Scope and roles
This Data Processing Addendum ("DPA") forms part of the Terms of Service between CA CAPITAL LIMITED ("Processor", "we") and the Customer ("Controller", "you"). It applies where we process personal data on your behalf in providing Torvane.
It is entered into to satisfy Article 28 of the UK GDPR. Where this DPA conflicts with the Terms of Service on the processing of personal data, this DPA prevails.
"UK GDPR", "personal data", "processing", "data subject", "controller", "processor" and "personal data breach" have the meanings given in the UK GDPR and the Data Protection Act 2018.
Subject matter, duration, nature and purpose
| Item | Detail |
|---|---|
| Subject matter | Processing of personal data contained in documents and account records in order to provide the Torvane service. |
| Duration | For the term of the subscription, plus the export and deletion periods set out in section 8. |
| Nature of processing | Collection, storage, organisation, structuring, retrieval, text extraction, indexing for search, automated classification and analysis by AI models, erasure and export, and recording the Controller's corrections and the rules derived from them; drafting correspondence from Customer documents at the request of an Authorised User; recording how Authorised Users correct, approve, use and edit the Service's output, and applying the preferences and rules they confirm. |
| Purpose | Reading, classifying, renaming, filing and searching the Controller's documents; extracting key dates and obligations; answering the Controller's questions about its own documents; applying the Controller's own corrections to its later documents; preparing draft emails and letters for the Customer to review and send. |
| Types of personal data | Determined by the Controller. Typically: names, job titles, business and
personal contact details, addresses, signatures, financial and payment
details, contract and policy terms, dates, reference numbers, and any
other personal data present in uploaded documents. Correction records
and learned rules may contain the names of the Controller's suppliers
and other counterparties as they appear on its documents, the names of
the Controller's users who made a correction, and document names.
Extracted obligations and deadlines store the sentence each date came
from, which may itself contain personal data.
Drafts may contain the names and contact details of the Controller's
counterparties (including any address a user types), amounts, references
and dates taken from the Controller's documents.
Records of corrections, approvals and draft edits made by Authorised Users
(who, when, the fields changed and any reason given), and Authorised Users'
confirmed drafting preferences (greeting, sign-off and length).
Special category data may be present (for example in HR, insurance or healthcare documents) — the Controller must ensure it has an Art. 9 condition before uploading it. |
| Categories of data subject | The Controller's employees, contractors, customers, clients, suppliers, claimants, tenants, patients and any other individuals named in the documents the Controller provides. |
Our obligations as processor
We will:
- Process on documented instructions only — process personal data only on your documented instructions, including on international transfers, unless required otherwise by law, in which case we will tell you first unless the law prohibits it. Your use of the service, and this DPA, are your instructions.
- Tell you if an instruction is unlawful — inform you if, in our opinion, an instruction infringes UK data protection law.
- Confidentiality — ensure that personnel authorised to process personal data are under a duty of confidence and have appropriate training.
- Security — implement the technical and organisational measures in section 5.
- Sub-processing — engage sub-processors only as set out in section 4.
- Assistance — assist you as set out in sections 6 and 7.
- Deletion or return — delete or return personal data as set out in section 8.
- Demonstrate compliance — make available the information needed to show compliance with Art. 28 and allow audits as set out in section 9.
We will not use personal data processed under this DPA to train, fine-tune or improve any general-purpose or publicly available AI model, and will bind our sub-processors to the same restriction. Contact for data protection matters: privacy@torvane.ai.
Sub-processors
You give general authorisation for us to engage sub-processors to provide the service. Our current sub-processors are maintained as a table in the Privacy Policy, which is the authoritative list:
| Sub-processor | Role | Location |
|---|---|---|
| Anthropic, PBC | Provides the large language models used to analyse documents and prepare drafts you ask for. Processes document content transiently to return results and does not use customer data to train its models. Your organisation's name (and any other names you tell us it trades under) is sent with each document, so that the model does not mistake your organisation for the other party on the document. | United States |
| Oracle Cloud Infrastructure (Oracle) | Application hosting and document storage. Uploaded documents are stored on disk attached to the application server in this region. | United Kingdom (London region, uk-london-1) |
| Supabase, Inc. | Managed PostgreSQL database. Holds account records, document metadata, extracted text, the search index and the audit log. Supabase runs this database on Amazon Web Services infrastructure in this region, so AWS is engaged by Supabase as its infrastructure provider. | United Kingdom (London region, on Amazon Web Services eu-west-2) |
| Backblaze, Inc. | Off-site encrypted backups. Holds a nightly copy of the document store and the database, encrypted at rest (AES-256), retained for 30 days and used only to restore the service after a loss. | European Union (Netherlands, eu-central-003) |
| Stripe Payments Europe, Limited (Stripe) | Payments. Card details are entered directly on Stripe's hosted checkout page and never reach Torvane. We send Stripe the subscribing administrator's email address, an organisation reference and the plan chosen. Stripe acts as our processor when it provides the payment service, and as an independent controller when it uses the data to prevent fraud, to meet its own legal obligations (including anti-money-laundering checks) and to improve its own products. It never receives document content. | Ireland and the United Kingdom; also the United States (Stripe, LLC) |
| No third-party email provider is currently engaged — email is generated by the service itself (to be confirmed before launch) | Delivery of account, security and notification email. Receives the recipient's name and email address and the content of the message. | Not applicable |
Stripe appears in this table for completeness: it processes the billing details of the customer that subscribes (for which we are the controller, not you), never the content of your documents.
