Privacy Policy · Torchrunner

In plain terms

We do not sell your data, we run no advertising, and our public pages set no cookies.
Your data is yours. We never use your content to train AI models. We learn only from how tasks get done, with your content and personal details removed, and we never sell that or share it for anyone else to train on. We send the content an AI feature needs to the provider that runs it, and nothing else.
Two roles. For the business records you put into Torchrunner, you decide what happens and we act on your behalf. For your account and our website, we decide, and this policy explains how.
You choose what to connect. Email, calendar, files, phone, chat and books are connected only when you turn them on, and you can disconnect them.
Questions or requests: privacy@torchrunner.ai.

Who we are and what this covers

This policy is from Torchrunner, Inc., a Delaware corporation (“Torchrunner,” “we,” “us”). It covers torchrunner.ai, the Torchrunner app and the client portal, and runnerID by Torchrunner at runnerid.torchrunner.ai (together, the “Service”).

Torchrunner is one app for solo operators and small teams: clients, email, phone, calendar, projects, documents, marketing and your own books, with an AI assistant and automations that do work for you with your approval. runnerID is a separate product from Torchrunner that signs AI agents in to websites without showing the agent a password.

Two roles: your data and ours

Customer Data is the content your organization brings into Torchrunner or creates there: contacts and clients, email, calendar entries, calls and voicemail, texts, meeting recordings and notes, documents, tasks, invoices and bank data, and credentials you store for agents. Your organization controls Customer Data. We process it only to provide the Service to you, as your processor or service provider, under our Terms and, where it applies, our Data Processing Addendum. If you are a client, contact or applicant of one of our customers, that customer is responsible for your data, and we will pass your request to them.

Account and website data is what we collect about the people who sign in, pay, apply, visit our website or ask us a question. For that data we are the controller, and the rest of this policy applies to it.

What we collect

Category	Examples	Where it comes from	Why we use it
Account and sign-in	Name, work email, organization and role, a password hash, two-factor settings, invitations, device name and system for connected devices	You, and your organization's admins	To create and secure your account and run the Service
Billing	Organization name, billing address and tax ID, plan, card brand and last four digits. Card numbers go to our payment provider, not to us.	You and our payment provider	To bill you, calculate tax and keep financial records
Forms and messages to us	Name, email, what you do and what you use today when you request access, sign up for runnerID, download the playbook or write to us	You	To reply, to decide who we onboard, and to send what you asked for
Job applications	Contact details, résumé and your answers to our questions	You	To consider your application
Usage and technical data	IP address and request details in server logs, a rate-limit counter keyed to your IP address, error reports that include a user and organization ID, push-notification tokens	Your browser, device and our servers	To keep the Service working and secure, to find and fix errors, and to limit abuse
Customer Data	See above. It may include information about your clients, their contacts and people who email, call or text you.	Your organization, your connected accounts and the people you communicate with	Only to provide the Service to your organization

We do not run advertising or analytics trackers on our website. Some features look up business information at your request, such as company details for a contact, using enrichment providers and public sources. What you save from those lookups becomes Customer Data.

Google and Microsoft accounts

When you connect a Google or Microsoft account, we ask for permission on the provider’s own consent screen, and you can see and revoke the permissions in your account settings with that provider or in Torchrunner. Depending on what you turn on, that can include reading and sending email, reading and managing calendar entries, reading files in Google Drive or OneDrive, and reading contacts.

Torchrunner’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use data from your Google account only to provide and improve the features you turn on, for example showing your mail inside a client record or placing a meeting on your calendar. We do not use it for advertising, we do not sell it, and we do not use it to train AI models. We do not allow people to read data from your Google account unless you ask us to for support, it is needed to investigate abuse or a security issue, or the law requires it. Other providers’ data is handled under the same limits. More generally, authorized personnel and service providers may access account data only when needed to provide, secure or support the Service, or as the law requires.

How we use information

To provide, secure and support the Service, including features that act on your behalf when you ask.
To bill you and to meet tax and accounting rules.
To authenticate you, enforce separation between organizations, and prevent fraud and abuse.
To find and fix errors and to improve the Service, using error reports and the content of support requests.
To improve how our agents do tasks, using task records with your content and personal details removed.
To reply to you, to onboard applicants and to tell customers about changes to the Service.
To meet legal obligations and to protect our rights and the rights of others.

