Privacy Policy
Last updated: April 2026
1. Who We Are
Torcano is the trading name of a sole trader (auto-entrepreneur) registered in France, based at 06250 Mougins, France. We provide an artificial-intelligence guest-communication service, operating via WhatsApp, for property managers and concierge services.
Data protection contact: hello@torcano.io
We act as the "data controller" for data collected directly (website visitors, customer accounts). For guest data processed on behalf of our customers, we act as the "data processor" under the customer's instructions.
2. Data We Collect
Customer data: name, email address, telephone number, company name, billing information.
Guest data (processed on behalf of our customers): guest name, telephone number, WhatsApp messages and associated metadata (timestamps, delivery status), booking details including arrival/departure dates and information about the accommodation. This data comes from the property-management software (PMS) connected by the customer, in particular Hostaway, SuperHote, Lodgify, and others.
Additional-sales transaction data: when upsell services are enabled, we process payment information via Stripe Connect, including amounts, the type of service and payout records.
Technical data: IP address, device and browser type, cookies, analytics events.
Support content: feedback, bug reports, support communications.
3. How We Collect It
Directly from customers (sign-up forms, email, WhatsApp). From property-management software (PMS) via API integration, with the customer's authorisation. From guests when they contact the WhatsApp number of the customer connected to Torcano. Automatically via cookies and analytics tools on our website. Via Stripe when processing additional-sales payments.
4. Purposes of Processing
To provide and operate the Service, in particular automated communication with guests, pre-arrival messages, check-in instructions and facilitation of additional sales (contract). To process additional-sales payments and manage payouts to customers via Stripe Connect (contract). Customer support and service notifications (contract / legitimate interests). Security, fraud prevention and abuse detection (legitimate interests / legal obligation). Improvement and development of the Service from aggregated and anonymised data (legitimate interests). Marketing communications to customers (consent; you may unsubscribe at any time).
5. WhatsApp and Guest Communications
When a customer connects WhatsApp to Torcano, we process guests' messages and associated metadata to provide automated responses on the customer's behalf. Customers are responsible for obtaining the appropriate consent from their guests to receive automated WhatsApp messages for business purposes.
6. Processing of Additional-Sales Payments
When upsell services are enabled, Torcano processes guests' payments via Stripe Connect. Payment data (bank details) is handled exclusively by Stripe and is never stored by Torcano. Torcano retains a 10% commission on each transaction and transfers the remaining 90% to the customer's connected Stripe account. Stripe's privacy policy applies to all payment processing: stripe.com/privacy.
7. Retention Period
Customer account data: retained for the duration of the account, then 24 months after its closure. Guest conversation and booking data: retained 24 months from the date of the conversation. Early deletion may be requested within legal limits. Additional-sales transaction records: retained 5 years for accounting and tax purposes. Website analytics: according to the cookie policy or browser settings.
8. Data Sharing
We share data with trusted providers under data-processing agreements and appropriate transfer safeguards: Hosting: Microsoft Azure (France region where possible). Messaging: Twilio (WhatsApp Business API). AI processing: Microsoft Azure OpenAI. PMS integrations: Hostaway, SuperHote, Lodgify (data accessed via API with the customer's authorisation). Payments: Stripe (standard account and Stripe Connect). We do not store full bank details. Analytics: Google Analytics. Email and support: Google Workspace. We also share data where required by law, to protect rights or safety, or with your explicit consent.
9. Your Rights
In accordance with the GDPR and applicable French law, you may request: access, rectification, erasure, restriction of processing, data portability, and to object to processing. Where we rely on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise your rights, contact: hello@torcano.io. You also have the right to lodge a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertés) at cnil.fr.
10. Security
We apply industry-standard security measures, in particular encryption in transit (HTTPS/TLS), access controls, authentication, audit logging and regular backups. Data is hosted on Microsoft Azure infrastructure. No method of transmission or storage is 100% secure; we continuously improve our safeguards.
11. Minors
Torcano is not directed at persons under 16 years of age and we do not knowingly process their personal data.
12. Cookies
We use essential cookies (necessary for the site to function), analytics cookies (Google Analytics, anonymised traffic data) and functional cookies (preferences, language). On your first visit, we ask for your consent for non-essential cookies. You can manage cookies via your browser settings or withdraw your consent at any time by deleting cookies.
13. Acting as a Data Processor
For guest data processed on behalf of our customers, the customer is the data controller and Torcano acts as the data processor under its instructions. Processing is governed by our Data Processing Agreement (DPA) available on request.
14. Changes
We will update this policy as necessary. Material changes will be communicated by email to registered customers and flagged on this page.
Contact: hello@torcano.io