Security & privacy
Your data. Your results. Your control.
EU hosting in Frankfurt and Amsterdam, no training on your data, a DPA built into every contract, every result yours. Each commitment on this page is written into our terms or our privacy policy — with the clause, so you can check it.
Four commitments
What every customer gets — from day one.
No enterprise tier, no negotiation. These four points are part of the contract for every account, from the free trial to the agency plan.
EU hosting in Frankfurt & Amsterdam
Your database, your login and your files sit in an EU region in Frankfurt. The applications run in an EU region in Amsterdam.
Terms § 19.2 · Privacy § 3 & 9
No training on your data
Your inputs and results are never used to train general AI models — ours or anyone else's. Our AI providers have committed to the same contractually.
Terms § 12.3 · Privacy § 9
DPA built into the contract
The Art. 28 GDPR data processing agreement becomes part of your contract at signup and sits in your account. A signed copy — including the subprocessor flow-down terms — is one email away.
Terms § 19.3 · Privacy § 11
Every result is yours
Listings, images, translations: the outputs belong exclusively to you. We reserve no exploitation rights and no promotional rights in them.
Terms § 13.2
Where your data lives
Two EU regions for your data. And full transparency on where AI runs.
We name cities, not labels — and say which part of the processing goes where.
Frankfurt · EU
Account, data & files
Database, authentication and file storage are pinned to an EU region in Frankfurt.
Amsterdam · EU
Website & applications
All Torch application services are deployed in an EU region in Amsterdam — server logs included.
USA · EU Standard Contractual Clauses
AI generation
For text and image generation, prompts, product data and images go to our AI processors in the US. No training on your content, no prompt retention by default, storage bounded by the contract term.
Transfers to third countries take place only on the basis of appropriate safeguards under Art. 44 et seq. GDPR and are listed individually in the privacy policy (Terms § 19.2).
In detail
What applies to you, concretely.
Six points procurement and data protection officers usually ask about — each with its clause.
Payments through Stripe
Card and bank details go through Stripe Payments Europe (Ireland). We never receive full card or account data.
Privacy § 6
Zero tracking cookies
Our website sets no cookies for tracking or analytics. We use no web analytics or advertising services.
Privacy § 7 & 8
No selling, no advertising
We do not sell personal data and do not use customer content for advertising.
Privacy § 9
30-day export after the contract ends
After the contract ends you can export your inputs and results in a common format for 30 days. After that, the data is deleted.
Terms § 18.5
Provenance record for every AI output
A provenance record identifying the content as AI-generated is stored with each generated version. A human stays in control of what gets published.
Privacy § 13
Reference only with your consent
We name you as a customer only after you have agreed in text form. No logo on our site without your yes.
Terms § 13.2
Facts, not seals
We show what we do — not what we bought.
You won't find a purchased seal or a self-made badge on this page. Every statement is a contractual commitment or documented in our privacy policy — checkable, with its clause. We do not hold an ISO 27001 or SOC 2 certification today; if your procurement has a security questionnaire, we answer it directly and in full.
Report a vulnerability
Find a vulnerability, and you will hear back from us.
Responsible disclosure belongs to a product companies trust with their data. Anyone who finds something in our publicly reachable services has one address here, one clear commitment — and our word that we will not take legal action against you.
What you may test
Our publicly reachable services. Test only with your own accounts and your own data — and only as far as it takes to demonstrate the finding.
How to report
One email is enough: what you found, which service is affected and how we can reproduce it. German, English or Spanish — whichever suits you.
What we commit to
We acknowledge your report within five business days and keep you posted until it is fixed. On request we credit you by name when we talk about the finding publicly. We do not run a bug bounty programme and we pay no rewards.
You are on safe ground
Anyone who follows these rules has no legal action to fear from us. We do not go after security research carried out in good faith.
Please: no social engineering, no phishing, no load testing, no access to other people's data, and no changing or deleting data. And please hold publication until the finding is fixed — we set no deadline for that. Reports that follow these rules are not treated as a breach of Terms § 15.
Questions about security & privacy
Where are my product data and images processed?
Do you train AI models on my data?
Do I get a data processing agreement (DPA)?
Are you ISO 27001 certified?
What happens to my data when I cancel?
Who receives my payment details?
See your catalog in the system
Start free with one account for Listings, Studio and Core. Or bring your product and 20 minutes, and we'll show you everything live on your own data.