Privacy Policy

Who we are

The controller is TorosRicos OÜ, registry code 16767169 (Estonian Commercial Register), VAT number EE102631131, Kiikri 6/2-4, 10159 Tallinn, Estonia. Email: info@torosricos.com. Toros Ricos is the brand under which TorosRicos OÜ operates.

Questions about this policy or your data can be sent to info@torosricos.com.

What this website is

torosricos.com gives general information about our company and our projects. Visitors do not need an account. A private administration area is available only to team members we invite; they sign in with an email address and password.

Data we process

• Contact form: the name, email address and message you enter, and optionally your company and phone number, together with the time and the page you sent it from.
• Email to us: the content of your email and your address.
• Abuse prevention for the contact form: a one-way hashed value derived from your network address (we do not store the address itself), your browser's user-agent string, the referring page if your browser sends one, and a key that recognises an accidental repeat submission.
• Network security: our network provider Cloudflare sets a short-lived security cookie (see Cookies) and processes connection data to deliver the site and filter automated abuse.
• Optional analytics, only after you accept: usage measurement through Google Analytics (see Analytics).
• Team members: account email, role, sign-in records and an activity log of administrative actions.

Purposes and legal bases

Where we rely on legitimate interests you may object, as explained under Your rights.

• Answering your inquiry and keeping a record of the correspondence: our legitimate interest in handling business inquiries (Article 6(1)(f) GDPR) and, where you ask for steps before a possible agreement, Article 6(1)(b).
• Protecting the website and the contact form from abuse: our legitimate interest in security (Article 6(1)(f)).
• Optional Google Analytics: your consent (Article 6(1)(a)). You can withdraw it at any time; withdrawal does not affect measurement made before it.
• Running and securing our private team tools, including Google reporting: our legitimate interest in operating our business (Article 6(1)(f)).
• Keeping records required by law: legal obligation (Article 6(1)(c)).

How inquiries are handled

Inquiries go to an internal inbox that only authorised team members can see. Internal notes are never shared back to the sender or published.

Our emails, such as replies, team invitations and sign-in messages, are sent from noreply@send.torosricos.com through Cloudflare's email service. Replies go to info@torosricos.com.

Cookies and similar storage

• Necessary, set without consent: your cookie choice is stored in your browser (tr.consent.analytics.v1) so we can respect it. Cloudflare sets the security cookie __cf_bm to tell people from automated traffic; Cloudflare states it expires after 30 minutes of inactivity. Invited team members' sign-in session is stored in their browser.
• Optional, only after you select Accept: the Google Analytics cookies _ga and _ga_0YKLXWG1FB. Google's default lifetime for these is up to 2 years; it is renewed on later visits.
• If you reject or later withdraw (Cookie preferences, in the footer of every page), analytics stops and those two cookies are removed. The website works the same either way. Advertising features stay switched off.
• Fonts and pictures are served from torosricos.com itself; no font is loaded from Google.

Analytics

With your consent we use Google Analytics (measurement ID G-0YKLXWG1FB) to count visits, page views and a small fixed set of events, such as opening a project page or a contact button and a successfully sent inquiry. We do not send form content, email addresses or team identities to Google. Web addresses are sent without query strings or fragments. Private, sign-in and administration pages are never measured. Google Ads features and Google signals are switched off.

Before you choose, or after you reject, the Google tag is not loaded and nothing is sent to Google.

Google reporting in our private team area

Google is not used to sign in to Toros Ricos. Our administration area can read Google Analytics and Google Search Console reports for torosricos.com. Currently only the team member holding the Platform Owner role can connect a Google account, choosing an account that is allowed to grant access to those properties, and confirms on Google's consent screen. The permissions requested are: basic identity (openid) and the account's email address, to show which account is connected; read-only Google Analytics; and read-only Search Console. We cannot change anything in Google.

