Privacy Policy

TORCHTECHNOLOGY LTD (a private company limited by shares under the Companies Law (Cap. 113) of the Republic of Cyprus, company registration number HE 496008)

Registered office: 25 Martiou 27, D. Michael Tower, Flat/Office 105A, Egkomi, 2408 Nicosia, Republic of Cyprus

Email: hello@torchtechnology.de

We only process personal data to the extent necessary to provide our website and services. The processing of personal data is generally only carried out with the user's consent or when processing is permitted by law.

A complete list of the service providers that process personal data on our behalf, including the country of processing and the applicable transfer safeguards, is set out in Section 11 (Subprocessors).

Our website and the Torch application services are hosted on the infrastructure of Railway Corporation, 548 Market St PMB 68956, San Francisco, CA 94104, USA ("Railway"). When you visit our pages, information is automatically stored in server log files that your browser transmits: browser type and version, operating system, referrer URL, hostname of the accessing device, time of request, and IP address. This data is technically necessary to deliver the site, is not merged with other data sources, and is collected on the basis of Art. 6(1)(f) GDPR — our legitimate interest in the secure and efficient operation of our services.

Railway is a US company and operates parts of its platform from the United States; the Torch product applications are deployed in Railway's EU region (Amsterdam, Netherlands). Transfers of personal data to the United States are safeguarded by Railway's active certification under the EU-US Data Privacy Framework and, in addition, by the EU Standard Contractual Clauses (Commission Implementing Decision (EU) 2021/914) incorporated into Railway's Data Processing Agreement (railway.com/legal/dpa). Railway's representative in the EU under Art. 27 GDPR is DP-Dock GmbH, Ballindamm 39, 20095 Hamburg, Germany.

When you contact us via the contact form, your details (name, email address, subject, message) are stored for the purpose of processing your inquiry. We will not share this data without your consent.

Contact messages are delivered through our email service provider Resend (see Section 11).

Processing is based on Art. 6(1)(b) GDPR if your inquiry is related to contract fulfillment or pre-contractual measures. In all other cases, processing is based on Art. 6(1)(f) GDPR.

If you book a demo, we process your name, email address, company details you choose to provide, and the selected time slot in order to schedule and hold the appointment. Slot reservations are stored in a datastore operated by Upstash, Inc. (San Jose, CA, USA); Upstash holds an active certification under the EU-US Data Privacy Framework, and its Data Processing Agreement additionally incorporates the EU Standard Contractual Clauses. Confirmation emails are sent through Resend (see Section 11).

Add-to-calendar links on the confirmation page open your own calendar application; we do not transmit your booking data to Google or any other calendar provider.

Processing is based on Art. 6(1)(b) GDPR (steps taken at your request prior to entering into a contract).

When you book a paid plan through our checkout, we process the data required to conclude the contract, bill you, and provide access, in particular name, email address, billing address, company and VAT details, selected plan, payment status, and Stripe customer number.

Payments are processed through Stripe. Our contracting entity is Stripe Payments Europe, Limited (Ireland); payment data may be transferred onward to Stripe, LLC in the United States, which holds an active certification under the EU-US Data Privacy Framework, with the EU Standard Contractual Clauses applying as a fallback under Stripe's Data Processing Agreement (stripe.com/legal/dpa). We do not receive full card or bank details.

The legal bases are Art. 6(1)(b) GDPR for contract performance, Art. 6(1)(c) GDPR for tax and commercial-law obligations, and Art. 6(1)(f) GDPR for fraud prevention and payment security.

Our website does not use cookies for tracking or analytics purposes. Should this change, we will update this privacy policy accordingly and implement a consent solution if required.

We currently use no web analytics service and no advertising trackers on this website. Should this change, we will inform you here in advance.

When you use the Torch products (Torch Platform, Torch Listings, Torch Studio, Torch Core), we process the data you provide in your workspace: account and login data, organization and billing details, and the content you upload or create — product data, images, brand information and prompts ("customer content"). Processing is based on Art. 6(1)(b) GDPR.

