Torch Orchestrator Privacy Policy

Effective date: September 6, 2026 Last updated: September 6, 2026

1. Controller and scope

Torch Orchestrator is an independent project operated by Bruno Pueyo, the controller of the personal data described in this Policy. Privacy contact: privacy@torchorchestrator.com. Official website: https://torchorchestrator.com.

This Policy covers the website, interest list, Torch Preview, feedback and issue channels, support, security, and licensing. Preview will initially be actively offered in Brazil. Public purchases are not yet available and will have separate terms before sales begin.

2. Data, purposes, and legal bases

Torch operates locally by default. Workspace files, projects, prompts, and content are not automatically sent to Torch Orchestrator.

We may process:

• Interest list: email, language, country, optional name, stated interest, and confirmation to register and manage the application, based on consent.
• Application and Preview: submitted answers, status, invitation, acceptance, wave, validity, and license activity to assess a requested application and perform the Preview Terms.
• Feedback and issues: report, category, Torch and Windows versions, impact, and diagnostics selected by the user to improve and protect the product. No file, terminal, or workspace is sent automatically.
• Support and rights: contact details, message, and minimal history to answer a request, comply with law, or perform the Terms.
• Security: IP address, time, route, result, and minimized technical identifiers when needed to prevent abuse, fraud, and incidents.
• Licensing: key or token, plan, activations, and minimized device identifier to grant, validate, recover, expire, or revoke access.
• Consent and suppression: notice version, purpose, date, event, and email HMAC to demonstrate choices and prevent messages after an objection.

We do not request sensitive data. Do not include secrets, sensitive data, or third-party personal data in reports or diagnostics.

3. Preview and marketing

Applying for or joining Torch Preview does not authorize marketing. Messages required for confirmation, selection, invitation, security, and closure are operational. News and offers require separate, optional consent that is unchecked by default. Withdrawing it does not affect an application or Preview license.

4. Providers and international transfers

We use Cloudflare for infrastructure, database, security, abuse prevention, asset delivery, and forwarding of the five official addresses. Cloudflare Turnstile analyzes necessary technical signals from the browser and request to distinguish people from automated traffic; according to the service documentation, it does not read the content entered in form fields.

We use Resend for transactional email. It processes the recipient address, message content, and delivery metadata. Automated email uses updates.torchorchestrator.com, and open and click tracking remains disabled. The sa-east-1 region determines the sending route from São Paulo; it does not mean Brazilian data residency. Resend account metadata, email logs, and API records are stored in the United States.

Messages received at hello@, support@, preview@, privacy@, and security@torchorchestrator.com are forwarded by Cloudflare to a Torch mailbox in Microsoft Outlook. Microsoft processes sender and recipient addresses, message content, and metadata required to deliver and store those messages.

These providers may use subprocessors and process data outside Brazil. Cloudflare D1 automatically selects data location according to its technical options; Torch does not promise Brazilian data residency. We will apply the contracts, safeguards, and transfer mechanisms required by applicable law. Cloudflare, Resend, and Microsoft process data under our instructions when acting as processors and may process information for their own purposes under their terms, including security and legal compliance. Additional information may be requested at privacy@torchorchestrator.com.

5. Retention

• Unconfirmed application: 7 days after submission.
• Confirmed but not selected application: 90 days after the campaign ends.
• Preview participation and operational data: 180 days after closure.
• Identifiable feedback: 180 days after closure, then deletion or effective anonymization.
• Unanswered outreach contact: 90 days.
• Communication data after unsubscribe: immediate deletion, preserving only minimal suppression data.
• Minimal consent, objection, and incident evidence: up to 5 years, with annual necessity review.
• Optional diagnostics: up to 90 days after case closure, except for an incident or dispute.
• Ordinary security logs: 90 days active and, when necessary, up to 12 months with restricted access.

Backups directly controlled by Torch follow a deletion cycle of no more than 30 days. Deleted data temporarily remaining in those backups is isolated, is not restored to ordinary use, and is erased during the normal cycle. Providers may retain residual technical copies under their contracts and legal obligations. The Resend DPA, for example, provides for deletion of customer data within up to 90 days after account termination. Legal duties, disputes, and incidents may require specific documented retention.

6. Security

We apply proportionate controls, including encryption in transit, least privilege, environment separation, secret management, rate limiting, automation protection, minimized logs, and tested restoration. No system is infallible. Send vulnerability reports to security@torchorchestrator.com.

7. Your rights

Subject to applicable law, you may request confirmation, access, correction, sharing information, portability where applicable, anonymization, restriction, deletion, withdrawal of consent, objection, and review of automated decisions. Preview selection is human and no final rejection is made solely by automation.

Requests are free and should be sent to privacy@torchorchestrator.com. We may verify identity proportionately. You may also complain to Brazil’s National Data Protection Authority or the competent authority in your country.

8. Age and eligibility

The interest list and Torch Preview are available only to people aged 18 or older. The app’s Everyone content rating concerns software content and does not change this Preview participation rule.

9. Changes and contacts

Material changes will be published with a new date and, when required, a new choice. Official contacts:

• General: hello@torchorchestrator.com
• Support: support@torchorchestrator.com
• Preview: preview@torchorchestrator.com
• Privacy: privacy@torchorchestrator.com
• Security: security@torchorchestrator.com