Before a new sub-processor starts processing your personal data we will give you at least 30 days notice. You may object on reasonable data protection grounds within that period; if we cannot resolve your objection you may terminate the affected part of the service without penalty and receive a pro-rata refund of prepaid fees.
We impose data protection obligations on each sub-processor that are no less protective than those in this DPA, and we remain fully liable to you for their performance.
Security measures
We implement appropriate technical and organisational measures under Art. 32, taking into account the state of the art, the costs of implementation, and the risks to data subjects. These include:
- encryption of personal data in transit (TLS) and at rest, with separately encrypted storage for connected-mailbox credentials;
- tenant isolation: every data access is scoped to a single organization, enforced both at the query layer and by the database itself (row-level security on every table holding Controller data, with the service connected as a least-privilege database role that cannot bypass it), and covered by automated tests against a real PostgreSQL database;
- role-based access control and per-department access limits within a customer's organization;
- a comprehensive, exportable audit log of user actions and automated decisions;
- hostile-file defences on every ingested file: true file-type verification, malware scanning, blocking of macro-enabled and active content, and quarantine of anything suspicious — files are read, never executed;
- application hardening including a strict Content-Security-Policy and protection against injection and cross-site scripting;
- the ability for you to restore availability of personal data through export;
- a process for reviewing the effectiveness of these measures.
We may update these measures provided the level of protection is not reduced. Further detail: security overview.
Assisting with data subject requests
The service gives you the tools to respond to data subject requests yourself: search across all your documents, per-document access and correction, export in a structured machine-readable form, and an approval-gated deletion workflow.
If we receive a request from a data subject relating to your personal data, we will not respond to it directly (other than to acknowledge and redirect) and will tell you without undue delay. Taking into account the nature of the processing, we will assist you by appropriate technical and organisational measures, insofar as possible, in fulfilling your obligation to respond to requests to exercise rights of access, rectification, erasure, restriction, portability and objection.
Personal data breach and DPIAs
We will notify you without undue delay, and in any event within 48 hours, after becoming aware of a personal data breach affecting your personal data. The notification will describe, as far as we know it: the nature of the breach, the categories and approximate number of data subjects and records concerned, the likely consequences, the measures taken or proposed, and a contact point for more information. Where we cannot provide all of it at once, we will provide it in phases without undue further delay.
We will not make any public statement identifying you in relation to a breach without your prior written consent, unless legally required.
We will also provide reasonable assistance with your data protection impact assessments and any prior consultation with the ICO, in each case relating to the processing under this DPA.
Deletion and return of data
At any time during the subscription you may export all Customer Data using the product's export function, in a structured, commonly used, machine-readable format.
On termination or expiry, at your choice, we will delete or return all personal data and delete existing copies, unless UK law requires us to keep it. Unless you tell us otherwise, we will:
- keep the data available for export for 30 days after termination;
- then delete Customer Data, including from search indexes and derived stores, within 30 days of account closure or of a verified deletion request;
- delete or overwrite backups on our normal backup rotation, within 30 days;
- retain audit logs for up to 12 months;
- retain audit records of processing where required to evidence compliance.
We will confirm deletion in writing on request.
Audit rights
We will make available to you all information necessary to demonstrate compliance with Art. 28 and this DPA, and will allow for and contribute to audits, including inspections, conducted by you or an auditor you appoint.
In practice: we will first provide our security documentation and any third-party certifications or reports we hold — none currently held; we hold no ISO 27001 certification, SOC 2 report or equivalent third-party audit, and we will not claim one until we do. If that is not sufficient for your regulatory obligations, you may request an audit on at least 30 days' written notice, no more than once in any 12-month period (unless required by a supervisory authority or following a breach), during business hours, subject to confidentiality, and conducted so as not to disrupt the service or other customers. Each party bears its own costs, save that you will reimburse our reasonable costs for audits beyond the annual allowance.
International transfers
We will not transfer personal data outside the United Kingdom unless one of these applies: the destination is covered by UK adequacy regulations; the transfer is made under the International Data Transfer Agreement (IDTA) or the EU Standard Contractual Clauses together with the UK Addendum; or another lawful transfer mechanism applies.
Where the IDTA or SCCs+Addendum apply, they are incorporated into this DPA by reference, with you as data exporter and us (or the relevant sub-processor) as data importer, and the particulars in section 2 completing the relevant tables and annexes. We will carry out and document a transfer risk assessment and apply supplementary measures where needed.
Current destinations and mechanisms. Personal data contained in documents is processed in the United States by Anthropic, PBC at the moment of analysis. The United States is not covered by UK adequacy regulations for this purpose, so that transfer is made under the IDTA, or the EU Standard Contractual Clauses with the UK Addendum.
Hosting, storage and database infrastructure are located in the United Kingdom, so no transfer mechanism is required for personal data at rest. An encrypted backup copy of the document store and the database is held by Backblaze, Inc. in the European Union (Netherlands); the European Economic Area is covered by UK adequacy regulations, so no additional mechanism is required for that copy. The AI processing step above is the only routine transfer outside the UK and the EEA. The hosting provider (Oracle) and the database provider (Supabase) are headquartered outside the UK and may perform technical support and administration remotely from outside the UK; that access is covered by the Article 46 safeguards in each provider's own data processing agreement and does not involve storing personal data outside the UK.
General
This DPA takes effect on 8 October 2026 and continues while we process personal data on your behalf. Liability under this DPA is subject to the limitations in the Terms of Service. This DPA is governed by the law of England and Wales.
To raise a data protection matter or request a signed copy of this DPA, contact privacy@torvane.ai.