Privacy Policy

This Privacy Policy explains how ToRun ('ToRun', 'we', 'us', 'our'), as data controller, collects, uses, shares, and protects personal data when you access the Service at torun.ai and its sub-domains. It is incorporated by reference into our Terms of Service.

We have written this policy to comply with the EU General Data Protection Regulation 2016/679 (GDPR), the UK GDPR and Data Protection Act 2018, the Turkish Personal Data Protection Law No. 6698 (KVKK) and its implementing regulations, the California Consumer Privacy Act of 2018 (CCPA) as amended by the California Privacy Rights Act of 2020 (CPRA), the Brazilian LGPD (Lei No. 13.709), and other privacy laws that apply to our cross-border operations.

If you have questions, contact our Data Protection Officer at /company/contact?category=legal.

1. Who Is the Controller

ToRun in this document means TORUN TEKNOLOJİ ANONİM ŞİRKETİ (Torun Teknoloji A.Ş.), the joint-stock company that provides the Service, incorporated in Türkiye and registered with the İstanbul Ticaret Sicili Müdürlüğü under No. 1165311 (MERSİS No. 0857078305100001), with its registered office at Selimpaşa Mah. 1010. Sk. No: 10/1 İç Kapı No: 1, Silivri / İstanbul, Türkiye.

ToRun is the data controller for personal data processed in connection with the Service, except where we act as a processor on behalf of an Organization customer (for example, an enterprise tenant managing its employees' accounts). In processor scenarios, the Organization is the controller and we are bound by a separate Data Processing Addendum (DPA).

Our registered office above is also our postal address for data-protection correspondence; correspondence to /company/contact?category=legal reaches our Data Protection Officer directly.

2. Information We Collect

2.1 Information you provide

• Account data - email, display name, password hash (never the plain password), optional avatar, language preference, time-zone, and any optional profile fields (bio, social handles, postal address if you opt in for an invoice).
• Authentication credentials - if you sign in through a supported social sign-in provider — currently Google, Microsoft, or X (formerly Twitter) — we receive only the limited profile information you authorise that provider to share. This is typically your email address, display name, profile-picture URL, and the provider's user-ID; for X this may also include your X username. We use this data solely to create or match your Account and to authenticate you. We never receive your password for the external provider, we do not post on your behalf, and we do not read your contacts or social graph.
• Billing information - billing address, VAT/tax identifier (if any), invoice preferences. Payment instruments themselves (card number, bank account, wallet token) are collected and stored by the payment processor — our Merchant of Record, Dodo Payments, for purchases on the website, or Apple (App Store) or Google (Google Play) for purchases in the mobile app — and never reach us. For each transaction we receive only what we need to reconcile it: its status, the product, the amount and currency and, for purchases on the website, the tax and the billing country.
• Runs balance - your prepaid usage-credit (Runs) balance and its transaction history (top-ups, consumption, refund reversals).
• BYOK credentials - third-party AI provider API keys you choose to upload, stored encrypted at rest in a key-management vault.
• Workspace content - conversations, prompts, system instructions, file uploads, workflow definitions, comments, memories, and any other content you create or upload.
• Communications with us - email, chat, support tickets, satisfaction survey responses.

2.2 Information collected automatically

• Usage telemetry - which routes you visit, which features you use, time spent in features, error events, performance metrics (request latency, model latency, throughput).
• Device and connection - IP address (truncated for analytics; full for fraud and security investigations), user-agent string, browser language, device type, operating system, screen resolution.
• Cookies and similar technologies - see Section 11 (Cookies) for the full list and your opt-out controls.
• AI call metadata - model selected, capability set requested, token counts, latency, cost, fund source, and BYOK tier applied. Each AI call produces a BillingRecord with a pricing snapshot, retained per Section 8 (Retention).
• Crash reports (mobile app) - when the mobile app crashes while you are signed in, it sends the error message, the technical error trace, the name of the screen, the app, update and operating-system versions, and the time. We write the report to our server logs together with your user ID and the app's user-agent string; it is not stored in a database and is deleted with the logs after at most 30 days.
• Guest-trial device verification (mobile app) - device-verification results from Apple (App Attest, DeviceCheck) or Google (Play Integrity), a keyed hash of a device identifier and a keyed hash of your IP network prefix; see Section 2.5.

