Privacy statement

In short

• We only process what is needed to have an exact request confirmed by someone you paired with earlier in person.
• Your face or fingerprint never leaves your device; we only receive a cryptographic signature.
• We do not read WhatsApp, text messages or email. We do not use tracking or advertising cookies.
• The help assistant is off by default.

Who is responsible

• Controller: [għadu mhux ipprovdut] ([għadu mhux ipprovdut]), [għadu mhux ipprovdut], Chamber of Commerce (KvK) [għadu mhux ipprovdut].
• Privacy contact: [għadu mhux ipprovdut].

Which data and why

• Account (email address, display name, language, password hash at the sign-in service, 16+ age confirmation): to give you an account — performance of the contract.
• Family, invitations and paired contacts (names, status, security pairing): to create trusted pairings — performance of the contract.
• Check requests (the text you enter yourself, optional amount, recipient, masked account number with an encrypted fingerprint, purpose, original message text, channel, times, outcome): to have the request confirmed or rejected — performance of the contract.
• Security data (public passkey keys, two-step verification at the sign-in service, device names, sign-in and audit log, truncated IP address on events, abuse counters): to protect your account and your contacts — legitimate interest (security and fraud prevention) and performance of the contract.
• Notices about account changes to your family and trusted contacts (without content): to protect them against misuse of your account — legitimate interest.
• Payments (once live: plan, amount, status, reference at the payment provider): performance of the contract and legal obligation (tax records).
• Complaints and contact (email, subject, message): to handle your question — performance of the contract or legitimate interest.
• Website statistics (page viewed, referring site, country, device type, language and a daily-changing anonymous code; no cookies, no IP address, no form contents): to improve the website — legitimate interest. Deleted after about 13 months.
• Feedback question (your answers and optional comment, without name, email or IP address): to learn whether Torivela is understandable — legitimate interest.
• Waitlist (only if you sign up: email address, language, interest in a trial, date and version of your consent): to email you when Torivela is ready — consent. You remove yourself with your removal code or via the contact form.
• Optional assistant (your question, after removing email addresses, phone numbers, account numbers, codes and links): only with your consent, which you can withdraw at any time.

Recipients and processors

• Hosting, database and sign-in service: Lovable (Lovable Cloud). Data processing agreement and hosting region: STILL TO BE VERIFIED before launch.
• Assistant (only with consent): Lovable AI, which forwards the question to a language model from OpenAI. The request asks for content not to be stored; contractual confirmation, region and any transfer outside the EEA: STILL TO BE VERIFIED.
• Email for confirmation and password reset: via the Lovable Cloud sign-in service. No marketing email.
• Payments: no payment provider active yet. Once there is one, it will be listed here.
• Your paired contacts only see the requests between you and them. Administrators see counts and subscription status, not request texts or keys.
• We do not sell data and do not use it for advertising.

Transfers outside the EEA

Whether data is processed outside the European Economic Area has not been established yet. Before launch we will record the region and safeguards (such as an adequacy decision or standard contractual clauses) for each processor and list them here.

Retention periods

• Account data (email, name, language, settings): for as long as your account exists; deleted immediately when you delete it.
• Check requests (question, amount, recipient, masked account number, status): 12 months after creation, then deleted automatically. The optional original message text: 90 days, then cleared automatically.
• Security notices to you and your contacts: 12 months.
• Security and audit log (sign-ins, passkeys, two-step verification, changes): 24 months.
• One-time security codes (challenges): 1 day after expiry. Abuse counters: 2 days.
• Invitations and temporary proof links: 30 days after expiry.
• Assistant: we do not store the content of your questions; only a count (without content) for 90 days.
• Closed complaints and contact messages: 24 months after creation.
• Consent records and withdrawals: for as long as your account exists (final period still to be set).
• Payment and invoice records (once payments are live): 7 years due to the Dutch tax retention obligation, also after your account is deleted.

Your rights

• You have the right of access, rectification, erasure, restriction, portability (for data you provided that we process on the basis of contract or consent), to object to processing based on legitimate interest, and to withdraw consent.
• Much of this you do yourself in the Privacy centre: download data, delete your account, switch off the assistant. For anything else, use the contact form. We respond within one month.
• Disagree with how we handle your data? You can complain to the Dutch Data Protection Authority (autoriteitpersoonsgegevens.nl).

Age

Torivela is intended for people aged 16 and over. You confirm this when signing up. There is no parental-consent procedure for younger children, so younger children cannot create an account.

Automated decisions

We do not take decisions with legal effect based solely on automated processing. Security rules (such as a waiting period after a lost device or a limit on requests) apply equally to everyone and can be reviewed via the contact form.

Security

We use passkeys, two-step verification, encrypted connections and strict per-account access rules. No system is completely secure; also read Security and limitations.