Torvara Privacy Policy

Applies to torvara.co, Torvara HQ, and every client console and portal we operate (together, the "Services") · Effective date: [EFFECTIVE DATE] · Last updated: [LAST UPDATED DATE]

1. Who we are and what this policy covers

This Privacy Policy is issued by [TORVARA ENTITY] ("Torvara", "we", "us"), with its principal place of business at [TORVARA ADDRESS]. It explains how we collect, use, share, and protect personal information when you use the Services, which include:

• our website at torvara.co and any pages we host under our name;
• Torvara HQ, our internal agency application, and Sam's Desk, an internal to-do and daily-brief application used by our founders;
• the branded web applications we build and operate for our business clients (each a "console"), and any customer-facing portal, booking page, contact form, or chat window that is part of a console; and
• text messages, emails, and chat conversations sent through the Services.

Two roles. When you visit torvara.co or contact us directly, Torvara decides how your information is used and is the "business" or "controller." When you interact with a console or portal run for one of our clients (for example, you book a class at a fitness club, request a quote from an advertising company, or ask a question about a mortgage), that client is the controller of your information and Torvara processes it on the client's behalf under a written data processing agreement; that agreement also lets Torvara use it for its own purposes, including selling or sharing it, as described in Section 4 and where the law allows. In that situation, the client's own privacy policy also applies, and requests about your information may be forwarded to the client. This policy describes both situations; where a section applies only to one, it says so.

If you do not agree with this policy, please do not use the Services.

2. Information we collect

2.1 Categories

2.2 Sources

We collect information (a) directly from you when you fill out a form, book, call, text, chat, or send us media; (b) from the client business, which enters and imports its own customer records; (c) automatically from your device when you use a console; and (d) from service providers such as our telephony, email, and advertising platforms, which supply delivery status, call and message metadata, and campaign metrics.

3. How we use information

We use personal information for the following purposes and on the following bases:

• Providing the Services: running each console, storing the client's records, delivering bookings, quotes, invoices, and reminders, and giving the client's staff access according to their seat.
• Communicating with you: sending texts and emails you have agreed to receive, including missed-call text-backs, appointment reminders, follow-ups, and review requests; answering your questions through the AI concierge or a human. Marketing messages are sent only with your consent as described in Section 6, and you can stop them at any time.
• Improving and securing the Services: debugging, preventing abuse and fraud, verifying access codes, keeping backups, and analyzing how features are used in aggregate.
• Advertising for our clients: creating, placing, and measuring ads on Meta and Google using the client's own ad accounts. We do not build advertising profiles of individuals ourselves, and we do not upload customer lists to ad platforms unless the client instructs us to and has the right to do so.
• Content: using photos, video, and testimonials in the client's marketing only when a signed consent is on file.
• Our own business purposes: including marketing our services, building lead and prospect lists, and selling or sharing personal information as described in Section 4.
• Legal and compliance: keeping records of consent, responding to lawful requests, enforcing our terms, and protecting rights and safety.

3.1 Automated decisions and artificial intelligence

Some parts of the Services use artificial-intelligence models, including a concierge chat assistant that answers common questions from a knowledge base the client has verified, and drafting tools that propose captions, ad copy, images, and video for a human to review. The AI concierge is identified as an automated assistant, may make mistakes, and does not make decisions that have legal or similarly significant effects on you (it does not approve loans, set prices, or deny service). Anything that spends money, publishes content, or sends a bulk message requires a human to approve it. Conversations with the concierge are stored with the client's records so that a person can follow up. We do not use your personal information to train AI models. [Counsel: confirm against Anthropic account data-retention settings before publication]

4. How we share information

We share personal information as described in this section. We may also sell or share personal information, including business contact details and information about leads and prospects, with third parties such as marketing, advertising, and data partners, where the law allows. Where the law gives you the right to opt out of the sale or sharing of your personal information, you can do so as described in Section 10. [Counsel: confirm the categories sold or shared, the kinds of recipients, and whether a data-broker registration applies (for example California, Texas, Oregon, Vermont).]

4.1 With the client business

Information you provide through a console or portal belongs to the client business you are dealing with, and its authorized staff can see it.

4.2 With service providers (subprocessors)

We use the following providers to run the Services. Each is bound by its own terms to use the data only to provide its service to us.