2.3 Information from third parties

• Payment metadata from Dodo Payments for purchases on the website, and from Apple or Google for purchases in the mobile app (described above).
• Fraud and risk screening results performed by our Merchant of Record / payment processor on payment transactions.
• Automated moderation results from our content-moderation provider — the classification returned when uploaded images and publicly published text are screened (see our Acceptable Use Policy).

2.4 Sensitive categories

We do not solicit special-category data (GDPR Article 9) - race, ethnicity, political opinions, religious beliefs, trade-union membership, genetic data, biometric data, health, sex life, sexual orientation - or KVKK Article 6 'special' personal data. If you submit such information voluntarily through prompts, files, or comments, we process it only as needed to deliver the Service to you and we apply enhanced protections.

2.5 Trying the mobile app without an account

You can try the ToRun mobile app for a limited time without creating an account (the "guest trial"). During the trial we do not ask for your name, e-mail address or phone number. To provide the trial, to stop it from being started again and again on the same device, and to prevent abuse, we process the following:

• Device verification - the app asks Apple (App Attest, DeviceCheck) or Google (Play Integrity) to confirm that the device and the app are genuine, and our server checks the result with them. We do not store the verification tokens. Apple keeps two values per device for us on its own servers ("a trial was given", "an account was created on this device").
• Device identifier - on iOS, a random identifier that the app creates and keeps on the device; on Android, the app-specific device identifier (ANDROID_ID). Only a one-way hash of it leaves the device, and we store it only after hashing it again with a secret key (a keyed hash). On iOS we also store a keyed hash of the App Attest key identifier.
• Network - a keyed hash of the network prefix of your IP address, never the full address, for the trial's daily limits.
• Trial record - how much of the trial is left, its status and, if a trial was refused, the reason.
• What you try - the message you type, your voice conversation, the photo you choose and the name you give for a song are sent to the AI provider that produces the result and to our content-moderation provider (Section 5.1). Your photo is used only to make the image and is not stored. A voice conversation is not recorded and its transcript is not stored. Your latest messages are kept for up to 24 hours after your last message, so that the next answer has context; they are not saved as a conversation. What the trial produces (a song, an image) is kept for 24 hours and then deleted.

Retention. Trial records are deleted automatically 90 days after the trial was given, and device records 90 days after the device was last used for the trial. If you create an account from the trial, the link between the account and the device is kept for 365 days, so that a second account created on the same device does not receive the welcome gift again. The billing record of what the trial used is kept for 5 years, as accounting law requires; it identifies the trial, not you, and carries the keyed hash of the network prefix, which is removed if you delete your trial data.

If you create an account. What you made during the trial moves into your account's Library and is kept as part of your account from then on; the device record is linked to your account.

Legal basis. Our legitimate interest in keeping the service secure and preventing abuse of a free trial (GDPR Art. 6(1)(f); KVKK Art. 5(2)(f)), and providing the trial you asked for (GDPR Art. 6(1)(b); KVKK Art. 5(2)(c)). Sending data to Apple's and Google's verification services and to AI providers is an international transfer, covered by Section 6.

Deleting your trial data. You can delete your trial data at any time in the app, without an account: on the welcome screen, open "Your trial data" and choose "Delete my trial data". The device is verified the same way as for the trial itself, so nobody else can delete your trial data or learn anything about it. Afterwards we keep only a note that this device has used its trial (nothing else, for at most 90 days) and, for one day, that a trial was used on your network, so that the trial cannot simply be started again. If you created an account, deleting the account also deletes the trial records linked to it. The two values Apple keeps for a device are not linked to you; we do not reset them, because resetting them would allow a new trial on that device.

3. How We Use Your Information

We use personal data for the following purposes:

#	Purpose	GDPR Article 6 lawful basis	KVKK basis
a	Operate the Service (account, routing, dashboards, notifications)	Contract (Art. 6(1)(b))	Performance of contract
b	Bill you, prevent fraud, comply with anti-money-laundering law	Contract; legal obligation (Art. 6(1)(b), (c))	Performance of contract; legal obligation
c	Send transactional emails (receipts, password resets, security alerts)	Contract (Art. 6(1)(b))	Performance of contract
d	Improve, debug, and secure the Service	Legitimate interest (Art. 6(1)(f))	Legitimate interest
e	Send marketing communications (opt-in only)	Consent (Art. 6(1)(a))	Explicit consent
f	Respond to your data-subject requests	Legal obligation (Art. 6(1)(c))	Legal obligation
g	Defend ourselves against legal claims; comply with court orders	Legal obligation; legitimate interest	Legal obligation
h	Train, fine-tune, or otherwise improve our own AI models	We do NOT do this with your content	n/a

