Privacy Policy — Torro CRM

Operated by Compton Traders Ltd (“Torro CRM”, “we”, “us”, “our”)
Last updated: 20 October 2026 · Effective: 11 August 2026

Torro CRM is a multi-channel customer-communication platform (CRM) that lets a business manage its conversations from connected messaging channels — including Telegram, WhatsApp, TikTok and (where available) Instagram — in a single inbox, with team collaboration, automation and AI-assisted replies, tasks, and a sales pipeline. This Privacy Policy explains what personal data we process, why, on what legal basis, with whom we share it, how we protect it, and the rights available to individuals.

This policy applies to https://torrocrm.com and the Torro CRM application and APIs. It does not apply to third-party services (including the messaging platforms) that have their own privacy policies.

1. Our role: controller and processor

Torro CRM serves two categories of individuals, and our role differs for each:

• Business users (our customers and their team members). For personal data about the business account owner and the agents who use Torro CRM (name, email, login, settings, billing), we act as a data controller.
• End-customers (the people a business converses with over a connected channel). When a business connects a messaging channel and we receive, store and process the messages exchanged with its customers, we act as a data processor acting on that business's documented instructions. The business is the controller of those conversations and is responsible for having a lawful basis and for informing its end-customers.

Where this policy describes end-customer conversation data, we act as a processor and process it only to provide the service to the relevant business.

2. Data we process

2.1 Business account data (we are controller)

• Identity & contact: name, email address, phone, company/business name, role.
• Account & security: login credentials (stored hashed/encrypted), authentication tokens, security settings.
• Configuration: connected channels, team members and permissions, templates, automations, AI settings.
• Billing: plan, balance, transactions, invoices. Payments are processed by our payment providers (Stripe and Cryptadium); we do not store full payment card numbers.
• Usage & technical: IP address, device/browser information, cookies, log and diagnostic data.

2.2 End-customer conversation data (we are processor)

When a business connects a channel, we process, on its behalf:

• Message content exchanged between the business and its customers (text, media — images, video, voice notes, files — captions, reactions, delivery/read status).
• Contact identifiers and profile data exposed by the channel (e.g. platform username/ID, display name, avatar, phone number where the channel provides it, country).
• Conversation metadata: timestamps, which channel/account, assignment, tags/labels, pipeline stage, tasks and notes created by the business's agents.
• Derived data produced by our AI features (§5): transcriptions of voice messages, translations, AI-generated reply suggestions, descriptions of images and documents, details extracted into CRM fields, conversation summaries, and message classifications.

We process end-customer data only for the business that owns the conversation and only to provide the service.

2.3 Data from connected platforms

Where a business authorizes a channel, we receive data through that platform's official integration:

• TikTok — via the TikTok Business Messaging API, after the business authorizes our developer app (OAuth). We receive and send the business's Direct Messages and related conversation data for the authorized Business Account only. We do not collect public TikTok content and do not access TikTok Shop messages.
• Meta (WhatsApp / Instagram), Telegram, and other connected channels — analogous, limited to the authorized account's own conversations.

3. How we collect data

• Directly from business users — at registration and while using the service.
• Automatically — cookies, log data and technical information when the app is used.
• From connected channels/platforms — inbound and outbound messages and the associated contact/conversation data, received in real time via the platform's APIs and webhooks after the business authorizes the connection.

4. Purposes and legal bases

For end-customer conversation data we act as processor; the lawful basis for that processing is the responsibility of the business (controller).

5. AI features and third-party AI processing

Torro CRM includes optional AI features. When one of them is used, the data it needs is sent to a third-party AI service provider, which processes it and returns the result (for example, a translation or a transcript). This section lists those features, the data each one sends, who receives it and why, and what the recipient may do with it. Every feature listed in §5.1 is provided by DeepInfra (§5.2); the only other AI provider is Fish Audio, which is used solely for voice messages in an AI character's voice (§5.5).

