Who we are
Torvane is operated by CA CAPITAL LIMITED ("we", "us"), which is the data controller for the personal data described in this policy. We are a company registered in England and Wales under company number 10848369.
We are registered with the Information Commissioner's Office as a data controller under registration number ZC183768, under the Data Protection (Charges and Information) Regulations 2018. You can view our entry on the ICO register, which is the public record of our registration.
For any question about this policy or how we handle personal data, contact our privacy team at privacy@torvane.ai.
Two different roles. For account and billing data we are the controller. For the contents of documents you upload to Torvane, you are the controller and we act as your processor — we only process that content on your instructions. Those terms are set out in our Data Processing Addendum.
What personal data we collect
Account data
When you create an organization we collect your name, work email address, the organization's name and industry, your role, and a securely hashed password. We never store your password in a form we can read.
Document content
Torvane reads the documents you or your connected sources send it. Those documents frequently contain personal data about third parties — customers, employees, suppliers, claimants — such as names, addresses, financial details and dates. We do not choose what is in them; you do. We process this content solely to provide the service to you, as your processor.
Drafts. If your organisation uses drafting, Torvane stores the emails and letters it drafts for you from your documents, any changes you make to them, and the recipient address if you type one. Torvane does not send them: you copy or download a draft, or open it in your own email app.
Usage and technical data
We record activity needed to run and secure the service: sign-in events, actions taken in the product (recorded in your organization's audit log), the files processed and the decisions our system made about them, and standard server logs including IP address, browser type and timestamps.
Corrections and learned rules
When someone in your organisation corrects how Torvane has filed or described a document, we store a record of the correction: who made it, when, which document it concerned, and the values before and after. Torvane may turn a correction into a rule — for example, that documents from a named supplier that Torvane reads as receipts are in fact invoices. A rule records the supplier's name as it appeared on the document, the value it sets, who created it, and a summary of the check Torvane runs before using it, which can include the names of a few of your own documents it would have affected. Rules and correction records are kept with your organisation's other data, in the same place, under the same access controls, and are deleted when your account is deleted. They are used only for your organisation's documents. They are never shared with, or used for, any other customer, and they are not used to train any AI model. A rule a manager or employee asks for, and any rule whose check shows it would change other documents, is not used until an administrator confirms it. An administrator can see, confirm, turn off and retire every rule on "What Torvane has learned". A retired rule is never used again and stays in the rule's history, with who changed it and when, until your account is deleted.
Learning from your work. If your organisation turns on learning, Torvane also keeps a short record each time someone corrects a document, approves or moves a filing, answers a question about a document, or uses, edits or discards a draft: who did it, when, which document or draft, the fields and values that changed (for example the department before and after, or that a draft's sign-off was changed), and any reason the person chose or typed when discarding a draft. These records never contain a document's text or a draft's full text. For each draft we also keep the text as Torvane first wrote it, so that it can tell what people change.
Your drafting preferences. When you make the same change to the same type of draft several times, for example always signing off with your first name, Torvane asks you once whether to do that from now on. Only if you say yes does it become a preference. A preference applies to your own drafts only. No one else in your organisation can see or use it. You can see, turn off, give an end date to or retire each one on "What Torvane has learned", and Torvane never asks again about a change you said no to. Preferences are applied by Torvane itself and are not sent to our AI provider.
Switching learning off. An administrator can switch learning off for the whole organisation under Admin → Features. Each person can also switch off "Learn from my edits" in their Account settings; Torvane then keeps no learning record of that person's corrections, approvals, answers or drafts, and asks them nothing about preferences. Decisions they make about existing rules and preferences are still recorded, and preferences they confirmed earlier keep applying until they turn them off.
Obligations and deadlines
Torvane stores the dates it extracts from your documents — payment dates, expiry, renewal and notice deadlines — together with the sentence each came from, the document and the counterparty named on it, and each deadline's status (open, acknowledged, done or dismissed). Where a date is not printed but follows from terms the document states, such as a notice deadline counted back from a renewal date, both source sentences are stored as its evidence. These records are kept and deleted with your organisation's other data, under the same access controls.
Notification email
We send two kinds of email. Account and security email — confirming your address, resetting your password, telling you your password was changed, and inviting colleagues — is necessary to operate your account and is not optional. The weekly document briefing is optional: it summarises your organisation's week and, because it is a summary of your documents, it contains document metadata — counts, upcoming renewal and due dates, and document names, which may themselves include supplier or customer names. It contains no document contents and no attachments. You can turn it off in Account settings or with the one-click unsubscribe link in every briefing, and we honour that immediately. Turning it off never affects account and security email.
Our emails contain no tracking pixels and no remote images; we do not record whether you opened one.
Billing data
If you subscribe to a paid plan, payment is handled by Stripe. Your card details go directly to Stripe's hosted checkout page; Torvane never sees or stores them. We send Stripe the subscribing administrator's email address, a reference for your organisation and the plan chosen, and we receive back Stripe's customer and subscription references and the subscription's status, which is how your plan is kept up to date.