3.1 We do not train on your content

ToRun does not use your prompts, files, conversations, or generated outputs to train, fine-tune, or otherwise improve any AI model, our own or anyone else's. When you use BYOK, the third-party provider's training posture is governed by that provider's terms; we recommend reviewing them. For non-BYOK calls, we use providers under contractual terms that prohibit them from training on our customers' content.

4. Cookies and Similar Technologies

We use cookies and similar storage (localStorage, IndexedDB) for:

• Strictly necessary - authentication (OpenIddict access token, refresh token), session continuity, anti-CSRF tokens, load-balancing affinity, cookie-consent persistence.
• Functional - language preference, theme (dark/light/dim), recently used workspace, last-selected model.
• Analytics - aggregated usage analytics, never tied to a real identity in our analytics warehouse (we use a salted device hash, not your User ID).
• Marketing - off by default; if you opt in, we may set first-party attribution cookies.

You can manage these preferences in the cookie banner the first time you visit, and you can change them at any time via the Cookie preferences link in the footer. Some strictly necessary cookies cannot be disabled because the Service would not function without them.

5. How We Share Personal Data

We share personal data only as needed to run the Service. We never sell personal data in the sense of the CCPA/CPRA (Civil Code 1798.140(t)).

5.1 Sub-processors

Our current sub-processors are listed in Annex III of our Data Processing Agreement, which is updated as we change vendors. In summary:

• Dodo Payments - Merchant of Record for purchases on the website: payment processing, invoicing, tax handling, refunds and chargebacks.
• Apple (App Store) and Google (Google Play) - payment processing for purchases made in the mobile app, which the store sells under its own terms.
• Bunny.net (BunnyWay d.o.o.) (Slovenia) - object storage, CDN, image and video optimizer, video streaming.
• Microsoft Azure / Hetzner / OVH - infrastructure hosting (region depends on tenant choice).
• Kafka-compatible event streaming providers - real-time event bus for transactional outbox and analytics.
• Third-party AI providers - which provider receives a given request depends on the capability you ask for and the model you or your routing settings select; the providers and models currently available are listed in the Service. AI providers receive the minimum content necessary to fulfil your specific request, and only when you (or your routing settings) cause a request to be sent to them.
• Content-moderation provider (OpenAI) - automated screening of uploaded images and publicly published text to detect prohibited content, per our Acceptable Use Policy. Payment-related KYC / AML checks are performed by our Merchant of Record.
• Email and notification delivery providers - transactional email (receipts, password resets, security alerts).
• Analytics and product-improvement tooling - aggregated usage analytics on a contractual-no-PII basis.
• Customer-support tooling - to handle your tickets and feedback.
• Apple and Google device-verification services (App Attest and DeviceCheck; Play Integrity) - to confirm that the device and the app are genuine during the mobile guest trial (Section 2.5).
• Google Maps Platform - place search, place details, directions and maps when you ask about places or share your location; in the iOS app, some maps are drawn by Apple Maps.

5.2 Legal disclosures

We may disclose personal data to law enforcement, regulators, or courts in response to a valid legal request (subpoena, court order, search warrant, regulator demand) issued under applicable law. Where permitted, we will notify you before disclosure so you may seek a protective order.

5.3 Business transfers

If we are involved in a merger, acquisition, financing, or sale of substantially all of our assets, personal data may transfer as part of that transaction. We will notify affected users and provide a meaningful chance to object or close their Account before the transfer takes effect, except where notice is precluded by law.

5.4 With your consent

We will share personal data for any purpose not listed above only with your explicit consent.

6. International Data Transfers

ToRun operates from Istanbul, Turkey, and uses sub-processors in the European Union, the United Kingdom, the United States, and other jurisdictions. Whenever we transfer personal data outside your country of residence, we rely on a lawful transfer mechanism:

• GDPR Chapter V - EU Standard Contractual Clauses (2021/914 Commission Decision) plus supplementary measures (encryption in transit and at rest, restricted access, audit logging) per the EDPB Recommendation 01/2020.
• UK GDPR - UK International Data Transfer Addendum to the EU SCCs.
• KVKK Article 9 - explicit consent or one of the Article 9(2) safeguards (binding commitment, adequate-country recognition).
• Adequacy decisions - where the European Commission has issued an adequacy decision, we may rely on it.

