Skip to main content

Trust Center › Legal

Data Processing Agreement

Version 2.0 · Effective 18 October 2026

How this DPA applies. This DPA forms part of the Toran Terms of Service and applies automatically to every Toran account, so there is nothing to sign. If your procurement process needs a signed copy, or Annex I filled in for your use case, email trust@toranhq.com and we will countersign this version.

1. Parties & scope

This Data Processing Agreement ("DPA") is between you (the "Customer") and Erez Avital, a registered business in Israel trading as 'Toran' ("Toran"). It covers the Personal Data that Toran processes on Customer's behalf to provide the Toran service (the "Services"). For that data, Customer is the controller and Toran is the processor. Notices under this DPA go by email to trust@toranhq.com. A postal address is available on request.

This DPA forms part of the Toran Terms of Service. If they conflict on how Personal Data is processed, this DPA wins. It does not cover data Toran handles for its own purposes as a controller, such as Customer's account and billing details; the Privacy Policy explains that.

Toran plans to incorporate as an Israeli limited company. When it does, Toran may transfer this DPA to that company by giving Customer at least 30 days' written notice, and the company will take on all of Toran's obligations under it.

2. Definitions

Words such as "Personal Data", "Processing", "Controller", "Processor", "Data Subject" and "Personal Data Breach" have the meanings given in the EU General Data Protection Regulation (Regulation 2016/679, "GDPR"). The matching terms in other laws, such as "personal information", "service provider", "database controller" or "holder", are treated as the same.

"Applicable Data Protection Law" means each of the following, to the extent it applies to the processing:

  • the GDPR, the UK GDPR and the UK Data Protection Act 2018, and the Swiss Federal Act on Data Protection;
  • Israel's Protection of Privacy Law, 5741-1981, and its regulations, including the Protection of Privacy (Data Security) Regulations, 5777-2017 (the "Data Security Regulations") and the Protection of Privacy (Transfer of Data to Databases Abroad) Regulations, 5761-2001 (the "Transfer Regulations"), together the "Israeli Privacy Law";
  • the California Consumer Privacy Act, as amended by the California Privacy Rights Act ("CCPA"), and other US state privacy laws;
  • India's Digital Personal Data Protection Act 2023.

3. Subject matter & duration

Toran processes Personal Data on Customer's behalf only to provide the Services. That means: running the widget on Customer's website; answering visitors with the AI assistant, using the content and settings Customer provides; capturing enquiries and contact details; scoring and summarising enquiries; sending notifications to the channels Customer sets up; and keeping leads in Customer's dashboard. Processing lasts while Customer has a Toran account, plus the limited periods in §10. Annex I gives the details.

4. Customer instructions

Customer's documented instructions are: (a) the settings Customer chooses in the Toran dashboard, including widget, AI assistant and notification settings; (b) Customer's use of the Services; (c) other written instructions Customer sends Toran that fit the Terms; and (d) the de-identified statistics described below. Toran processes Personal Data only on these instructions, including when it is transferred to another country, unless the law requires otherwise. In that case Toran will tell Customer first, unless the law forbids it. Toran will tell Customer if it believes an instruction breaks Applicable Data Protection Law.

Customer is responsible for having a lawful basis for the processing, for telling its visitors about it in its own privacy notice, and for making sure its instructions are lawful.

De-identified statistics

Customer authorises Toran to keep de-identified records of how leads turn out, to improve lead scoring and routing for all customers. Each record holds only coarse signals and the outcome: for example the country, the hour of day, broad visit counts, derived labels such as "asked about pricing", and whether the lead converted. A salted one-way code stands in for the widget. The records hold no names, contact details, message text, IP addresses, visitor or session IDs, or exact times. Toran keeps this data de-identified and will not try to re-identify any person or customer from it.

5. Confidentiality

Toran limits access to Personal Data to people who need it to provide or support the Services. Today that is only Toran's operator, who is bound by this DPA. Before anyone else gets access, Toran will have them commit in writing to keep Personal Data confidential, and that duty will continue after their work for Toran ends.

