Privacy Policy
Version 1.0 · Effective November 4, 2026
| Version | 1.0 |
| Effective Date / Last Updated | November 4, 2026 |
| Applies to | Website visitors, business subscribers and their staff users, resellers, and customer-app consumers in the United States |
Torismic Privacy Policy
1. Who We Are and What This Covers
This Policy explains how Torismic LLC ("Torismic," "we," "us"), a Nevada limited liability company, collects, uses, discloses, and retains personal information through our websites, including torismic.com and its subdomains (such as app.torismic.com), merchant dashboard, POS software and hardware, Partner dashboard, and Torismic customer app (the "Services"). The Services are offered only in the United States. Section 3 is our Notice at Collection; Section 10 is our Notice of Financial Incentive; Section 11 describes California rights; Section 12 describes rights in other U.S. states, including Nevada.
2. Our Roles — Who Is Responsible for What
| Information | Who decides how it is used | Torismic's role |
|---|---|---|
| Torismic's own account holders (merchant owners/admins, resellers), website visitors, applicants | Torismic | Business / controller |
| A consumer's universal Torismic profile in the customer app, and Torismic Points / Torismic Rewards | Torismic | Business / controller |
| Business CRM Records — customer records a business creates in its own CRM (including for customers who never opt into a Torismic profile) | That business | Service provider / processor only; private to that business; never added to the universal profile system or shared with any other business |
| A business's copy of a consumer's profile (received when that business scans the QR code the consumer shows from their Torismic profile) and the business's own records (sales, invoices, service history, its loyalty program, employees) | That business | Service provider / processor for that business |
How profiles are created. A universal profile is created only when a consumer accepts a Torismic profile invitation and opts in (or signs up in the App). Businesses cannot send a Torismic profile invitation from their own phone, email, or messaging channels. Invitations are sent only through the invitation button on the Torismic platform, which sends the consumer an invitation email from Torismic. Invitations are sent only by email, never by text message. Before that, a business may hold only its own Business CRM Record about the person.
Universal profile vs. a business's copy. Each consumer has one universal profile that Torismic maintains for the consumer. A business cannot see a consumer at all until that business scans the Torismic QR code the consumer shows from their profile. On scan, at the consumer's direction, the business receives a copy of the profile fields shown to the consumer at that moment (Section 8.2). From then on, that copy and the business's own records are the business's responsibility — the business is the "business"/ "controller" for them, and Torismic processes them only on the business's behalf. Businesses never see each other's records. If you are a business's customer and have questions about how that business uses its copy, please contact the business directly; we may forward requests we receive (Section 11.6).
3. Notice at Collection — Categories of Personal Information
We collect the categories below from the sources listed, for the purposes in Section 4. We do not sell personal information for money. We may "share" limited identifiers and internet activity for cross-context behavioral advertising on our marketing website only, and only if you opt in (Section 6), and you can opt out (Section 7). Retention periods are in Section 9.
| Category (CCPA) | Examples | Sources | Disclosed for a business purpose to | "Sold" or "shared"? |
|---|---|---|---|---|
| Identifiers | name, email, phone, account ID, device ID, IP address | you; your device; businesses (for their customers, including Business CRM Records and invitation contact details) | service providers; connected businesses (consumer-directed); processors (merchant applications) | Shared (website ad identifiers only) |
| Customer records (Cal. Civ. Code § 1798.80) | address, business contact info, billing metadata (card brand, last 4) | you; our billing provider | service providers | No |
| Commercial information | subscriptions, hardware purchases; for consumers: visits, purchases at connected businesses, Points and coupon history | you; businesses; our systems | service providers; connected business (its own records only) | No |
| Internet/network activity | pages viewed, app interactions, logs, cookie data | your device; cookies/SDKs | service providers; ad partners (website only, after opt-in) | Shared (website only, after opt-in) |
| Geolocation | approximate location from IP | your device | service providers | No |
| Audio/visual | profile photos, pet/vehicle photos you upload | you | service providers; connected businesses you choose | No |
| Professional / employment | staff names, roles, PINs, schedules, time records (processed for businesses) | businesses | service providers | No |
| Inferences | tier status, preferences | our systems | service providers | No |
| Sensitive personal information | account login credentials; for merchant processing applications: owner SSN, driver's license, financial account details (collected and passed directly to the processor — not stored) | you | service providers; the payment processor you apply to | No |
Payment card data. Torismic does not store cardholder data. Card data for Torismic's own billing is entered on the billing provider's hosted checkout. Cards your customers use at a business are processed by that business's payment processor; card data entered at the point of sale, including manually keyed cards, goes directly to the processor's tokenization service or payment gateway the moment it is entered, so no card numbers are stored in our systems. The only exception is the last four digits of the card, which appear on printed receipts (we also keep amount, status, authorization code, and card brand). Torismic relies on the processor's PCI DSS compliance and sits outside PCI DSS scope because it does not store cardholder data; card data goes directly to the processor's tokenization service or payment gateway.
