Torvis Privacy Notice

Effective: 10 October 2026 · Version: 2026-10-10

This notice explains how your personal data is processed when you use Torvis. It is written to meet the EU and UK General Data Protection Regulation (GDPR) and Türkiye's KVKK (Law No. 6698). There is a Turkish version as well.

1. Who is responsible

The controller is Fatih Dinç, Türkiye, email: heytorvis@gmail.com.

2. In short

• We do not keep your conversations. What you say, type or show the assistant is processed on our servers to answer you, then not stored there. The one exception is the optional cloud memory you turn on yourself (section 3.6).
• We do not use it to train AI, sell it, or use it for advertising. It is not sent to another AI company; the models that answer you run on servers we rent.
• What our servers keep is metadata, not content:
  • how much you used;
  • which computers you used;
  • when you accepted the terms.
• What is on your computer (settings, local memory, log files) stays on your computer.

3. What we process, why, on what legal basis, and for how long

3.1 Subscription and licence

• Data: Your licence key and what Whop tells us about your subscription: membership and product ids, status, plan and period end. We do not receive your name, email or card details; Whop takes the payment.
• Why: To check that you subscribe and to which plan.
• Legal basis: Performance of the contract (GDPR Art. 6(1)(b)).
• Kept: The last answer from Whop for 400 days.

3.2 Your computers

• Data: A one-way device id derived from your computer, the computer's name, and when it was first and last seen.
• Why: To apply your plan's computer limit and list your computers for you.
• Legal basis: Contract (6(1)(b)); our legitimate interest in preventing abuse (6(1)(f)).
• Kept: Removed after 180 days unseen, or when you remove the computer yourself.

3.3 Accepting the terms

• Data: Which version of the terms you accepted, the app language, the time, and your IP address at that moment.
• Why: To prove which terms the contract was made on.
• Legal basis: Legitimate interest in establishing and defending legal claims (6(1)(f)).
• Kept: 10 years.

3.4 Usage metering

• Data: For each request: time, licence, kind (conversation, transcription, voice), model, the seconds of audio, the characters and tokens processed, and the share of your allowance this comes to. No content.
• Why: To count and show your allowance, keep use fair, and settle billing questions.
• Legal basis: Contract (6(1)(b)); legal claims (6(1)(f)).
• Kept: 400 days.

3.5 Content processed to answer you

• Data: What you say to the assistant (the audio of your turn only), what you type, and its transcript. When a task needs them and you ask, also a picture of your screen or camera, the content of a file you ask about, and the results of the tools the assistant uses.
• Why: To understand you, write the answer and speak it.
• Legal basis: Contract (6(1)(b)).
• Kept: Not kept. It is processed in the servers' memory while the answer is made and not retained after it.
• With the wake word on, while the assistant sleeps, microphone audio does not leave your computer: "Hey Torvis" is detected on your computer.

3.6 Cloud memory (optional)

• Data: What you want the assistant to remember, your recent conversation, the settings it needs to answer you on your phone, scheduled jobs you set up, and your personal Telegram bot's token.
• Why: So that you can talk to the same assistant, with the same memory, on your phone while your computer is off.
• Legal basis: Contract (6(1)(b)).
• Protection: Stored encrypted on our server, with a key made on your computer. While it runs, its content is open in the server's memory so that it can answer you.
• Your control: You can download it or delete it permanently from the app at any time.
• Kept: What the assistant remembers about you: while you subscribe, deleted 30 days after the subscription ends. Shorter, deleted by themselves: a phone conversation 7 days after you last continued it, the recent exchanges carried over from your computer after 24 hours, files you sent from the phone or that were made for you 7 days after they were last changed, and the log of what happened while your computer was away after 7 days.

3.7 Connecting your phone (optional)

• Data: Your Telegram user id and name, and your bot's id, username and token. What you write to the assistant on Telegram is processed as in 3.5.
• Why: To set up your private bot and make sure only you can use it.
• Legal basis: Contract (6(1)(b)).
• Kept:
  • Pairing codes are deleted shortly after use.
  • The bot's details are kept while the connection exists.
• Telegram's own privacy policy also applies.

3.8 Switching your computer on from your phone (optional)

• Data: What you set up for it: a smart plug's web link, or its maker's cloud keys and the plug's id (Tuya, Shelly, SwitchBot), or your Home Assistant's internet address, access token and the plug's name, or your Voice Monkey (Alexa) token and the names of your routine devices, or, if you shared the plug with our Smart Life account, the plug's id and name, or your router's address and the computer's network card address (Wake-on-LAN).
• Why: So that our server can switch your computer on when you ask from your phone while the computer is off.
• Legal basis: Contract (6(1)(b)).
• Who receives it: When the plug is switched, our server sends the command to the plug's maker's cloud (the Tuya, Shelly or SwitchBot cloud) or to your own Home Assistant, or to Amazon Alexa through Voice Monkey, with your keys. If you shared the plug with our account, our server only switches that plug on and off; you can stop sharing it in the Smart Life app at any time. In a maker's cloud, that maker's own privacy policy applies.
• Protection and period: On your computer, the keys are stored protected (as in 5). On our server they are kept with your cloud body's data (3.6), only while the setting exists: removing it in the app removes it from the server at the next connection. A plug shared with our Smart Life account is forgotten when you remove it in the app, or after 400 days without use.