You may request a copy of the transfer-mechanism documentation by writing to /company/contact?category=legal.

7. Security

We apply technical and organisational measures appropriate to the risks of processing personal data, including:

• Encryption in transit for every API request via TLS 1.3.
• Encryption at rest for BYOK secrets, billing data, audit logs, and document content via cloud key-management service.
• Access control - role-based, least-privilege, with mandatory multi-factor authentication for staff; access reviewed quarterly.
• Audit logging - hash-chained tamper-evident logs for billing, moderation, and administrative actions, retained 5 years.
• Network security - rate limiting, web-application firewalling, anomaly detection, denial-of-service mitigation.
• Vulnerability management - automated dependency scanning, code-review gates, biannual penetration testing by an independent firm.
• Incident response - documented runbooks, on-call rotation, breach-notification procedures.
• Vendor due diligence - all sub-processors are reviewed against our security and privacy baseline before onboarding.

No system is perfectly secure. If you become aware of a security issue, please report it to /company/contact?category=trust so we can investigate.

8. Data Retention

Data category	Retention period
Account profile and credentials	Lifetime of Account + 30 days
Workspace content (chats, files, workflows)	Lifetime of Account + 30 days
BillingRecord and invoices	5 years (legal accounting and audit)
Audit logs (hash-chained)	5 years (Section 7)
Tax-related documents	10 years (Turkish tax legislation)
Marketing-consent records	Lifetime of consent + 3 years
Email transactional logs	12 months
Web analytics (aggregated, no PII)	26 months
BYOK secret material	Until you remove the key, plus 30-day grace
Guest trial records (mobile app)	90 days after the trial was given
Guest trial device records	90 days after the device was last used for the trial
Guest trial outputs not moved to an account	24 hours
Guest trial messages (context for the next answer)	Up to 24 hours after the last message
Note that a device has used its trial (after you delete your trial data)	At most 90 days
Account–device link after a guest trial	365 days
Mobile app crash reports (server logs)	At most 30 days

Closed accounts are soft-deleted immediately and hard-deleted (cryptographic erasure where supported, secure overwrite otherwise) 30 days after closure, subject to retention requirements above.

9. Your Rights (GDPR / UK GDPR)

If GDPR or UK GDPR applies to you, you have the following rights with respect to your personal data:

• Access (Article 15) - obtain a copy of the personal data we process and information about that processing.
• Rectification (Article 16) - correct inaccurate or incomplete data.
• Erasure (Article 17, the 'right to be forgotten') - request deletion in defined circumstances.
• Restriction (Article 18) - request that we pause processing pending verification.
• Portability (Article 20) - receive your data in a structured, commonly used, machine-readable format.
• Objection (Article 21) - object to processing based on legitimate interests; you have an absolute right to object to direct marketing.
• Automated decision-making and profiling (Article 22) - not be subject to a decision based solely on automated processing that produces legal effects or similarly significant effects (see Section 13).
• Withdraw consent at any time, without affecting the lawfulness of processing before withdrawal.
• Lodge a complaint with the supervisory authority in the EU/UK Member State where you live, work, or where the alleged infringement took place.

To exercise these rights, submit a Data Subject Request from your Account dashboard or by emailing /company/contact?category=legal. We respond within 30 days (Article 12(3)). Where appropriate we may verify your identity before responding.

If you tried the mobile app without an account, you can delete your trial data in the app itself (Section 2.5). We hold nothing that identifies you as a guest, so we cannot find a trial from an e-mail request.

10. Your Rights (KVKK - Turkey)

Turkish users can read our full KVKK Aydinlatma Metni (data-protection clarification notice) for the detailed disclosure.

Under Article 11 of the Turkish KVKK, you have the right to:

• learn whether your personal data are being processed;
• request information if your data have been processed;
• learn the purpose of processing and whether the data are used in line with that purpose;
• know to whom personal data have been transferred at home and abroad;
• request correction of incomplete or incorrect data;
• request deletion or destruction of personal data;
• request notification of any correction, deletion, or destruction to third parties to whom the data were transferred;
• object to a decision based solely on automated processing that produces unfavourable results;
• claim compensation for damage arising from unlawful processing.