AI and your data

Your data is yours. We never use your content to train AI models: not your records, documents, emails, passwords or codes, not what your agents read or type on the sites they visit, and not your account data. We do learn from how tasks get done, such as the steps a site’s sign-in takes or where it asks for a code. We call these task records. A task record keeps only the shape of a step: the site, the kind of step, the order, how long it took and whether it worked. Typed values, page text, file contents and personal details are removed before it is kept, so agents get better at the work without your content. We never sell task records or share them for anyone else to train on, and they are deleted when your account is deleted. Data from your Google account is never used for task records. Archie, Runners and our other AI features read the records in your workspace and send the content the feature needs, for answers, summaries, document reading and search indexing, to the model provider that runs it. The provider returns a result. Providers process that content under their own terms. Archie’s memory is stored in your workspace as notes and search indexes. It is not model training, and it belongs to your organization.

By default we use our own choice of model provider, which our subprocessors page describes, and we name it on request. If you bring your own API key or connect your own AI client, what you send goes to that provider under your agreement with it, and that provider’s terms and privacy policy apply. AI output can be wrong, so by default anything that leaves your business, moves money or deletes data waits for a person’s approval, and AI actions are written to an activity log.

Calls, texts, meetings and email tracking

Calls and voicemail. Phone calls run through our telephony provider. Calls are recorded only if your organization or a member turns recording on, which is off by default. An organization can set a spoken notice for the other person. Recordings and voicemail are stored with the provider and played back in Torchrunner.
Texts and chat. Channels such as WhatsApp, Telegram, LinkedIn, Instagram, Messenger and Slack connect through messaging connection providers described on our subprocessors page. Text messaging over our phone service is not generally available yet.
Meetings. If you invite our meeting notetaker, it joins the call, posts a notice in the chat and plays a spoken notice, and then records audio and video and produces a transcript and notes.
Email open tracking. Email you send from Torchrunner can include a small image that tells you when a message was opened. Opens are shown to you. They are not used for advertising.
Your responsibility. Recording and tracking laws differ by place. Our customers are responsible for giving the notices and getting the consents those laws require. Our Terms say more.

We share information only as follows.

Service providers (subprocessors). Companies that host, store, secure, send, bill, monitor and process data for us, each only to do that job. Our subprocessors page lists each type of provider, what it does and where, and says which are used only if you turn a feature on. We name each provider on request.
AI model providers, as described above, and any provider you choose to connect.
Services you connect. When you connect Google, Microsoft, Intuit, Stripe, Slack or another service, we exchange data with it as you direct.
People you work with. Your clients, teammates and signers see what you share with them through the portal, shared records and signing links.
Legal and safety. Where required by law or valid legal process, or to protect people, the Service or our rights. Where the law allows, we tell you first.
Business transfers. If we merge, are acquired or sell assets, information may transfer, subject to this policy.

We do not sell your data

We do not sell personal information, and we do not share it for cross-context behavioral advertising or targeted advertising. We have not done so in the past 12 months. Because we do none of this, there is nothing for you to opt out of.

Cookies

Our websites, torchrunner.ai and runnerid.torchrunner.ai, set no cookies. The signed-in app sets a small number of cookies, mainly the one that keeps you signed in and a few that remember preferences, and stores interface settings in your browser. We use no advertising or analytics cookies. Details, with names and lifetimes, are in our Cookie Policy.

The invite-only Trust Center, where we share our security packet with organizations that are evaluating us, sets one cookie for the person we invited, after they accept our confidentiality terms. For that we use the name and company in the invitation, the time they accepted, and their IP address and browser. We email that record to ourselves and keep it so we know who has seen the packet.

Where data is processed

We are based in the United States and our main hosting and database are in the United States. If you use the Service from elsewhere, your information is transferred to and processed in the United States and other countries where our subprocessors operate. Where the law of the EEA, UK or Switzerland requires a transfer mechanism, we use the European Commission’s Standard Contractual Clauses with the UK and Swiss addenda, which our Data Processing Addendum incorporates.

How long we keep it

We keep information for as long as your organization has an account and as needed to give you the Service, meet legal obligations, resolve disputes and enforce our agreements. These are the periods that apply today.