Databases, authentication and file storage are operated by Supabase Pte. Ltd. (Singapore). Our database, authentication and storage instances are pinned to Supabase's EU region (Frankfurt, Germany); Supabase support and platform telemetry may involve processing in the United States or Singapore. These transfers are safeguarded by the EU Standard Contractual Clauses (2021/914, Modules Two and Three) incorporated into Supabase's Data Processing Addendum (supabase.com/legal/dpa).

To generate text, we send the relevant parts of your customer content (prompts and product data) to OpenRouter, Inc. (New York, USA), an AI model gateway. OpenRouter does not use your inputs or outputs for model training and by default does not retain prompt content; the model providers OpenRouter routes requests to (for example OpenAI, Anthropic or Google) act as OpenRouter's own subprocessors under its Data Processing Agreement, which incorporates the EU Standard Contractual Clauses (Module Two).

To generate and edit images, we send image prompts and product images to fal – Features & Labels, Inc. (San Francisco, USA), an AI inference platform. fal processes this data only as our processor, retains it no longer than the term of our agreement, claims no rights in the generated outputs, and may use only de-identified data to improve its services. Transfers are safeguarded by the EU Standard Contractual Clauses (Module Two) incorporated into fal's Data Processing Addendum (fal.ai/legal/data-processing-addendum).

Invitation and notification emails are sent through Resend, a service of Plus Five Five, Inc. (San Francisco, USA), which holds an active certification under the EU-US Data Privacy Framework (EU and UK; email data is stored in the United States) and whose Data Processing Agreement additionally incorporates the EU Standard Contractual Clauses. Emails triggered by our authentication provider, Supabase (account confirmation, sign-in, password reset, change of email address), are also delivered through Resend.

We do not sell personal data, and we do not use customer content for advertising.

Newsletter (weekly email)

If you are a registered user and have expressly agreed, we send you our newsletter once a week (in English): one concrete tip for more revenue, plus occasional product updates and offers from TorchTechnology. You give your consent in your account: during onboarding, on the home page or under Settings → Notifications. Without your consent you will not receive this email.

For this we process your email address and the first name from your account (for the greeting), your choice together with when and where you made it, and, for every email sent, the recipient address, the time of sending and the send status. The legal basis is your consent under Art. 6(1)(a) GDPR; it is also the prior express consent that Section 7(2) No. 2 of the German Act against Unfair Competition (UWG) requires for advertising by email.

The emails are sent through Resend (see above and Section 11). We measure neither opens nor clicks: Resend's open and click tracking is switched off, and the links in the emails lead straight to our pages without passing through a measurement service.

You can withdraw your consent at any time with effect for the future: with the unsubscribe link in every email, with your email program's unsubscribe function (one-click unsubscribe) or in your account under Settings → Notifications.

We keep your choice and the delivery records for as long as your account exists, including after you withdraw your consent. This lets us prove whether and when you consented (Art. 7(1) GDPR; legal basis for this: Art. 6(1)(f) GDPR). After you withdraw, you will receive no further emails. When your account is deleted, this information is deleted or no longer linked to you.

Torch Listings analyzes publicly available marketplace data — product listings, prices, rankings, reviews and seller information from e-commerce marketplaces such as Amazon. Where such data relates to identifiable persons (for example, sole traders selling under their own name), the following applies (Art. 14 GDPR):

Categories: publicly listed product, price, ranking, review and seller information. Source: publicly accessible marketplace pages and marketplace data services. Purpose: market and trend analyses for our customers. Legal basis: Art. 6(1)(f) GDPR — our legitimate interest, and that of our customers, in market intelligence compiled from public sources.

We collect this data through the specialised service Apify Technologies s.r.o. (Prague, Czech Republic).

You may object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR) by writing to hello@torchtechnology.de.

We use the following service providers to process personal data on our behalf. For providers outside the European Economic Area, the listed transfer safeguard applies. Status of this list: 27 October 2026.

Railway Corporation (USA) — hosting of the website and all Torch application services (EU deployment region: Amsterdam); server logs and IP addresses. Safeguards: EU-US Data Privacy Framework (active certification) and EU Standard Contractual Clauses (railway.com/legal/dpa).