6. Security

Toran maintains the technical and organisational measures in Annex II, which are also summarised on the Trust Center. Toran keeps them appropriate to the risk and may update them, as long as the overall level of protection does not go down.

7. Personal Data Breach notification

Toran will notify Customer without undue delay, and in any case within 24 hours of confirming a Personal Data Breach that affects Customer's data. The notice will include what Toran knows at the time: what happened, the categories and approximate number of people and records affected, the likely consequences, what Toran has done or proposes to do, and a contact for follow-up. Toran will send more details as it learns them and will help Customer meet its own duties to notify regulators and affected people.

This notice also serves as notice of a security incident under the Data Security Regulations. Where an incident must be reported to Israel's Privacy Protection Authority, Toran will give Customer what it needs for that report without delay and will cooperate with the Authority.

8. Sub-processors

Customer gives Toran general written authorisation to use Sub-processors, on these conditions:

  • The current list at /legal/subprocessors (Annex III) is authorised.
  • Toran puts written data protection terms in place with each Sub-processor that protect Personal Data at least as well as this DPA does.
  • Toran gives Customer at least 30 days' notice before adding or replacing a Sub-processor, by email to Customer's account contact and on the Sub-processors page.
  • Toran stays fully responsible to Customer for its Sub-processors' work.

Customer may object on reasonable data-protection grounds within 14 days of a notice. If the objection cannot reasonably be resolved, Customer may end the affected part of the Services.

9. Data subject requests & other help

Customer can handle most requests itself. The dashboard lets Customer download its data, delete a lead, and erase everything held about a single visitor. For anything else, Toran will help: email privacy@toranhq.com and Toran will ordinarily reply within 30 days.

If a visitor sends a request to Toran, Toran will pass it to Customer within 5 working days and will not answer it for Customer unless Customer asks. Toran may tell the visitor Customer's business name and website so they can contact Customer directly.

Toran will also give Customer reasonable help with data protection impact assessments and with consultations with regulators, where they concern the Services.

10. Return & deletion of Personal Data

Return. Customer can download its data at any time from the dashboard as a JSON file. It includes widgets, leads, chat records still within their retention period, message-form messages, knowledge base documents and settings.

Deletion. When Customer deletes its account, the deletion runs after a 7-day cooldown, during which Customer can cancel it. It removes Customer's account, widgets, leads, chats and messages from Toran's live systems. Toran keeps only: security and audit logs, with Customer's identity removed; records the law requires Toran to keep, such as invoices and tax records; and backups, as below. On request, Toran will confirm the deletion in writing.

Backups. Backups exist for disaster recovery only, and chat message text is left out of them. Toran does not use backups to restore anyone's deleted records. Deleted data that remains in a backup is kept out of use until that backup is deleted.

11. Audit

Toran will give Customer the information it reasonably needs to show that this DPA is being met, and will allow and contribute to audits, including inspections, by Customer or an auditor Customer appoints, on reasonable notice and at Customer's cost. To keep this proportionate, Customer will first review Toran's Trust Center documents and Toran's written answers to its questions. An inspection follows only if those do not reasonably answer Customer's questions, or a regulator requires it.

12. International transfers

Toran's primary database is in the European Union (Paris, France). Toran operates from Israel, which the European Commission recognises as giving adequate protection to personal data (Decision 2011/61/EU). The UK and Switzerland recognise Israel in the same way. Transfers of Personal Data from the EEA, the UK or Switzerland to Toran therefore need no further safeguards.

When a Sub-processor outside those places receives Personal Data, Toran relies on an adequacy decision where one exists (such as the EU-US Data Privacy Framework for certified companies) or on the EU Standard Contractual Clauses (Decision 2021/914) in its contract with that Sub-processor, with the UK Addendum and Swiss changes where needed.