3.9 Record of connections from our servers

• Data: For every connection your cloud body opens to the internet: the time, which body (that is, which account), the destination IP address and the port. The content sent and the page address are not recorded.
• Why: To prevent and detect misuse of our servers, and to identify the account behind a connection when we receive a complaint or a lawful request from an authority.
• Legal basis: Our legal obligations (6(1)(c)) and our legitimate interest in the security of our servers (6(1)(f)).
• Kept: 1 year, then deleted automatically.

3.10 Updates

The app asks our server whether a new version exists. The app version and device details (3.2) are sent with that request.

3.11 What stays on your computer

Settings, local memory, conversation summaries and the app's log file stay on your computer and are not sent to us.

• What the assistant remembers about you (local memory) is encrypted on Windows, for your Windows account only; a copy of the file cannot be opened elsewhere.
• The log file records what was done, for troubleshooting (which feature, when, error messages). What you say and type, your messages, the contents of your files and your screen are not written to it.
• The record of steps taken from your phone holds only which tool ran, when, and how it ended (done, confirmed, cancelled, refused) — no content. It is kept on your computer for 90 days and shown in the phone control panel.
• Screen and camera pictures are processed in memory only and are not saved to disk, unless you ask for a picture to be saved.

You can delete these when you uninstall.

4. Who receives data

We do not sell personal data. We share it only with these providers, only as far as needed to run the Service:

Third-party services used by features. When you use certain features, only what that job needs goes to the service concerned:

• A web search: your query goes from our server to Brave Search (USA). Brave sees our server's address, not yours. The results are passed to you and not kept.
• Weather in the phone briefing: the place you set goes once to OpenStreetMap (Nominatim) to find it, and its coordinates go to MET Norway, both from our server. Weather data: MET Norway (CC BY 4.0); place data: © OpenStreetMap contributors (ODbL).
• Plugins you switch on open the web pages their job needs from your computer.

These services have their own privacy policies.

The countries where your data is processed.

• Germany (Hostinger): our connection server (relay), your cloud memory and the cloud body that answers your phone. The usage record, your computers list and the record of accepting the terms are kept here too.
• European Union (RunPod data centres): the AI models that understand you, write the answer and speak it. What you say, type or choose to show is processed there in memory and not kept (3.5).
• USA (Whop): payments and subscriptions. Your conversations never go to Whop.
• USA (Brave Search): your search queries, without your address.
• If you connect your phone, Telegram's servers; if you set up a smart plug, its maker's cloud (table above).
• We have no servers in Türkiye. What is kept on your computer (3.11) does not leave it.

Transfers outside the EU/EEA. We are based in Türkiye, and some of the providers above are outside the EU/EEA (for example in the USA). Where the European Commission has not found a country adequate, transfers rely on the Standard Contractual Clauses or the recipient's certification under the EU-US Data Privacy Framework.

We may also disclose data when the law requires it, in response to lawful requests from authorities.

5. Security

• All traffic between the app and our servers is encrypted, and the app trusts only our server's certificate.
• Traffic between our own servers is encrypted too.
• Secrets stored on your computer, and your local memory, are protected by Windows' per-user encryption.
• Risky actions such as sending a message, running code or deleting a file are not done until you press the confirmation button. Text from outside — web pages, emails, files — is given to the assistant as data, never as instructions.
• Cloud memory is stored encrypted.
• Our servers do not write conversation content to their logs.

No system is perfectly secure. If we learn of a breach affecting you, we will notify the competent authority and you as the law requires.

6. Children

• Torvis is only for people aged 18 or older. If we learn that we hold data of someone under 18, we delete it.
• Parents and guardians can exercise their child's data rights at heytorvis@gmail.com.

7. Cookies and tracking

The app has no advertising, tracking or analytics tools. Our website uses no cookies. If this changes, we will update this notice first.

8. Your rights

Under the GDPR you have the right to:

• access your data;
• rectify it;
• erase it;
• restrict its processing;
• data portability;
• object to processing based on legitimate interest;
• not be subject to solely automated decisions with legal or similarly significant effects.

You can download and delete your cloud memory yourself in the app. For everything else, write to heytorvis@gmail.com. We answer within one month.

Delete my account and all my data. On the Plan screen in the app, without asking us, whenever you choose. Deleted: your cloud memory and everything in it (phone conversations, files, your phone's bot), your computers list on our server, your smart-plug link, your phone pairing record, our copy of your Whop membership details, and all Torvis data on your computer. Kept for the periods given in this notice: the usage record (3.4), the record of accepting the terms (3.3) and the cloud body's connection record (3.9) — none of them holds conversation content. Deleting does not cancel your subscription.

You also have the right to lodge a complaint with the data protection authority of the country where you live or work. In Türkiye, that is the Personal Data Protection Board (KVKK).

9. Changes

We may update this notice and will announce material changes in the app. The current version is always on this page.