• Data accessed: the connected account's email address and Google identifier; names and identifiers of the Analytics properties, data streams and Search Console properties it can see; and report figures for those properties, such as users, sessions, page views, events, top pages, traffic channels, top search queries, clicks, impressions, click-through rate, position and sitemap status.
• Purpose: showing website traffic, search performance and connection health to authorised team members.
• Who can see it: team members whose role allows reading settings (currently Platform Owner, Super Admin and Auditor). Only the Platform Owner can connect, check or disconnect.
• Saved reports: when our nightly reporting job runs, it saves whole-period totals for the last 30 complete days in the private job history.
• Ask AI: when an authorised team member asks the built-in assistant about traffic or search, only the report figures needed for the answer are sent through Lovable AI Gateway to an OpenAI model to write the reply. Google tokens and the connected email address are not included. Our AI service allows extended-retention models. Providers may retain prompts and outputs, including for at least 30 days for some allowed models; the actual retention period for each Ask AI model or request has not been verified. The visible provider statement says this data is never used to train AI models. We do not claim zero data retention. A notice above the assistant explains this before anything is sent.
• Your own AI assistant: an authorised team member may connect their own assistant (for example ChatGPT or Claude). Report figures they request that way go to the assistant they chose, under that provider's terms.
• Storage and security: Google access and refresh tokens are encrypted on our servers and never shown in a browser. Connect, check and disconnect actions are recorded in our activity log.
• Removal: the Platform Owner can disconnect at any time, which deletes the stored tokens, permissions and connected email from the connection record. Access can also be revoked at https://myaccount.google.com/permissions.

Google API Services User Data Policy

Toros Ricos' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy (https://developers.google.com/terms/api-services-user-data-policy), including the Limited Use requirements. We use Google user data only to provide the reporting features described above. We do not sell it, do not use it for advertising, and do not use it to develop, improve or train generalized AI or machine-learning models. People at Toros Ricos read it only as part of these features, with the account holder's consent, for security purposes, or to comply with law.

Service providers

These providers process data on our behalf to run the website and our tools: Lovable (website hosting and the AI gateway used by Ask AI), Supabase (database and team sign-in), Cloudflare (domain name service, network delivery and security, stored pictures, and email delivery), Google (optional Analytics and read-only reporting) and OpenAI (the AI model used by Ask AI, reached through Lovable). We do not sell personal data.

International transfers

Some of these providers, or their sub-processors, may process data outside the European Economic Area. Where that happens, the transfer must rely on a safeguard recognised in Chapter V of the GDPR, such as an adequacy decision (including the EU-U.S. Data Privacy Framework for certified companies) or the European Commission's standard contractual clauses. You can ask us at info@torosricos.com which safeguard applies to a provider.

How long we keep data

• Open inquiries: while they are being handled.
• Closed inquiries: they become due for erasure 24 months after they are closed. Erasure is carried out by an authorised administrator and redacts the personal content in place.
• Contact form abuse-prevention data: becomes due for clearing after 30 days and is cleared when an administrator runs the retention review.
• Google connection: tokens and connection details until the connection is removed. Saved reporting totals and activity log entries are kept as part of our administration records.
• Analytics cookies: see Cookies above. Google keeps Analytics data under the retention set in our Analytics property.
• You can ask us to erase your inquiry earlier; we will do so unless the law requires us to keep it.

Your rights

We do not make decisions based solely on automated processing that produce legal or similarly significant effects for you. To use your rights, write to info@torosricos.com. We may ask for information needed to confirm the request is about your own data, and we answer within the time the GDPR requires.

• Access a copy of your data.
• Rectify inaccurate data.
• Erase your data where the GDPR allows.
• Restrict processing where the GDPR allows.
• Receive your data in a portable format where the GDPR allows.
• Object to processing based on our legitimate interests; we will stop unless we have compelling legitimate grounds or need the data for legal claims.
• Withdraw consent to analytics at any time, through Cookie preferences in the footer.
• Complain to the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, www.aki.ee) or to the authority where you live or work.

Security

We use role-based access, encryption of stored Google tokens and an activity log of administrative actions. No method of transmission or storage is completely secure.

Links to other websites

Other websites we link to have their own privacy practices, which we do not control.

Changes

When we change this policy we publish the new version on this page with a new last-updated date.