How your data is handled

You can use toro4n without an account, and when you do, nothing about you or your models leaves your browser. If you sign in, toro4n stores your email address and the models you choose to save online, within the EU, so that you and the people you share them with can open them. This page explains exactly what is stored, where, for how long, and why.

Who is responsible

toro4n (toro4n.com) is run by Lantz Hedström Consulting AB, company registration number 559215-6557, Fiskarfjärdsstranden 36, 127 41 Skärholmen, Sweden. The company is the controller of the personal data described on this page. You can send any requests about your data to that address.

If you do not sign in

Your models are stored in your own browser and in any files you save yourself. Nothing is sent to toro4n's server, no cookie is set, and we store nothing about you. Whether or not you sign in, there are no analytics, no tracking, and no advertising.

If you sign in

Signing in is optional. If you do sign in, toro4n's server stores the following:

• Your email address and the time your account was created. We use your email address to sign you in, to send you sign-in codes, and to show the people you work with who has access to a shared model.
• Your sign-in on each browser: a scrambled form of the key that keeps you signed in, along with when it was created and last extended. It is removed when you sign out and stops working 30 days after it was last extended.
• The models you choose to save online: their name and content, when they were created and changed, and who changed them. They are sent over an encrypted connection and stored encrypted by our hosting provider. Only you and the people you share a model with can open it in toro4n. We do not open or read your models unless you ask us to or the law requires it. A model is saved online only when you choose “Save online” for it; all your other models stay in your browser.
• Earlier versions of those models, stored in the same way, so that you can return to an earlier state of a model. With each version, we store when it was last changed and the email addresses of the people who changed it since the previous version.
• Your folders: the names of the folders you create in My models and which of your online models are in each one. Only you can see them; the people you share a model with can't see your folders.
• Who you share a model with: the email addresses you invite, and whether each person can edit or only view. Each person you invite receives one email letting them know you've shared a model with them, so please invite only people who expect to hear from you.
• AI assistants you connect: the name the assistant gives itself, the addresses it returns to, when you allowed it, when it was last used, and scrambled forms of the keys it uses. An assistant you allow can view, create, and change your online models and the models shared with you. Anything it reads is sent to the company behind the assistant (for example, Anthropic for Claude or OpenAI for ChatGPT) and handled under that company's terms; toro4n itself never sends anything to them. You can disconnect an assistant under Account at any time.
• Abuse-prevention counters: how many sign-in codes and invitations were recently requested. They are stored under a scrambled form of the email address or network address, never the address itself, and are deleted within two days.

We do not store passwords (there are none), your network address, details about your browser, or what you do in the app. When several people have the same model open, they see each other's selections and pointers; this is passed along directly and never stored.

Why, and on what legal ground

Your email address, your sign-ins, the models you save online, your sharing settings, and the AI assistants you connect are stored because they are needed to provide the service you asked for when you signed in (GDPR Article 6.1 b). The abuse-prevention counters are kept on the basis of our legitimate interest in protecting the service and the people whose addresses could otherwise receive unwanted email (Article 6.1 f). Your data is not used for anything else, and it is never sold or given to anyone.

The cookie

When you sign in, one cookie is set: __Host-toro4n_session. It keeps you signed in, cannot be read by scripts, and is sent only to toro4n.com. It is required for signing in to work, and no other cookies are used.

Where it is stored

toro4n runs on Cloudflare, which stores the data on our behalf under its data processing agreement. Storage is restricted to data centers within the EU. Sign-in codes and sharing notifications are sent from graph@hlhc.se through the mail server of our web host, Inleed, in Sweden. Everything is sent over encrypted connections, and Cloudflare stores it encrypted.

How long it is kept

• A sign-in code can be used for 10 minutes and is then deleted.
• A sign-in stops working 30 days after it was last extended and is then deleted.
• A model saved online is stored until you delete it.
• A folder is stored until you delete it or delete your account.
• Earlier versions: every version from the last day, one per day for the past month, and one per week before that, up to 100 per model. Older versions are deleted, and all versions are deleted along with the model.
• An AI assistant's access is stored until you disconnect it or until it has gone unused for 30 days.
• Your account is stored until you delete it.
• After something is deleted, Cloudflare keeps backup data for up to 30 days. After that, it cannot be restored.

Your choices and rights

• Delete. You can delete an online model in “My models” and delete your entire account from the account button in the app. Deleting your account removes your email address, your sign-ins, every model you have saved online, your access to models others have shared with you, and every AI assistant's access.
• Take your data with you. You can save any model as a file or copy it to your browser at any time.
• Ask. You have the right to know what is stored about you, to have it corrected or deleted, to have its use restricted, and to object to its use. To exercise these rights, write to the address above.
• Complain. If you believe your data is being handled improperly, you can file a complaint with the Swedish Authority for Privacy Protection (Integritetsskyddsmyndigheten, IMY).

More detail

A technical description written for IT and security staff is available in the app: click the help button (?) and then Security.