5.1 AI features and the data they send

• Message translation — when a team member translates a message, when automatic translation of incoming messages is turned on (it is off by default), and when translation of a business's outgoing replies into the customer's language is enabled. We send the text of the messages to be translated and, for outgoing replies, recent messages from the customer and the customer's country, so that the translation matches the customer's language.
• Voice message transcription — when a team member asks to turn a voice or video message into text, or when the business's AI agent or automations need to read a voice message. We send only the sound of that message, converted to a compact single-channel (mono) audio file and limited to its first 30 minutes; the picture of a video message is not sent. Transcription is done by Whisper at DeepInfra (§5.2).
• Reply suggestions and text improvement — when a team member asks for a suggested reply or asks the AI to improve a message they have written. We send the recent messages of that conversation, or the text to be improved.
• AI agent replying on behalf of a business — when a business sets up an AI agent (an AI character) to answer its customers or to send them follow-up messages. We send the conversation history; the instructions, knowledge-base content and offers the business has given the agent; and the details from the customer's CRM card that the business makes available to the agent, such as the customer's name, language, pipeline stage, tags and custom fields and, if a calendar is connected, the customer's meetings (§7).
• Images and documents in conversations — when the AI agent or an automation needs to understand an image or a document that a customer has sent (for example, a screenshot). We send that image or document.
• Message classification, data extraction and conversation summaries — when a business's automations use AI to decide which next step fits an incoming message, to fill in CRM fields or create tasks from what the customer wrote, or to produce summaries and quality reviews of conversations for the business. We send the relevant messages and the business's conditions or instructions.
• Conversation analysis for business users — when a business user asks the AI assistant to analyse the business's conversations (for example, to find the chats that match a description or to review how a sales funnel performs), and when the business has the results of an AI step in its automations reviewed so that better instructions can be suggested for that step. We send the messages of the conversations being analysed, with details such as their pipeline stage, tags and responsible team member, together with the user's request or the step's instructions and results.
• Knowledge-base search — when a business uploads documents to its knowledge base for the AI agent. We send the text of those documents, and of the questions the agent looks up in them, to turn them into a searchable index.
• AI help for business users — when a business user asks the AI assistant to help set up an automation or to improve the instructions they have written for an AI feature. We send what the user writes and the settings being worked on.

We send only the data a feature needs at the moment it runs. The results (translations, transcripts, suggestions, descriptions, summaries) are stored in Torro CRM with the conversation and are deleted together with it, as described in §10.

5.2 Who processes the data: DeepInfra

All the AI processing described in §5.1 is performed by DeepInfra (Deep Infra Inc., 2625 Middlefield Road #460, Palo Alto, CA 94306, United States). For these features DeepInfra runs only open-weights AI models. Open weights means that a model's developer publishes the model files for anyone to run; the developer does not operate the model for us. DeepInfra hosts and runs each of these models itself, so the data used by these features goes to DeepInfra and is not sent to the companies that developed the models.

• Gemma, developed by Google, handles message translation, reply suggestions and text improvement, the AI agent, images and documents in conversations, message classification, data extraction and conversation summaries, the AI agent's answers from the knowledge base, and AI help for business users. We rent dedicated GPU servers from DeepInfra, and on them DeepInfra runs Gemma for us. This data is not sent to Google.
• Whisper, a speech-recognition model developed by OpenAI, handles voice message transcription. It runs on DeepInfra's shared infrastructure, not on the dedicated servers. The audio is sent to DeepInfra and is not sent to OpenAI.
• Qwen3-Embedding, developed by Alibaba's Qwen team, turns knowledge-base documents, and the questions the AI agent looks up in them, into the searchable index. It runs on DeepInfra's shared infrastructure. This data is not sent to Alibaba.
• DeepSeek, developed by DeepSeek, handles conversation analysis for business users. It runs on DeepInfra's shared infrastructure. This data is not sent to DeepSeek.

Under DeepInfra's terms of service, which include its data processing agreement, DeepInfra, for every model listed above:

• uses the data only to provide its service to us, that is, to process each request and return the result;
• does not sell the data and does not use it to train, fine-tune or otherwise improve any AI model;
• does not keep, store or log the data beyond the time strictly needed to process the request and return the result: the data is held in memory while it is processed and is not written to disk, and only technical information about requests, such as request IDs and cost, is logged;
• may keep data longer only where the law requires it, to investigate fraud, security incidents or abuse of its service, or where we ask it in writing to help resolve a specific technical issue, in which case it deletes the data within 30 days after the issue is resolved.

DeepInfra states that its security measures comply with the SOC 2 and ISO 27001 standards. According to its privacy policy, DeepInfra processes data in the United States; see §9 for international transfers. Because DeepInfra uses the data only to return the result, does not keep it after the request and does not use it for any other purpose, the data we send to it is protected to at least the same standard as described in this policy.

