Data Protection & GDPR
Our commitments as a controller and processor under UK and EU GDPR.
1. Roles
CA Capital Limited (trading as Torvane) is a data controller for account and billing data, and a data processor for customer content processed by AI workers on your instruction — including content reached through connected systems you authorise. A Data Processing Agreement (DPA) is available for all business and enterprise customers.
2. Security measures
We apply encryption in transit and at rest, least-privilege access, and tenant isolation enforced by row-level security in the database rather than by application code. AI workers run sandboxed with least-privilege permissions, every action is permission-checked at the Tool Gateway, and consequential actions are written to an audit trail that rejects edits and deletions. Independent penetration testing and formal certification are planned before general availability; we do not claim them today.
3. Sub-processors
We maintain a list of sub-processors and provide prior notice of changes so you may object where required.
4. Data subject requests
We assist controllers in responding to data subject requests within statutory timeframes and provide tools to export, rectify and erase data.
5. Breach notification
We will notify affected customers without undue delay and, where required, within 72 hours of becoming aware of a personal data breach.
6. Certifications
Torvane is built to SOC 2 and ISO 27001 control standards and to UK and EU GDPR. Formal certification is in progress; our current data-protection controls and DPA are available for review under NDA.
7. Contact
Data Protection Officer — torvaneai@gmail.com. CA Capital Limited is registered with the UK Information Commissioner’s Office, registration number ZC183768, at 320 Firecrest Court, Centre Park, Warrington, United Kingdom, WA1 1RG. If we cannot resolve your concern, you have the right to lodge a complaint with the ICO (ico.org.uk).
Questions about our policies?
Our UK data protection team answers policy questions directly.
Email our privacy team