We keep the current list at [SUBPROCESSOR LIST URL]. Clients receive advance notice of changes under our data processing agreement.

4.3 Other disclosures

• Legal: to comply with law, subpoena, or court order; to enforce our agreements; or to protect the rights, property, or safety of Torvara, our clients, or others.
• Business transfers: if Torvara is involved in a merger, acquisition, financing, or sale of assets, information may be transferred as part of that transaction, subject to this policy.
• With your direction: when you ask us to share something (for example, to post a testimonial you approved).

5. Cookies and local storage

Our consoles do not use third-party advertising cookies or tracking pixels. They use your browser's local storage to keep your data and settings on your device, and a session cookie (planned) to keep you signed in to the back end. Client consoles keep that data in local storage only, with no sync, unless a feature says otherwise; Torvara HQ and Sam's Desk (both internal) additionally sync their data to the hosting platform's artifact database so both founders see the same records. On your first visit, every HQ and console page shows a short notice that the app keeps your work in local storage and sets no tracking cookies; pressing OK stores a small record of that notice on your device. Console pages fetch typefaces from Google Fonts and map tiles from OpenStreetMap; those servers receive your IP address as part of the request. Our full Cookie and Local Storage Notice, including the storage keys we use and how to clear them, is at https://claude.ai/code/artifact/c5a58f88-8293-4695-8053-292152cca1ac#cookies.

6. Text messages, email, and your consent

We send text messages only with your prior express consent, which you give by texting a keyword, checking an unchecked box on a form, or replying to confirm. The consent names the specific business that will text you. Consent is not a condition of purchase. Message frequency varies by the program you joined. Message and data rates may apply. Reply STOP to any message to stop receiving texts from that business, and HELP for help. We observe quiet hours and do not send marketing texts before 9:00 a.m. or after 9:00 p.m. in your local time (earlier cut-offs apply where state law requires). Automated missed-call text-backs are sent in response to your call to the business; if you do not want them, reply STOP.

Marketing emails include a working unsubscribe link and our postal address; we honor unsubscribes within ten business days and typically immediately. Transactional messages (booking confirmations, receipts, security notices) may be sent without marketing consent. Full consent terms are in our SMS and Communications Consent document at https://claude.ai/code/artifact/c5a58f88-8293-4695-8053-292152cca1ac#sms.

Mobile information (your phone number and opt-in status) is never shared with third parties or affiliates for their marketing purposes; it is shared only with our messaging providers to deliver the messages you agreed to receive.

7. Children

The Services are not directed to children, and we do not knowingly collect personal information from anyone under 13. If we learn we have collected information from a child under 13, we will delete it. For businesses that serve minors (for example, a fitness club with youth programs), the parent or guardian is the customer; a minor's name and program details are stored only as part of the parent's record, and we do not text or email the minor. Ads we manage are never targeted to people under 18. Media consent for anyone under 18 requires a parent or guardian's signature. If you believe a child has provided information to us, contact us at [PRIVACY EMAIL].

8. Retention

We keep personal information for as long as needed to provide the Services, for our own business purposes described in Section 4, and as required by law, then delete or de-identify it. Typical periods:

• Customer relationship records: for the life of the client's engagement, then deleted or returned within 60 days of termination under the data processing agreement, unless the client instructs otherwise. Information Torvara keeps for its own purposes under Section 4 is kept for as long as it is useful and the law allows.
• Consent records (texts, email, media): for as long as the consent is relied upon plus [CONSENT RECORD RETENTION, e.g. 4 years] after it is withdrawn, so we can prove consent if challenged.
• Opt-out records: indefinitely, so we do not contact you again.
• Message logs at our telephony provider: [TWILIO LOG RETENTION] or the provider's default, whichever is shorter.
• Backups: encrypted backups are kept for [BACKUP RETENTION] and then overwritten.