5.3 AI features are optional

• A business chooses which AI features to use. The AI agent, automatic translation and automations that use AI run only when the business sets them up, and the business can switch them off at any time; the other features run only when a team member uses them. When a feature is not in use, no data is sent to an AI provider for it.
• In the Torro CRM mobile app, each user is asked for permission before the app sends their data to an AI provider. Until the user agrees, the app does not send data to an AI provider.
• A business that uses AI features in conversations with its customers is responsible, as the controller (§1), for informing those customers.

5.4 Our commitments

• We send data to an AI provider only to provide the feature that the business or its team uses.
• We do not use conversation content to train AI models, and we share it with AI providers only as described in this section.
• Platform data (including TikTok data) is used solely to operate the messaging features and is never used for advertising targeting, sold, or shared with unauthorized third parties.
• These are our own commitments. What an AI provider may do with the data it receives is set by its terms: for DeepInfra see §5.2, and for Fish Audio see §5.5.

5.5 Voice messages in a character's voice: Fish Audio

In the Torro CRM web application, a business can give its AI character a voice, so that messages can be sent as voice messages in that character's voice. This feature uses a separate provider, Fish Audio (Hanabi AI Inc., 1111B S Governors Ave STE 48109, Dover, DE 19904, United States), not DeepInfra. Data is sent to Fish Audio only when a business sets up a voice for its AI character in the web application. The Torro CRM mobile app does not offer this feature and does not send any data to Fish Audio.

What we send to Fish Audio:

• to create the character's voice, the voice or video recordings that the business uploads as samples for that character, labelled with the character's name. Fish Audio keeps a private voice model made from them;
• to produce each voice message, only the text of that single message (a message that a team member chooses to send as a voice message, or one that the business's AI agent or automation sends in the character's voice), or the sample text that a business user enters to preview the voice, together with technical settings such as the identifier of the character's voice and the audio format. Nothing else about the user, the customer or the conversation is sent: no account details, no customer contact details and no conversation history. If the text of the message itself contains personal data, for example the customer's name, that text is sent as written.

We have no agreement with Fish Audio that limits how it uses this data; its own published terms apply. Fish Audio's Terms of Use state: “Usage Data and Content may be used to develop, train, or enhance artificial intelligence or machine learning models that are part of Fish.Audio’s products and services, including third-party components of the Services, and you authorize Fish.Audio to process your Usage Data and Content for such purposes.” Under those terms, Content includes the text and audio provided to Fish Audio. This means that Fish Audio may use the message texts and the voice recordings we send to it to develop, train and improve its AI models. Its privacy policy also states that it retains Content “as long as we need it to ensure that our systems are working appropriately, effectively and efficiently”. A business that does not want its messages or voice recordings to be used in this way should not set up a voice for its AI character.

Fish Audio's privacy policy does not name the countries in which it processes data. It states that the personal data of people in the European Economic Area, Switzerland and the United Kingdom is transferred to, and stored at, a destination outside that region (for instance, to its service providers and partners), and that these transfers are made under appropriate safeguards such as the standard data protection clauses adopted by the European Commission.

6. Platform compliance and use limitations

Our access to and use of data from TikTok, Meta and other platforms is governed by those platforms' developer terms and policies, in addition to this policy. Specifically, data obtained through a platform integration is:

• used only to provide the messaging and CRM features to the authorized business;
• not sold, rented, or used for advertising/ad-targeting;
• not used to train AI/ML models;
• not shared with third parties except the sub-processors strictly necessary to deliver the service (§8);
• deleted when the business disconnects the channel or closes the account, or upon a valid deletion request, subject to §10.

For TikTok specifically: we only interact with conversations of Business Accounts that have authorized our app; personal (non-business) TikTok accounts are not supported; availability depends on the sign-up region of the Business Account.

7. Google user data (Google Calendar integration)

A business user may connect their own Google Calendar to Torro CRM through Google OAuth. We request exactly one scope — https://www.googleapis.com/auth/calendar.readonly — which is read-only. We never create, modify or delete calendar events, and we request no other Google scope.

What we read and why: for a bounded window around the present, we read event metadata — title, start and end time, status, attendee e-mail addresses, and the meeting link. This data is used solely to show the customer's meetings inside that customer's card in the CRM, and to trigger the business's own automations when a meeting is booked or cancelled. It is not used for advertising or ad-targeting, is not sold or rented, and is not shared with third parties other than the sub-processors strictly necessary to deliver the feature (§8).

The use of raw or derived user data received from Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.