We use sensitive personal information only for permitted purposes (providing the Services you request, security, fraud prevention, and legal compliance), not to infer characteristics about you, so we do not offer a separate "Limit the Use of My Sensitive Personal Information" link.
We do not collect precise geolocation today. If we later launch location-based features (such as a planned Discover page), we will use precise location only if you turn on location services for the App, and we will update this Policy first.
4. How We Use Personal Information
- Provide, operate, maintain, secure, and improve the Services (including support and hardware device management).
- Bill subscriptions and hardware (through our third-party billing provider), and pay reseller commissions (through our third-party payout provider).
- Prepare and submit merchant processing applications to the processor you choose.
- Operate the customer app: your universal profile, QR-scan connections, favorites, notifications, estimates/approvals, and each business's loyalty points tracked on your profile.
- Operate Torismic Points and Torismic Rewards, including fraud prevention (Section 10).
- Send you Torismic's own service and account emails (e.g., billing, renewal, decline and suspension notices, security and account notices), and send the profile invitation email a business requests through the platform's invitation button (Section 5). Torismic does not send texts and does not email or text on a business's behalf for anything else. Torismic does not send its own promotional emails at launch; if that changes later, any promotional emails would go only to a separate opt-in list with an unsubscribe link (CAN-SPAM), separate from service and account notices.
- Detect and prevent fraud, abuse, and security incidents; comply with law; enforce our terms.
- Analytics and, on our marketing website and only if you opt in, advertising and measurement (Section 6).
- Create de-identified or aggregated data, which we maintain in de-identified form and do not attempt to re-identify.
5. How We Disclose Personal Information
- Service providers under written contracts that restrict their use of the data, in these categories: cloud database/authentication/storage, hosting, billing and payouts, device management, email/notification delivery, customer support, and analytics.
- Payment processors you choose, to submit your merchant processing application and to authorize transactions.
- Connected businesses, at the consumer's direction. When a business scans the QR code a consumer shows from their Torismic profile, we disclose a copy of the profile fields shown to the consumer to that business. This is a disclosure the consumer intentionally directs, which the CCPA does not treat as a "sale" or "sharing".
- Never across businesses for Business CRM Records. A business's own CRM records are never added to universal profiles and are never disclosed to any other business.
- Invitations. Businesses cannot send profile invitations, or texts or emails about the universal profile, from their own phone, email, or messaging channels. Invitations are sent only through the invitation button on the Torismic platform: we use the contact email address the business enters to send that person an invitation email from Torismic (invitations are sent only by email, never by text message). The business is responsible for having a relationship with, and any required permission to contact, each person it invites. Other than invitation emails, Torismic does not send texts or emails on a business's behalf.
- Between locations under the same user. Each location is its own account. Records are not shared between location accounts unless the user who holds them directs it, and are never shared between different users or separately owned businesses.
- Advertising partners (marketing website only, and only after you opt in), see Section 6.
- Legal and safety: to comply with law or legal process, protect rights and safety, and prevent fraud.
- Business transfers: in connection with a merger, acquisition, financing, or sale of assets, subject to this Policy.