If a transfer from Customer to Toran ever needs safeguards (for example, if an adequacy decision lapses), the parties incorporate the EU Standard Contractual Clauses, Module 2 (controller to processor), by reference, with these choices: Clause 7 (docking) not used; Clause 9(a) Option 2, with 30 days' notice; the optional wording in Clause 11(a) not used; Clauses 17 and 18: Ireland. UK transfers use the UK International Data Transfer Addendum (version B1.0), and Swiss transfers use the changes the Swiss regulator requires. Annexes I to III of this DPA complete the Clauses.

13. California and other US state laws

Where the CCPA applies, Toran is Customer's service provider. Toran will:

  • not sell or share Personal Data, as the CCPA defines those words;
  • keep, use and disclose Personal Data only for the business purposes in §3, on Customer's behalf, and not outside its direct business relationship with Customer;
  • not combine it with personal information Toran gets from others or collects itself, except where the CCPA allows a service provider to;
  • give it the level of privacy protection the CCPA requires, and meet the CCPA obligations that apply to Toran;
  • tell Customer if it can no longer meet these obligations.

Customer may take reasonable steps to make sure Toran uses Personal Data in line with Customer's CCPA obligations, and to stop and fix any unauthorised use. Toran helps with consumer requests as described in §9. Sections 4 to 11 also form the processor contract that other US state privacy laws require.

14. Israel addendum

This section applies where Customer's database is subject to the Israeli Privacy Law. Customer is the database controller and Toran is the holder. Together with the rest of this DPA, it sets out the terms that regulation 15 of the Data Security Regulations calls for. Toran gives these commitments whether or not that regulation applies to it.

  • Data and purposes: the Personal Data in Annex I, used only for the purposes in §3.
  • Systems: Toran's own systems for the Services (its database, server functions and dashboard) and the Sub-processors in Annex III.
  • Processing allowed: as described in §3 and §4.
  • Duration, return and destruction: for as long as Customer has an account; return and deletion as in §10, with written confirmation of the deletion on request.
  • Security: Toran applies the measures in Annex II. Toran has not yet prepared the written documents the Data Security Regulations require for databases at the medium or high security level (such as a security procedure, a database structure document, and access and incident records). If Customer's database is at the medium or high level, Customer will tell Toran before using the Services for it, so the parties can agree what is needed.
  • Confidentiality: as in §5.
  • Sub-processors: Toran uses only the Sub-processors in Annex III, under §8. Each is bound by its own written terms covering confidentiality, security, use only for its service, and deletion. Those terms do not repeat every item in this section, such as the annual report.
  • Reporting: Toran will send Customer, once a year and on request, a short written report on how it meets this DPA and the Data Security Regulations, and will report security incidents as in §7.

Toran does not use Customer's Personal Data for its own purposes. The only exception is the de-identified statistics in §4, which Customer authorises and which identify no one.

Transfers abroad. Customer's Personal Data is stored in France, a party to the Council of Europe's Convention 108, which the Transfer Regulations accept (regulation 2(8)). Sub-processors in the United States receive it under written terms in which they commit to protect it and to use it only to provide their service (regulation 2(4)). Customer decides whether this meets its own duties as controller, and should tell Toran if it needs a different arrangement.

15. Changes & general terms

Toran may update this DPA to reflect changes in the law, the Services or its Sub-processors. Toran will email Customer before a material change takes effect, and Customer may close its account if it does not agree. Sub-processor changes follow §8.

If documents conflict, this order applies: the Standard Contractual Clauses (where they apply), then this DPA, then the Terms. This DPA is governed by the law named in the Terms, except that the Standard Contractual Clauses are governed by the law chosen in §12. Each party bears its own costs.

Annex I - Processing details

This is the standard Annex I. If you need it filled in for your use case, email trust@toranhq.com.