In particular, Google user data — whether raw, aggregated or derived — is never used to create, train, fine-tune or improve any generalized or foundational AI/ML model, whether ours or a third party's. Where the business has enabled AI features, a customer's meeting details may be passed to DeepInfra as context, strictly to draft that business's own reply, on the terms described in §5.2: that content is not used for model training and is not retained by DeepInfra beyond delivering the response.

Google user data is stored encrypted at rest and is logically isolated per tenant. Disconnecting the calendar stops synchronization immediately, and the mirrored event data is deleted on disconnect or by retention, in line with §10.

Our use of information received from Google APIs adheres to the Google API Services User Data Policy, including its Limited Use requirements.

8. Sub-processors and third parties

We share personal data only with service providers that we use to deliver the service. They process it on our behalf under contractual confidentiality and data-protection obligations, with one exception: Fish Audio, which produces voice messages in an AI character's voice, uses the data it receives under its own terms (§5.5). Categories and current providers:

• Messaging platforms (integration counterparties): TikTok / ByteDance, Meta Platforms (WhatsApp, Instagram), Telegram.
• AI providers (for the AI features): the providers named in §5, which also describes what data each of them receives and what each of them may do with it.
• Cloud hosting and infrastructure: hosting located in Germany (European Union) (servers, database, cache, message queue, search/logging, object storage for media).
• Payments: Stripe and Cryptadium.

We do not sell personal data. A current list of sub-processors is available on request.

9. International transfers

Business and conversation data is primarily stored on infrastructure located in the European Union (Germany). Some of the providers listed in §8 process data in other countries: for example, DeepInfra processes the data sent to the AI features in the United States (§5.2), Fish Audio, a United States company, transfers data outside Europe as described in §5.5, and certain payment providers may process data elsewhere. Where data is transferred across borders, we rely on appropriate safeguards required by applicable law, such as adequacy regulations or decisions, the UK International Data Transfer Agreement or Addendum, or the European Commission's Standard Contractual Clauses. The exception is data sent to Fish Audio: for it, the safeguards are only those that Fish Audio's own privacy policy describes (§5.5).

10. Data retention and deletion

• Conversation data is retained while the business keeps the channel connected and its account active, or as instructed by the business, and is then deleted or anonymized within 90 days.
• On channel disconnect we stop processing that channel's data and delete platform-provided data associated with it within 90 days, except where retention is required by law.
• On account closure, we delete or anonymize the business's data within 90 days, subject to legal retention (e.g. billing records).
• Data isolation: each business's data is logically isolated per tenant.
• End-customer deletion requests: because we are a processor, requests are routed to and handled by the relevant business (controller); we assist as required.

11. Security

We apply technical and organizational measures appropriate to the risk, including:

• Encryption in transit (TLS) and encryption at rest for sensitive fields;
• Multi-tenant logical isolation so a business can only access its own data;
• Access controls and least privilege for staff, with authentication and audit logging;
• Secured EU-based infrastructure, network controls, and monitoring;
• Regular review, vulnerability scanning and penetration testing.

No method of transmission or storage is 100% secure; we work to protect data but cannot guarantee absolute security.

12. Your rights

Depending on your jurisdiction, individuals may have rights to access, correct, delete, restrict or object to processing, and to data portability, and to withdraw consent.

• Business users can exercise these rights via account settings or by contacting us (§15).
• End-customers should contact the business they communicated with (the controller); Torro CRM will support that business in fulfilling the request.

You may also lodge a complaint with the UK Information Commissioner's Office (ico.org.uk) or with your local data-protection authority.

13. Cookies

We use strictly necessary cookies to run the service and, where enabled, analytics/preference cookies. You can control cookies through your browser.

14. Children

The service is intended for businesses and is not directed to children under 16. We do not knowingly collect data from children.

15. Contact

Controller / operator: Compton Traders Ltd, a company registered in England and Wales (company number 16219075). Registered office: 27 Old Gloucester Street, London, WC1N 3AX, United Kingdom.

Privacy contact: [email protected]. For privacy questions or to exercise your rights, contact [email protected].

16. Governing law

This policy is governed by the laws of England and Wales, without prejudice to mandatory data-protection rights available to individuals under the laws applicable to them.

17. Changes

We may update this policy. Material changes will be notified via the service or by email, and the “Last updated” date will change. Continued use after changes take effect constitutes acceptance where permitted by law.

Download as PDF