The Stripe company you deal with is Stripe Payments Europe, Limited — the Stripe entity a United Kingdom account contracts with under Stripe's Services Agreement (General Terms, last modified 18 November 2025); Stripe Payments UK Ltd is an additional party where Stripe's Financial Services Terms or other service terms say so. Under Stripe's Data Processing Agreement (last updated 18 November 2025) Stripe has two roles: it is our processor when it provides the payment service, and an independent controller when it uses the data to monitor, prevent and detect fraud, to comply with the law (including anti-money-laundering screening), and to analyse, improve and develop its own products and services. For those purposes Stripe's own privacy policy applies. Stripe is listed in the table below.
Why we process it, and our lawful basis
Under UK GDPR we must have a lawful basis for each purpose. Ours are:
| Purpose | Data used | Lawful basis |
|---|---|---|
| Providing the service — reading, classifying, renaming, filing and searching your documents | Account data, document content | Contract (Art. 6(1)(b)) — necessary to deliver what you signed up for. For third-party personal data inside documents, you are the controller and determine the basis. |
| Creating and administering your account | Account data | Contract (Art. 6(1)(b)) |
| Securing the service — malware and file scanning, abuse prevention, tenant isolation, audit logging | Usage data, file metadata | Legitimate interests (Art. 6(1)(f)) — keeping the service and its customers safe |
| Improving reliability and performance of our own systems | Aggregated usage and technical data | Legitimate interests (Art. 6(1)(f)) |
| Service and security notifications | Account data | Contract / Legitimate interests |
| Optional marketing email, if we introduce it | Account data | Consent (Art. 6(1)(a)) — withdrawable at any time |
| Non-essential cookies, if we introduce them | Device data | Consent (PECR reg. 6 + Art. 6(1)(a)) |
| Meeting tax, accounting and legal obligations | Billing data | Legal obligation (Art. 6(1)(c)) |
Where we rely on legitimate interests we have considered whether those interests are overridden by your rights, and you can object at any time (see Your rights).
We do not train public AI models on your documents
Your documents are not used to train public AI models. We do not use the contents of documents you upload to train, fine-tune or improve any general-purpose or publicly available AI model, and we do not permit our AI provider to do so on our behalf.
Torvane uses AI models to read and understand a document at the moment it is processed for you. The document text is sent to the model to produce that result and is not retained by the model provider for training purposes. Where Torvane learns from your corrections, that learning stays inside your own organization — a rule you create applies to your documents only and is never shared with, or visible to, any other customer.
Automated decision-making
Torvane organises and flags documents. It reads, classifies, names and files them, extracts dates and raises reminders. It does not make decisions that produce legal or similarly significant effects on individuals, within the meaning of UK GDPR Article 22.
Anything consequential goes to a person: a document Torvane is unsure about waits for review instead of being filed; deleting a document always needs a person's approval; a learned rule that a manager or employee asks for, or that would change other documents, is held for an administrator before it is used; and Torvane does not pay, send, sign or submit anything on your behalf. Every automated step is recorded in your organisation's audit log, and a person can override any of them.
International transfers
Some processing takes place outside the UK. The AI models that read your documents are provided by Anthropic, PBC, which is based in the United States, so document content is processed there at the moment it is analysed.
The United States is not covered by a UK adequacy decision for these purposes. The mechanism we rely on for that transfer is the UK International Data Transfer Agreement (IDTA), or the EU Standard Contractual Clauses together with the UK Addendum — the safeguards permitted by Article 46 of the UK GDPR. We also carry out a transfer risk assessment and apply additional technical measures where they are needed.
Where a provider is covered by an adequacy decision, we may rely on that instead.
Everything else stays in the UK, with one exception. Your documents and account data are hosted in the United Kingdom. The transfer described above applies only to the AI processing step — the moment a document's content is analysed. Data at rest, including the documents themselves, the extracted text, the search index and your account records, is stored in the UK.
The exception is our backup. An encrypted backup copy of the document store and the database is held by Backblaze, Inc. in the European Union (Netherlands), retained for 30 days, and used only to restore the service after a loss. The United Kingdom recognises the countries of the European Economic Area as providing adequate protection under the UK adequacy regulations, so no additional transfer mechanism is required for that copy.
One qualification, stated plainly. Our hosting provider (Oracle) and
our database provider (Supabase) are both headquartered outside the UK. Your data is
stored only in their London regions — Oracle's uk-london-1 for documents,
and Supabase's London region, which runs on Amazon Web Services eu-west-2,
for the database — and we do not replicate it elsewhere, but each provider's technical
support and administrative functions may be carried out from outside the UK. Any such
access is remote administrative access rather than a transfer of your documents, and it
is covered by the Article 46 safeguards in each provider's own data processing
agreement — the IDTA, or the SCCs with the UK Addendum.
