Legal
Subprocessors
Last updated November 4, 2026
These are the service providers that process personal data on our behalf to run Torvany, for the content our customers put in their workspaces (see the Data Processing Addendum) and for our own purposes (see the Privacy Policy). Each is bound by a written contract with data protection terms at least as protective as ours.
Current subprocessors
| Provider | What for | Data | Location and safeguard |
|---|---|---|---|
| Hosting Combell | Servers, database and backups that run Torvany | Everything stored in Torvany | Netherlands Not needed (EEA) |
| File storage Hetzner Online GmbH | Storing the files people attach and meeting audio until it is transcribed | Files attached to tasks and comments, and meeting audio | Germany (European Union) Not needed inside the EEA; otherwise the European Commission's standard contractual clauses |
| Payments Mollie (Mollie B.V.) | Subscription payments, direct debit mandates, refunds and invoices | Billing name, address, VAT number, email address, payment details (card details or IBAN stay with Mollie) | Netherlands Not needed (EEA) |
| Email delivery Lettermint (Lettermint B.V.) | Sending the emails Torvany sends (sign-up, notifications, receipts) and reporting bounces and complaints | Email address, name, the content of the email | European Union (Netherlands) Not needed (EEA) |
| AI features An AI model provider based in the European Union | Drafting plans, summaries, status updates and meeting action items, and the help chat, when someone uses them | The content someone asks about (for example one task's description and comments) and, for the help chat, the projects and tasks it looks up to answer (only what that person can see) | European Union Not needed (EEA) |
| Meeting transcription The same AI model provider (once transcription is available) | Turning a recorded meeting into a transcript and summary | The meeting recording and its transcript | European Union Not needed (EEA) |
| Error reporting None: errors are logged on our own servers | Finding and fixing errors | Technical details of errors, with email addresses, IP addresses, tokens and query strings removed | Our servers Not needed |
| Off-server backup storage Combell | Keeping an encrypted copy of the backups away from our servers | Encrypted backups the provider can't read | Belgium Not needed inside the EEA; otherwise the European Commission's standard contractual clauses |
| Network edge BunnyWay d.o.o. (bunny.net) | Carrying requests to our website and the Service to our servers, and telling us the country a visit comes from | IP addresses and everything the requests carry (encrypted connections end at the provider) | European Union (Slovenia) Not needed inside the EEA; otherwise the EU-US Data Privacy Framework, where the provider is certified, or the European Commission's standard contractual clauses |
Changes to this list
Before we add or replace a subprocessor, we update this page and email the owners of every workspace at least 30 days ahead. A business customer may object on reasonable data protection grounds by writing to privacy@torvany.com within that period; if we can't resolve the objection, the customer may stop using the affected feature or end its subscription, as set out in the Data Processing Addendum.