6. Cookies, Analytics, and Advertising
Our marketing website uses cookies, pixels, and similar technologies for essential functions and,
only if you opt in, for analytics and advertising/measurement,
as described in the Cookie Policy (/cookies). Advertising
technologies may be considered "sharing" for cross-context behavioral advertising under California
law. We do not place advertising pixels in the merchant dashboard, POS, Partner dashboard, or
customer app. We honor Global Privacy
Control (GPC) signals as a valid opt-out of sale/sharing for the browser or device sending them.
7. Your Choices
- Do Not Sell or Share: use the "Do Not Sell or Share My Personal Information" link in our website footer (torismic.com/privacy-choices), our cookie settings, or enable GPC.
- Cookies: cookie settings link in the footer (to opt in to, or out of, analytics and advertising technologies, which are off unless you opt in); browser controls.
- Marketing email: Torismic does not send its own promotional emails at launch; if that changes, any promotional emails would go only to a separate opt-in list with an unsubscribe link in each message. Service and account emails are separate.
- Customer app: manage QR-scan connections, the "Allow access on visit" toggle, your favorite businesses for marketing push notifications, and notification settings in App → Settings.
- Device settings: push notifications and location permissions.
8. The Customer App and Your Universal Profile
8.1 Isolation by default. A business cannot search for or view your profile until it scans your membership QR code. Each business's customer view is isolated from every other business.
8.2 What a business receives when it scans your membership QR code. Your name, phone and/or email, profile photo (if any), and the pet/vehicle profiles you choose to share. Your activity at other businesses is never shared.
8.3 Visit-access toggle. You can turn off a business's access on future visits; it then stops receiving profile updates.
8.3A Messages from businesses are the business's responsibility — not Torismic's. Information collected through your interaction with a business (for example, a QR scan, booking, purchase, or invoice approval), including your phone number and email address, is stored with that business's records. The business uses that contact information under its own privacy policy: when a business uses information from its own CRM (information you gave that business directly) with its own customers, including for marketing through its own channels, that use is the business's sole responsibility, subject to applicable law, and the business must follow all applicable laws and regulations. Any marketing text, email, or other message it sends you is the business's own communication, sent from the business's own phone, email, or messaging service outside Torismic. Businesses may not use their own channels to send Torismic profile invitations or other messages about your universal profile; those go only through the Torismic platform (Section 5). Other than a profile invitation email a business requests through the platform's invitation button, Torismic never sends emails or texts on a business's behalf; inside the App, businesses can reach you only by push notification. Torismic is not responsible for those messages, for what a business sends its own customers through its own channels, or for how the business uses your contact information for its own purposes. To stop them, reply STOP, use the unsubscribe link, or contact the business directly. This information is never shared with other businesses.
8.4 If you are disconnected, disconnect, or delete. When the business disconnects you, or you disconnect from the business (or delete your profile), the business's copy of your records (the profile information it received from you through membership QR scans) is removed and it stops receiving updates; this covers only that membership QR scan copy, not information the business collected or kept itself. If you delete your Torismic account, we delete your universal profile (Section 9). If you share your universal Torismic customer profile with a business in our network, it is your sole responsibility to contact that business directly and request deletions per location, as each location handles its services per location. Information a business collected or kept itself is governed by that business's own privacy policy (Section 8.4A). Our universal profiles exist to facilitate, among other things, your transaction histories, your loyalties, and your ability to create new accounts at different locations that are under our network.
8.4A If a business leaves Torismic. When a business's Torismic subscription ends without renewal, the business loses access to its Torismic records, and we do not provide, export, or hand over to it the profile information it received from your universal profile through QR scans. That information (the business's copy of your records) is kept with the business's other stored records for 90 days after its subscription ends without renewal; if the business renews within those 90 days, its access is restored, and after day 90 deletion begins (Section 9). The business can see it only while its subscription is active. Your own universal profile is not affected. When the business disconnects you, or you disconnect from the business (or delete your profile), the business's copy of your records is removed (Sections 8.4 and 11); you can disconnect or delete your profile at any time. Information a business collected or retained itself (for example, outside Torismic, or exported or recorded earlier with your consent) is governed by that business's own privacy policy and legal obligations, not this Policy, and Torismic is not responsible for it.