A. Data subjects

  • Visitors to Customer's website on pages where the widget loads, including visitors who never open it
  • Visitors who chat with the AI assistant or send a message, and the leads they become
  • Customer's team members who appear in the widget or receive notifications

B. Categories of Personal Data

  • Contact details visitors give: name, email address, phone number
  • Conversation content: chat messages, message-form messages and the AI assistant's replies
  • Technical data: IP address, browser and device details, page address, language and timestamps
  • Approximate location derived from the IP address (country, region, city, postcode and approximate coordinates), and the name of the network or company the IP address belongs to
  • Usage data: a random visitor ID kept in the visitor's browser once they use the widget, widget events (such as opening the chat or tapping a channel), how far the visitor scrolled and how long they spent on the page
  • AI-derived data: lead score, conversation summary and intent labels
  • Team data: names and photos shown in the widget, and the email addresses, phone numbers or channel IDs used for notifications

C. Special categories of Personal Data

None intended. The widget asks visitors not to share medical, financial or other sensitive information. Customer will not set up the widget or the AI assistant to ask for health, biometric, payment-card, government ID or other special-category or sensitive data.

D. Frequency & nature of processing

Continuous and automated: collection, storage, AI processing, scoring, notification and scheduled deletion.

E. Purpose

To provide the Services: the website widget and AI assistant, lead capture, AI scoring and summaries, notifications to Customer's channels (push, email, Slack, Telegram and WhatsApp Forwarder), and the dashboard.

F. Duration

  • Chat message text: erased on the schedule Customer chooses in the dashboard (30 days by default, or shorter)
  • Message-form messages: deleted automatically after 30 days
  • Visitor technical and usage data: deleted after 30 days
  • Widget error logs (page address and browser details): deleted after 90 days
  • Leads (contact details, summary and score) and their notification records: kept until Customer deletes them or the account
  • In the visitor's own browser: the random visitor ID and widget settings stay until the visitor clears them; a saved copy of the chat follows Customer's chat setting
  • Everything else: until the account is deleted, as in §10

Annex II - Technical & organisational measures

The live summary is at /trust#security. The measures in place on the effective date are:

  • Encryption in transit: TLS 1.2 or higher on all Toran websites and APIs; older versions are refused.
  • Encryption at rest: AES-256 for the primary database and file storage; backups are encrypted before they leave Toran's systems.
  • Access control: Row-Level Security on every table in the primary database, so each account can reach only its own data.
  • Sign-in security: two-step sign-in (MFA) is available on every account and required for Toran's internal admin console.
  • Least privilege: access to production data is limited to Toran's operator.
  • Audit logs: sign-ins, password and MFA changes, API key changes, account deletion requests and visitor data erasures are logged.
  • Data minimisation: chat text, visitor technical data and logs are deleted on fixed schedules (Annex I, F). Error reports are filtered to remove message text, names, email addresses and phone numbers before they reach the error-monitoring service.
  • Abuse protection: bot checks (Cloudflare Turnstile) and rate limits on widget submissions.
  • Vulnerability management: automated dependency update alerts and a dependency security audit on every code change.
  • Backups: Your account and lead data is backed up nightly, encrypted before it leaves our systems, and held in independent off-site storage with a tested recovery process. Backups exist for disaster recovery only, and deleted records are never restored from them.
  • Incident response: a documented incident-response and breach-notification runbook. We will run a tabletop test of that runbook before onboarding our first paying customer.
  • Location: the primary database is in Paris, France. Toran operates from Israel, where encrypted backups are also kept, with an off-site copy held by Cloudflare. Some Sub-processors process data in the United States (Annex III).

Annex III - Authorised Sub-processors

The current list of authorised Sub-processors, with each one's legal entity, purpose, region and the data it receives, is kept at /legal/subprocessors and forms part of this DPA. Changes are notified under §8.

Version history

  • 2.0, 18 October 2026. Applies automatically as part of the Terms. Adds CCPA service-provider terms and an Israel addendum, and updates the security, deletion and transfer details to match how the Services work today.
  • 1.0-draft, 18 May 2026. First public draft.