Legal information

Privacy Policy

What personal data Torhash processes, why, who it passes them to, how long it keeps them and how to exercise your rights.

This English text is a translation of the Ukrainian original at torhash.app/konfidentsiinist/, provided for convenience. The Ukrainian version is the binding one and prevails in case of any discrepancy.

Version of 16 September 2026

1. Who processes the data

1.1. The controller of personal data is the individual entrepreneur Ivan Vasylovych Habor (hereinafter — we). The registration details are set out in the public offer. Send requests concerning personal data to support@torhash.app.

1.2. This policy covers two different cases:

data of visitors to the torhash.app website and of shop owners who use Torhash — we are the controller of that data;
data of buyers who contact a shop created in Torhash — the controller of that data is the shop owner, and we process it as a processor on the owner's instructions (section 4).

1.3. We process personal data in accordance with the Law of Ukraine “On Personal Data Protection”.

2. The torhash.app website

Waitlist (no longer collected)

While access to Torhash was by invitation, the website had a waitlist form. It is gone now: a shop is created in the bot. We still hold the entries sent earlier in Google Firestore — an e-mail, optionally a Telegram username and a shop name, the time of submission and the first 200 characters of the browser string (in order to tell people from bots). The basis is the consent given when the form was submitted. We use them only in order to contact you about Torhash; write to us and we will delete your entry.

Advertising and the Meta Pixel

The website uses the Meta Pixel from Meta Platforms Ireland Limited. The pixel tells Meta that you viewed a page or went from it to Telegram, together with technical data about your browser. Meta and other third parties use cookies and similar technologies in order to measure the effectiveness of advertising and to display it, and may link these events to your Facebook or Instagram account. We use this data in order to evaluate our advertising and to show it to people who may find Torhash useful.

You can opt out of personalised advertising in Meta's ad settings, and visitors from the EU can also do so at youronlinechoices.eu. Cookies can be deleted or blocked in your browser settings.

Cookies

The website sets no other tracking cookies. The owner's application keeps technical data in browser storage so that it does not ask you the same thing twice.

3. Shop owners' data

3.1. When you use Torhash, we process:

Telegram account data that Telegram passes to the bot: identifier, first name, last name, username, language, permission to receive messages from the bot, time of sign-in; your name and e-mail if you entered them in your profile;
the referral source — the tag of the link through which you first opened Torhash, for example from an advertisement;
shop data: name, description, instructions for the agent, working hours, delivery and payment terms, the shop's contacts (phone, e-mail, Instagram, city), the payment details you show to buyers, sender details for Nova Poshta;
the catalogue: products, prices, availability, photos, voice messages and links from which product cards were created;
the orders of your shop;
correspondence with the agent: messages, photos and voice messages, the agent's actions and the model's technical responses;
payments for Torhash: the plan, the amount, the date, payment and subscription identifiers; for card payment — the masked card number as monobank passes it; for payment in Stars — the payer's Telegram identifier. We do not receive the full card number;
the keys of the services you have connected: Nova Poshta, Prom.ua, monobank, Checkbox, MyDrop, Instagram;
Telegram Business, if you have connected it: messages from private chats that the agent replies to;
feedback and bug reports that you send.

3.2. Purposes and bases of processing:

provision of the services under the public offer — in order to conclude and perform the contract;
security of the Service, prevention of abuse, correction of errors and review of the quality of the agent's replies — our legitimate interest;
accounting for payments — compliance with the requirements of the law.

4. Shop buyers' data

4.1. When a buyer writes to a shop on Telegram or Instagram, or places an order in the storefront, we process on behalf of the shop owner:

the identifier, name and username on Telegram or Instagram;
the phone number, if the buyer shared it;
the messages, photos and voice messages that the buyer sent to the shop, and the agent's replies;
the contents of the order, the recipient's name and phone number, the Nova Poshta branch or address, notes to the order;
reactions to the bot's messages and requests to the shop's support;
the buyer's name, phone number and e-mail from orders that the shop imports from Prom.ua.

4.2. The controller of this data is the shop owner: the owner determines why and how it is to be processed. We process it only in order to run the shop that the owner has set up.

4.3. If you are a buyer and want to obtain, correct or delete your data, contact the shop. You can also write to us at support@torhash.app: we will pass the request on to the shop and help it to be fulfilled.

5. Artificial intelligence

5.1. So that the agent can reply and perform actions, the content of the conversation, together with the shop, catalogue and order data needed for the task, as well as photos and voice messages, is passed to the model provider. The main provider is Google. If we change the model provider, we will update this policy first.