Supabase Pte. Ltd. (Singapore) — databases, authentication and file storage for the Torch products, pinned to the EU region Frankfurt; support and telemetry may be processed in the US/Singapore. Safeguards: EU Standard Contractual Clauses, Modules Two and Three (supabase.com/legal/dpa).

Stripe Payments Europe, Limited (Ireland) — payment processing and billing. Onward transfers to Stripe, LLC (USA) are safeguarded by Stripe LLC's active EU-US Data Privacy Framework certification and the EU Standard Contractual Clauses (stripe.com/legal/dpa).

OpenRouter, Inc. (USA) — AI gateway for text generation; carries prompts and product copy. No training on customer inputs or outputs; no prompt retention by default. Safeguards: EU Standard Contractual Clauses, Module Two (openrouter.ai/data-processing-agreement).

fal – Features & Labels, Inc. (USA) — AI image generation; carries image prompts and product images. No model training on customer content (de-identified data only); retention bounded by the contract term. Safeguards: EU Standard Contractual Clauses, Module Two, under fal's Data Processing Addendum (fal.ai/legal/data-processing-addendum).

Apify Technologies s.r.o. (Czech Republic, EU) — collection of publicly available marketplace data; run data is processed in the EU and the United States (AWS, MongoDB Atlas, Mezmo, Snowflake). Safeguards for processing outside the EEA: EU Standard Contractual Clauses under Apify's Data Processing Addendum (docs.apify.com/legal/data-processing-addendum).

Plus Five Five, Inc. d/b/a Resend (USA) — transactional email (invitations, contact and booking confirmations, account and sign-in emails) and the weekly newsletter to registered users who have consented (Section 9). Safeguards: EU-US Data Privacy Framework (active certification, EU and UK extensions) and EU Standard Contractual Clauses (resend.com/legal/dpa).

Upstash, Inc. (USA) — datastore for demo-booking slot reservations. Safeguards: EU-US Data Privacy Framework (active certification) and EU Standard Contractual Clauses (upstash.com/trust/dpa.pdf).

We will update this list when a provider is added or replaced. Business customers can request our Data Processing Agreement, including subprocessor flow-down terms, at hello@torchtechnology.de.

This site uses SSL/TLS encryption for security and to protect the transmission of confidential content. You can recognize an encrypted connection by the address bar of your browser changing from "http://" to "https://" and by the lock icon in your browser bar.

TORCHTECHNOLOGY LTD develops and operates its products in conformity with European Union law. Personal data is processed in accordance with the EU General Data Protection Regulation (GDPR), and our services and AI features are designed to align with the EU Artificial Intelligence Act (AI Act).

Where our products generate content using artificial intelligence, a provenance record identifying that content as AI-generated is stored with each generated version, a human remains in control of what is published, and the systems are operated with appropriate human oversight. We do not use AI for practices prohibited under the AI Act.

Personal data is hosted and processed within the European Union wherever possible. Details on your data-protection rights can be found in the sections above.

You have the right to free information about your stored personal data, its origin and recipients, and the purpose of data processing, as well as a right to correction or deletion of this data (Art. 15–17 GDPR).

You have the right to request restriction of processing of your personal data (Art. 18 GDPR) and the right to data portability (Art. 20 GDPR).

Where we process your personal data on the basis of Art. 6(1)(f) GDPR (e.g. server log files and marketplace data), you have the right to object to this processing at any time on grounds relating to your particular situation (Art. 21 GDPR). Simply send your objection to hello@torchtechnology.de.

You can withdraw any consent you have given, for example for the newsletter (Section 9), at any time with effect for the future, without affecting the lawfulness of the processing carried out before the withdrawal (Art. 7(3) GDPR).

If you believe that the processing of your data violates data protection law, you have the right to lodge a complaint with a supervisory authority (Art. 77 GDPR).

The use of contact data published as part of the legal notice obligation for sending unsolicited advertising is hereby objected to. The operator expressly reserves the right to take legal action in the event of unsolicited promotional information, such as spam emails.