8.5 Loyalty points. Each business runs its own loyalty program; your points for it are tracked on your universal profile and visible only to you and to that business while its Torismic subscription is active. Torismic Points are Torismic's own program and never belong to a business (Section 10).
8.6 Notifications and messages. From Torismic: only service and account emails, a profile invitation email if a business invites you through the platform's invitation button (Section 5), and, if you allow them, in-App notifications about Torismic Rewards. From businesses inside the App: push notifications only — operational notices from businesses you have transacted with (e.g., ready for pickup, estimates to approve) and marketing push only from your favorite businesses. Texts or emails from a business come from the business itself, outside Torismic, and may not be used for Torismic profile invitations (Section 8.3A).
9. Data Retention
We keep personal information only as long as reasonably necessary for the purposes in Section 4, then delete or de-identify it:
| Data | Retention |
|---|---|
| Merchant records — Business CRM Records, sales, transactions, invoices, reports | Life of the account + 90 days after the subscription ends without renewal (the business has no access or export during that period, but its access is restored if it renews within the 90 days; Section 13); after 90 days, deletion begins, except backups (rolled off within 35 days) and records we must keep |
| Profile Copy Data held for a business (fields received via QR scan) | Life of the business's subscription + 90 days after the subscription ends without renewal, together with the business's other stored records (access restored if the business renews within the 90 days; deletion begins after day 90); never exported; visible to the business only while its subscription is active; removed when the business disconnects the customer, or the customer disconnects from the business (or deletes their profile); the consumer's own universal profile is not affected |
| Billing, tax, and transaction records (Torismic's own) | 7 years (tax/accounting) |
| Merchant processing application data we store (business info, EIN, owner contact) | Life of the merchant account + 3 years |
| Universal consumer profile | Until you delete your account, or after 24 months of account inactivity (no qualifying earn or redemption), with at least 30 days' notice by email or in-app |
| Torismic Points / coupon history | Life of the account + 3 years (fraud/dispute); Torismic Points themselves expire after 24 months of account inactivity (no qualifying earn or redemption), with at least 30 days' notice by email or in-app (Program Terms Section 6.1A) |
| Reseller records and commission statements | Term + 7 years |
| Website analytics/cookie data (collected only after opt-in) | Per Cookie Policy (generally ≤ 13 months) |
| Security logs | 12 months |
| Consumer privacy request logs (access, deletion, correction, opt-out requests and responses) | 24 months (California 11 CCR 7101) |
10. Notice of Financial Incentive (Torismic Rewards)
What it is. Torismic Points and Torismic Coupons (together, Torismic Rewards) are promotional benefits we offer to consumers who join the Program. Because they relate to the collection of personal information, California treats the Program as a "financial incentive."
Material terms. See the Torismic Rewards Program Terms (torismic.com/rewards-terms): how you earn points (visits, purchases, bonuses), redeem them for Torismic Coupons (by choosing a catalog reward), and the limits, expiration, and forfeiture rules. Rewards have no cash value and cannot be loaded, withdrawn, or cashed out.
Personal information involved. Identifiers (name, email/phone, account ID), commercial information (qualifying visits and purchase amounts at participating Businesses, points earned and redeemed, coupons issued and applied), and inferences (tier).
How to opt in. By accepting the Program Terms in the App. How to withdraw: turn off Torismic Rewards in App → Settings, or delete your account, at any time (unredeemed Rewards are forfeited as stated in the Program Terms).
Value of your data and method of calculation. We estimate the value of a participating consumer's personal information as approximately equal to the value of the promotional discounts that participating Businesses provide through the Torismic Coupons you redeem, calculated from the discounts applied through those coupons, because the Program's purpose is to encourage visits and engagement. We reasonably believe this is the value the data provides to us.
