owners can investigate security and billing issues. You can correct your details, download a copy of your personal data (Account settings → Your data) and delete your account yourself in Account settings. Workspace owners and admins on Pro and Business can export all workspace data as JSON or CSV. A workspace owner can delete the whole workspace (Settings → General): it becomes inaccessible immediately, can be restored by the owner for 30 days, and is then permanently erased with its projects, tasks, comments and files. For anything else, contact [email protected]. If you are in the EEA or UK you may also complain to your data protection authority.
Security
Passwords are hashed with scrypt, sessions use random tokens stored as hashes, all workspace data is isolated per tenant, and the app ships a strict Content Security Policy.