5.2. During live digitization the application sends the image from the camera and the sound from the microphone directly to Google. Torhash does not store this stream.

5.3. In order to find the agent's errors, sampled conversations are reviewed automatically every night by an AI model. An operator may turn an individual conversation into a test case for checking the agent; before that, phone numbers are removed from it and the operator reviews the text manually.

5.4. For product cards the agent searches for images and descriptions in search services (Brave Search, Google, Wikimedia). The queries contain product names.

5.5. We do not train artificial intelligence models on your data or on the data of your buyers.

5.6. What the agent does by itself and what it first shows for confirmation is determined by the shop owner in the settings.

6. Who we pass data to

Google Cloud and Firebase (Google Ireland Limited, Google LLC) — hosting, database, files, queues, encryption keys, logs. The Service runs in the europe-central2 region (Warsaw). Google's AI services may process data outside this region.
Anthropic PBC — review of the quality of the agent's replies (section 5).
Telegram — all bot messages pass through Telegram. Payment in Stars is processed by Telegram.
monobank (АТ «Універсал Банк», JSC Universal Bank) — card payment. We pass the amount, the payment purpose and the contents of the basket, without the buyer's data.
Nova Poshta — the recipient's name and phone number and the branch, when the shop creates a waybill.
MyDrop — the buyer's name, phone number and city, if the shop has connected MyDrop.
Instagram (Meta Platforms) and Prom.ua — only if the shop has connected them, and only within that integration.
Checkbox — product names and amounts for the shop's fiscal receipts, without the buyer's data, if the shop has connected Checkbox.
Sentry (Functional Software, Inc.) — reports about technical errors; keys and tokens are stripped out of them. Reports are stored in the EU (Germany).
Brave Search, Google, Wikimedia — search queries with product names.

We do not sell personal data and do not pass it to advertising networks, apart from the Meta Pixel on the website (section 2). Data may be disclosed to public authorities only in the cases provided for by law.

7. Who on our side has access

Only Torhash operators on a dedicated list have access to shop data. They can view conversations, orders and shop data in order to handle support requests and errors. Every such view is written to the audit log.

8. Security

8.1. Data is transmitted encrypted (TLS). Bot tokens and the keys of connected services are additionally encrypted with a key stored in Google Cloud KMS, and do not end up in logs.

8.2. The rest of the data, in particular messages and phone numbers, is stored in the Google Cloud database and file storage, which encrypt data on disk. There is no separate encryption of messages and phone numbers at the application level.

8.3. If you have noticed a vulnerability or a data leak, write to support@torhash.app.

9. How long we keep data

The waitlist — until you ask us to delete the record. We delete it within 30 days of the request.
Owner, shop, catalogue, conversation and buyer data, in particular photos and voice messages, — for as long as the shop exists in Torhash. Archiving or deleting a shop in the application does not erase the data: the shop can be restored. To delete the data permanently, write to us — we delete it within 30 days of the request, apart from data that the law obliges us to keep.
Payment data — for the period established by tax and accounting legislation.
Database backups — 7 days, after which deleted data disappears from them as well.
Technical logs — no longer than needed for the security of the Service and for investigating errors.
Instagram — if you remove Torhash in the Instagram settings (“Settings → Security → Apps and websites”), we automatically delete the access token, the business account data and the buyer identifiers obtained through Instagram.

10. Your rights

10.1. Under Article 8 of the Law of Ukraine “On Personal Data Protection” you have the right, in particular:

to know what data of yours we process, why, where we obtained it and who we pass it to;
to obtain access to your data;
to demand the correction of inaccurate data or its deletion;
to object to the processing of your data;
to protection against an automated decision that has legal consequences for you;
to withdraw consent to the processing, if the processing is based on consent;
to complain to the Ukrainian Parliament Commissioner for Human Rights or to a court.

10.2. Send requests to support@torhash.app. We reply within 30 calendar days. In order to protect your data, we may ask you to confirm that it was indeed you who sent the request.

11. Transfer of data abroad

Data is stored in Google Cloud in Poland. Google, Anthropic, Telegram and Sentry may also process data in other countries, in particular in the USA. We pass data to these providers because without this it is impossible to provide the services under the contract, and we rely on their standard data protection terms.

12. Children

Torhash is intended for running a business and is not designed for persons under the age of 18. If you have learned that a child has given us their data, write to us and we will delete it.

13. Changes to the policy

We update the date at the top of the page after every change. We notify shop owners of material changes in the manager bot @torhash_app_bot before they take effect.