Payments. Stripe's services are provided from Ireland and the United Kingdom, and billing data is also transferred to Stripe, LLC in the United States. Stripe makes those transfers under its own Data Transfers Addendum (part of its Data Processing Agreement), which relies on the Data Privacy Framework, the EU Standard Contractual Clauses and the UK International Data Transfer Agreement. Document content is never sent to Stripe.
You can request a copy of the relevant safeguards from privacy@torvane.ai.
How long we keep it
We keep personal data only as long as we need it for the purpose it was collected for. These are our current periods:
| Data | Retention |
|---|---|
| Account data | Kept while the account is active, then deleted within 30 days of the account closing |
| Uploaded documents and derived data (extracted text, search index) | Kept for the life of the account. Deleted within 30 days of account closure, or on a verified deletion request — see the DPA |
| Audit logs | Up to 12 months — retained after document deletion so the record of what happened survives |
| Server and security logs | Up to 12 months |
| Backups | Cycled out within 30 days on our normal backup rotation, so deleted data ages out of backups too |
| Drafts | Kept until you delete them, or the document they were drafted from is deleted; deleted within 30 days of account closure |
| Learning records and drafting preferences | Kept while learning is on and your account is open, so that you can see why Torvane does what it does; a document's learning records are deleted with the document; all deleted within 30 days of account closure. A preference you retire stays in your history and is never applied. |
| A draft's first version and outcome | Kept with the draft, and deleted with it |
| Billing records | 6 years, to meet UK tax and accounting law |
Deletion inside the product is deliberately two-step: a deletion request is raised and an administrator in your organization approves it. That prevents a single mistaken click from destroying records, and every deletion is audited.
Your rights
Under UK GDPR and the Data Protection Act 2018 you have the right to:
- Access — get a copy of the personal data we hold about you.
- Rectification — have inaccurate data corrected and incomplete data completed.
- Erasure — have your data deleted where there is no overriding reason for us to keep it.
- Restriction — ask us to pause processing while a concern is resolved.
- Portability — receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another provider. The product's export produces exactly this.
- Object — object to processing based on legitimate interests, and to direct marketing at any time.
- Withdraw consent — where we rely on consent, withdraw it at any time without affecting processing already carried out. Cookie choices can be changed whenever you like through Cookie settings.
- Not be subject to solely automated decisions producing legal or similarly significant effects. Torvane classifies and files documents automatically, but a person in your organization reviews low-confidence results and can override any decision the system makes.
How to exercise them
Email privacy@torvane.ai. We will respond within one month, and will tell you if we need to extend that (we may, by up to two further months, for complex requests). We may ask for information to verify your identity. There is no fee unless a request is manifestly unfounded or excessive.
If the personal data is inside a customer's documents, that customer is the controller: we will refer you to them and assist them in responding.
Complaining to the ICO
You have the right to complain to the Information Commissioner's Office (ICO), the UK's supervisory authority for data protection. We would appreciate the chance to address your concerns first, but you can go to the ICO at any time:
- Website: ico.org.uk/make-a-complaint
- Helpline: 0303 123 1113
- Post: Information Commissioner's Office, Wycliffe House, Water Lane, Wilmslow, Cheshire, SK9 5AF
How we protect it
Security is a design constraint of this product, not a policy statement. In practice:
- Encryption — data is encrypted in transit (TLS) and at rest; stored credentials for connected mailboxes are encrypted with a separate key.
- Tenant isolation — every query is scoped to your organization. No customer can see another customer's documents, folders, search results or audit log. This is enforced by the database itself as well as by our code: row-level security applies to every table holding customer data, and the service connects as a restricted database role that cannot bypass it.
- Role-based access control — admin, manager and employee roles, plus per-department access limits so staff see only the documents they should.
- Audit logging — who did what, and every automated decision the system made, recorded and exportable.
- File security — every uploaded file is treated as hostile. We verify the true file type against its extension, scan for malware, block macro-enabled and active content, defend against decompression bombs and malicious XML, and quarantine anything suspicious. Files are only ever read, never executed. See our security overview.
- Application hardening — a strict Content-Security-Policy, downloads served as attachments with the verified content type, and no third-party scripts on this site.
No system is perfectly secure. If we suffer a personal data breach that is likely to result in a risk to individuals' rights, we will notify the ICO within 72 hours of becoming aware of it, and affected customers without undue delay.
Children's data
Torvane is a business product. It is not directed at children and we do not knowingly allow anyone under 18 to create an account. If you believe a child has provided us with personal data, contact us and we will delete it.
Documents you upload may contain personal data about children (for example in HR or care records). Where that happens you are the controller for that data and are responsible for having a lawful basis to process it.
Changes to this policy
We may update this policy as the service changes. The "last updated" date at the top of the page always reflects the current version. If a change materially affects how we handle your personal data we will tell you — by email or an in-product notice — before it takes effect, and where the change relies on consent we will ask again.
Questions about any of this: privacy@torvane.ai.