We do not discriminate against you for exercising privacy rights; the Program's benefits differ only as reasonably related to the value of the data described above.
11. California Privacy Rights (CCPA/CPRA)
11.1 Your rights. If you are a California resident, you may request to: know/access the categories and specific pieces of personal information we collected, the sources, purposes, and the categories of third parties to which we disclosed it; delete it; correct inaccurate information; opt out of sale/sharing (Section 7); and limit use of sensitive personal information (we do not use it for purposes that trigger this right — Section 3). We will not discriminate against you for exercising these rights.
11.2 How to submit. Email support@torismic.com, use our contact page (torismic.com/contact) and select "Privacy request" from the inquiry dropdown, or use App → Settings → Privacy.
11.3 Verification. We verify requests by matching information we hold (e.g., confirming control of your account email/phone). We may request more information for requests for specific pieces of data.
11.4 Authorized agents. An agent may submit a request with your signed permission; we may verify your identity directly.
11.5 Timing. We confirm receipt within 10 business days and respond within 45 calendar days (extendable by 45 days with notice). We keep records of privacy requests and our responses for 24 months (see Section 9).
11.6 Requests about a business's copy. Where Torismic is a business's service provider (Section 2), we may forward your request to the business or tell you to contact it, and assist it as required.
11.7 Minors. We do not sell or share personal information of consumers we know are under 16.
11.8 Shine the Light. We do not disclose personal information to third parties for their own direct marketing purposes (Cal. Civ. Code § 1798.83).
11.9 Applicability. We provide the rights in this Section 11 whether or not Torismic meets the CCPA's applicability thresholds.
12. Other U.S. State Rights (Including Nevada)
Depending on your state of residence (e.g., Colorado, Connecticut, Delaware, Indiana, Iowa, Kentucky, Maryland, Minnesota, Montana, Nebraska, New Hampshire, New Jersey, Oregon, Rhode Island, Tennessee, Texas, Utah, and Virginia), you may have rights to access, correct, delete, and obtain a portable copy of your personal data, and to opt out of targeted advertising, sale, and certain profiling. Submit requests as in Section 11.2. Appeals: if we decline your request, you may appeal by replying to our decision or emailing support@torismic.com with "Appeal" in the subject; we will respond within the time required by law, and if we deny the appeal you may contact your state Attorney General.
Nevada. We do not sell covered information as defined in NRS 603A.320. Nevada residents may submit a request to opt out of any future sale to support@torismic.com.
13. Business Data Export
Businesses may export their own records (including Business CRM Records) manually at any time while their subscription is active. Torismic does not provide a built-in export feature or export files on request; a business gathers and documents its own records itself from its dashboard. There is no export window after cancellation: a business loses access to its records when its subscription ends without renewal, and regains it only by renewing within the 90-day retention period in Section 9 (this includes the business's copy of profile information received from consumers via QR scans, which is never exported — Section 8.4A).
14. Security and Breach Notification
We use reasonable administrative, technical, and physical safeguards appropriate to the information (e.g., encryption in transit, access controls, encrypted secrets, device management). No system is perfectly secure. If a breach of security involving your personal information occurs, we will notify you and regulators as required by law (e.g., NRS 603A.220; Cal. Civ. Code § 1798.82), and we will notify affected businesses as described in our Business Terms (Section 8.5).
15. Children
The Services are not directed to children under 13, and we do not knowingly collect their personal information. The customer app requires users to be at least 18 years old. If we learn we collected a child's information, we will delete it. Contact us if you believe a child has provided information.
16. United States Only
The Services are intended for use in the United States, and we process information in the United States.
17. Changes to This Policy
We may update this Policy. We will post the updated version with a new "Last Updated" date and, for material changes, notify you by email or in-app notice before the changes take effect where required. We will not use previously collected personal information in a materially different way without any consent the law requires.
18. Contact
Torismic LLC — 4343 North Rancho Drive, Suite 104, Las Vegas, Nevada 89130 — support@torismic.com — Phone: [phone number].
See the full list of public legal documents on the Legal page.