You may exercise these rights by writing to /company/contact?category=legal or by submitting a request via the Veri Sorumlusuna Başvuru Usul ve Esasları Hakkında Tebliğ. We respond within 30 days of receiving a properly formed request.

Complaints may be lodged with the Kişisel Verileri Koruma Kurumu (KVKK) at kvkk.gov.tr.

11. Your Rights (CCPA / CPRA - California Residents)

California residents have the right to:

• Know the categories of personal information we have collected, the sources, the purposes, and the categories of third parties with whom we share it (Civil Code 1798.110, 1798.115).
• Delete personal information subject to exceptions (1798.105).
• Correct inaccurate personal information (1798.106, CPRA).
• Limit the use and disclosure of sensitive personal information (1798.121).
• Opt out of any 'sale' or 'sharing' for cross-context behavioural advertising. We do not sell personal information, and we do not share for cross-context behavioural advertising.
• Non-discrimination - we will not deny services, charge different prices, or provide a lower quality of service because you exercised a privacy right.

To exercise your CCPA rights, email /company/contact?category=legal. You may designate an authorised agent to act on your behalf with verifiable written permission.

12. Children's Privacy

The Service is not directed to children under 13 (or the applicable digital-consent age in your jurisdiction, for example 16 in some EU Member States). We do not knowingly collect personal data from children under those ages. If you believe a child has provided us personal data, contact /company/contact?category=legal and we will delete the data promptly.

13. Automated Decision-Making

The Service uses automated decision-making to:

• route AI calls to specific providers based on capability and price;
• flag content for moderation review using automated classifiers;
• detect fraud and abuse using risk-scoring systems;
• reconcile billing and usage records.

These decisions do not produce legal effects in the sense of GDPR Article 22 in most cases, but where they do (for example a decision to permanently terminate an Account for fraud), you may request human review by writing to /company/contact?category=legal.

14. Marketing Communications

We send marketing emails only with your prior, freely given, informed consent. Each marketing email includes an unsubscribe link, and you can manage marketing preferences in your Account settings. Transactional messages (security alerts, billing receipts, password resets, important Service updates) are not marketing and you cannot unsubscribe from them while your Account is open.

If you sign up for product updates but do not confirm your address, we delete the sign-up after 30 days.

15. Data Breach Notification

We notify the relevant supervisory authority and affected individuals of any personal-data breach without undue delay and in any event within 72 hours of becoming aware of the breach, where the breach is likely to result in a risk to your rights and freedoms (GDPR Article 33; KVKK Communiqué on Personal Data Breach Notification).

Notifications are sent to the email address on your Account and to a public incident page at torun.ai/incidents where appropriate.

16. Cookies, Tracking and Do-Not-Track

We honour the Global Privacy Control (GPC) signal where applicable. We do not respond to legacy 'Do Not Track' browser headers as there is no industry consensus on what they mean. Cookie-level preferences set in our banner take effect immediately and synchronise across your sessions.

17. Changes to This Policy

We may update this policy from time to time. The current version is always available at torun.ai/privacy-policy with an effective date and version number. Material changes will be notified by email at least 30 days before they take effect. The latest version controls; archived versions are available on request.

18. Contact and Supervisory Authorities

Data Protection Officer: /company/contact?category=legal

Postal address: TORUN TEKNOLOJİ ANONİM ŞİRKETİ, Selimpaşa Mah. 1010. Sk. No: 10/1 İç Kapı No: 1, Silivri / İstanbul, Türkiye

Supervisory authorities:

• Turkey - KVKK (Kişisel Verileri Koruma Kurumu) - kvkk.gov.tr
• European Union - find your local DPA at edpb.europa.eu/about-edpb/about-edpb/members_en
• United Kingdom - ICO - ico.org.uk
• California, USA - CPPA (California Privacy Protection Agency) - cppa.ca.gov

If you are not satisfied with our response to your request, you have the right to lodge a complaint with the supervisory authority for your jurisdiction.

19. Language

This policy is provided in English as the master version. Translations are offered for convenience; in case of conflict between the English version and a translation, the English version controls, except where mandatory data-protection law of your country requires otherwise.