9. Security

We use reasonable administrative, technical, and physical safeguards appropriate to a business of our size, including: encrypted connections (TLS) to every hosted page and provider; local backups encrypted with AES-GCM under a passphrase only the account holder knows; per-seat access controls and access codes for client portals [Counsel: representation to be softened or scheduled until the spine ships — today's sign-in is a seat button with no credential]; escaping of user content before display to prevent script injection; no execution of untrusted code; and a rule that no automated system spends money, publishes content, or sends bulk messages without human approval. When our own back end is live it will use HttpOnly, Secure session cookies, rate limiting, server-side authorization checks, and encryption at rest. No method of transmission or storage is completely secure, and we cannot guarantee absolute security. If we learn of a breach affecting your information, we will notify affected people and regulators as required by the laws of your state, including the Michigan Identity Theft Protection Act and the Florida Information Protection Act.

10. Your rights and choices

Regardless of where you live, you may ask us to:

• Access the personal information we hold about you and receive a copy in a portable format;
• Correct inaccurate information;
• Delete your information, subject to legal retention needs (for example, we keep your opt-out record so we do not contact you again);
• Opt out of marketing texts (reply STOP) and marketing emails (unsubscribe link), and of the sale or sharing of your personal information, including through browser-based opt-out preference signals where the law requires us to honor them;
• Limit the use of sensitive personal information (we do not collect it intentionally, but will honor such a request);
• Appeal a decision we make on your request.

To exercise a right, email [PRIVACY EMAIL] or write to [TORVARA ADDRESS] with "Privacy request" in the subject line, or ask the client business you deal with. We will verify your identity by matching the details you give us to our records and, where needed, by sending a confirmation code to the phone number or email on file. You may use an authorized agent if the agent provides your written permission. We will respond within 45 days (extendable once by 45 days where the law allows) and will not discriminate against you for exercising your rights. Where the client business is the controller, we will forward your request to it and assist it in responding.

11. State-specific disclosures

11.1 California

We do not believe Torvara currently meets the thresholds that make the California Consumer Privacy Act (as amended by the California Privacy Rights Act) apply to it. If it does apply, California residents have the rights listed in Section 10, and the following applies: in the preceding 12 months we collected the categories of personal information listed in Section 2 for the purposes in Section 3, disclosed them for business purposes to the service providers in Section 4, and sold or shared personal information only as described in Section 4. [Counsel: the CCPA can apply to a business that earns 50% or more of its annual revenue from selling or sharing personal information, whatever its size.] We do not use or disclose sensitive personal information for purposes other than those permitted by the CCPA. We do not knowingly sell or share the personal information of consumers under 16. You may exercise your rights through the contact methods in Section 10; we do not offer financial incentives in exchange for personal information.

11.2 Florida

The Florida Digital Bill of Rights applies to controllers above a large revenue threshold, which Torvara does not meet; we nonetheless honor the rights in Section 10 for Florida residents. We comply with the Florida Telephone Solicitation Act for text messages sent to Florida numbers, including its consent and calling-hours rules, and with the Florida Information Protection Act for breach notification.

11.3 Michigan

We comply with the Michigan Identity Theft Protection Act for breach notification and with Michigan consumer-protection law. Michigan residents may exercise the rights in Section 10.

11.4 Other states

Residents of Colorado, Connecticut, Virginia, Utah, Texas, Oregon, Montana, Delaware, Iowa, Nebraska, New Hampshire, New Jersey, Tennessee, Minnesota, Maryland, Kentucky, Indiana, Rhode Island, and other states with comprehensive privacy laws may have rights similar to those in Section 10, including the right to appeal a denied request. We honor those rights through the same contact methods, whether or not a specific law requires it.

11.5 Outside the United States

The Services are intended for use in the United States and are hosted here. If you use them from elsewhere, you understand your information will be processed in the United States.

12. Third-party sites and services

Consoles may link to a client's social profiles, Google Business Profile, payment processor, or other third-party sites. Those sites have their own privacy practices, and this policy does not cover them.

13. Changes to this policy

We may update this policy from time to time. We will post the new version at https://claude.ai/code/artifact/c5a58f88-8293-4695-8053-292152cca1ac#privacy with a new "last updated" date, and, for material changes, notify client businesses by email at least 14 days before the change takes effect so they can inform their customers. Continued use of the Services after the effective date means the updated policy applies.

14. Contact us

[TORVARA ENTITY]
[TORVARA ADDRESS]
Email: [PRIVACY EMAIL]
Phone: [SUPPORT PHONE]

If you are dealing with one of our client businesses, you may also contact that business directly using the details on its console or portal.