PRIVACY POLICY
Last updated: April 2026
1. Who We Are
Torcano is the trading name of a sole trader registered in France, with registered address at 06250 Mougins, France. We provide an AI-powered guest communication service operating via WhatsApp for property managers and conciergeries.
Data Protection contact: hello@torcano.io
We act as “controller” of personal data we collect directly (website visitors, customer accounts). For guest data processed on behalf of our customers, we act as “processor” under the customer’s instructions.
2. What Data We Collect
Customer data: name, email, phone number, business name, billing information.
Guest data (processed on behalf of our customers): guest name, phone number, WhatsApp messages and metadata (timestamps, delivery status), booking details including check-in/check-out dates and property information. This data is sourced from Property Management Systems (PMS) including Hostaway, SuperHote, Lodgify, and others connected by the customer.
Upsell transaction data: where upsell services are activated, we process payment information via Stripe Connect, including transaction amounts, upsell type, and payout records.
Technical data: IP address, device and browser type, cookies, analytics events.
Support content: feedback, bug reports, support communications.
3. How We Collect It
Directly from customers (registration forms, email, WhatsApp).
From Property Management Systems (PMS) via API integration, with the customer’s authorisation.
From guests when they message the customer’s WhatsApp number connected to Torcano.
Automatically via cookies and analytics on our website.
From Stripe when processing upsell payments.
4. Why We Use Your Data
To provide and operate the Service, including automated guest communication, pre-arrival messaging, check-in instructions, and upsell facilitation (contract).
To process upsell payments and manage payouts to customers via Stripe Connect (contract).
Customer support and service notifications (contract / legitimate interests).
Security, fraud prevention, and abuse detection (legitimate interests / legal obligation).
To improve and develop the Service using aggregated and anonymised data (legitimate interests).
Marketing communications to customers (consent; opt-out available at any time).
5. WhatsApp & Guest Communications
When a customer connects WhatsApp to Torcano, we process guest messages and related metadata to provide automated replies on the customer’s behalf. Customers are responsible for ensuring they have appropriate opt-in consent from their guests to receive automated WhatsApp messages for business purposes.
6. Upsell Payment Processing
Where upsell services are activated, Torcano processes guest payments via Stripe Connect. Guest payment data (card details) is handled exclusively by Stripe and is never stored by Torcano. Torcano retains a 10% commission on each upsell transaction and transfers the remaining 90% to the customer’s connected Stripe account. Stripe’s privacy policy applies to all payment processing: stripe.com/privacy.
7. Data Retention
Customer account data: retained for the life of the account plus 24 months after closure.
Guest conversation and booking data: retained for 24 months from the date of the conversation. Earlier deletion may be requested where legally permitted.
Upsell transaction records: retained for 5 years for accounting and tax compliance purposes.
Website analytics: per cookie policy or browser settings.
8. Data Sharing
We share data with trusted providers under data processing agreements and appropriate transfer safeguards:
Hosting: Microsoft Azure (France region where available).
Messaging: Twilio (WhatsApp Business API).
AI processing: Microsoft Azure OpenAI.
PMS integrations: Hostaway, SuperHote, Lodgify (data accessed via API with customer authorisation).
Payments: Stripe (standard account and Stripe Connect). We do not store full card details.
Analytics: Google Analytics.
Email and support: Google Workspace.
We also share data where required by law, to protect rights or safety, or with your explicit consent.
9. Your Rights
Under GDPR and applicable French law, you may request: access, correction, deletion, restriction of processing, data portability, and to object to processing. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise your rights, contact: hello@torcano.io. You also have the right to lodge a complaint with the CNIL (Commission Nationale de l’Informatique et des Libertés) at cnil.fr.
10. Security
We apply industry-standard security measures including encryption in transit (HTTPS/TLS), access controls, authentication, audit logging, and regular backups. Data is hosted on Microsoft Azure infrastructure. No method of transmission or storage is 100% secure; we work continuously to improve our safeguards.
11. Children
Torcano is not directed at children under 16 and we do not knowingly process their personal data.
12. Cookies
We use essential cookies (required for website operation), analytics cookies (Google Analytics, anonymised traffic data), and functional cookies (preferences, language). On your first visit we request consent for non-essential cookies. You can manage cookies via your browser settings or withdraw consent at any time by clearing cookies.
13. Acting as Processor
For guest data processed on behalf of our customers, the customer is the data controller and Torcano acts as processor under their instructions. Processing is governed by our Data Processing Addendum (DPA) available on request.
14. Changes
We will update this policy when needed. Material changes will be communicated by email to registered customers and highlighted on this page.
Contact: hello@torcano.io
On your first visit, we may ask for your consent to use non-essential cookies (analytics, functional). You can withdraw consent anytime by clearing cookies in your browser.