What	How long
Customer Data in an active account	Until your organization deletes it or the account is closed
Contacts, leads and companies you delete	In trash for 30 days, then permanently removed
Other items you delete, such as documents	Stay in trash until someone empties it
AI chat threads you end	Removed after 7 days
Agent activity log	Removed after 90 days
Financial change log	Kept with your financial records
Meeting video and audio at our notetaker provider	Removed after 60 days. Transcripts and notes stay until you delete them.
Call recordings and voicemail	Kept until your organization deletes them
Client portal invitations and sessions	Removed 30 days after they end
Billing records	As long as tax and accounting law requires
Requests, forms and job applications	While needed to respond, run the application process, meet legal obligations and resolve disputes, then deleted or anonymized when feasible
Backups	Until they are overwritten on our ordinary backup cycle

You can export your CRM records, tasks, activity and meeting notes from settings. To export other data or to have your data deleted after you leave, write to privacy@torchrunner.ai. We verify the request and delete what the law allows us to delete.

Security

We protect information with technical and organizational measures, including:

Tenant isolation enforced in the database so one organization cannot read another organization’s data.
Encryption in transit, and encryption before storage, under keys specific to your organization, for the credentials and connection tokens you store. runnerID encrypts each identity with its own key.
Two-factor sign-in that you can turn on, strong password rules and breach-checked passwords.
Approvals for actions that leave your business, move money or delete data, and logs of what AI agents do.

No method of transmission or storage is perfectly secure, and we cannot guarantee absolute security. If we learn of a breach that affects your information, we will tell you and the authorities as the law requires. See our security page for more.

Your rights and choices

Depending on where you live, you can ask us to tell you what personal information we hold about you, give you a copy, correct it, delete it, limit or stop certain uses, and move it to another service. You can withdraw consent where we rely on it. California residents may also ask us to limit our use of sensitive personal information, although we use it only to provide the Service and for the purposes California law permits. You will not be treated worse for using these rights. If we refuse a request in the US, we will explain why, and you can appeal by writing to privacy@torchrunner.ai with “Privacy appeal” in the subject. For the account information we need to provide the Service, you may be unable to use it if you do not give it to us.

To make a request, write to privacy@torchrunner.ai. We may need to confirm it is you, and you may use an authorized agent. We respond within the time the law sets, generally 45 days for US state requests and one month under the GDPR. If your data is Customer Data, we will direct you to the customer that controls it.

If you are in the EEA or UK, you can also object to processing based on legitimate interests and complain to your local data protection authority. For California, see below.

Legal bases (EEA and UK)

Purpose	Basis
Provide the Service and your account	Contract
Billing, tax and record keeping	Contract and legal obligation
Security, abuse prevention, error fixing, improving the Service	Our legitimate interests in running a safe, working product
Replying to you and onboarding applicants	Legitimate interests, and steps you ask for before a contract
Optional features that need your permission, such as connecting a mailbox	Your consent, which you can withdraw
Responding to legal requests	Legal obligation

Children

The Service is for businesses and is not directed to anyone under 18. We do not knowingly collect personal information from children. If you believe a child has given us personal information, write to privacy@torchrunner.ai. We will review the request and delete the information where required and permitted by law.

California notice

In the past 12 months we collected these categories of personal information, from the sources and for the purposes described above: identifiers (name, email, IP address, device and account IDs); commercial information (plan and billing); internet or network activity (logs, error reports); professional and employment information (role, organization, résumé); financial information (billing details and, for the books feature, the bank and invoice data you connect); audio, electronic and visual information (call recordings and meeting recordings that your organization turns on). We disclosed these categories to service providers and contractors, listed on our subprocessors page, only for the purposes in the table above and to provide, secure, support and bill for the Service. We did not sell or share personal information, including the personal information of consumers under 16.

Some of this is sensitive personal information under California law, such as account log-in details and financial account data. We use it only to provide the Service and for the permitted purposes the law lists, not to infer characteristics about you.

Changes

We will update this policy as the Service changes and show the date at the top. For material changes we will tell account owners by email or in the app before they take effect. We keep earlier versions and will send one on request.

Contact

Torchrunner, Inc., a Delaware corporation. Privacy questions and requests: privacy@torchrunner.ai. Legal notices: legal@torchrunner.ai. General help: support@torchrunner.ai.