How we collect, use, and protect your personal information
Version 1.1.0 · Last updated: February 2026 · Governing Law: England and Wales
Before the legal language, here is what matters in plain English:
Innovatorly Ltd (trading as TorlyAI) is the data controller for personal data processed through the torly.ai website ("Website") and the TorlyAI Desktop application ("Desktop App"), collectively referred to as the "Service".
We are registered with the Information Commissioner's Office (ICO) as a data controller. For all privacy-related enquiries, contact legal@innovatorly.ai.
This Privacy Policy applies to:
This policy does not apply to third-party websites or services that we link to. We encourage you to read their privacy policies separately.
| Purpose | Legal Basis |
|---|---|
| Providing the Service | Performance of contract |
| AI content generation | Performance of contract |
| Subscription management and billing | Performance of contract |
| Licence validation | Performance of contract |
| Account security | Legitimate interest |
| Product improvement (anonymised metrics) | Legitimate interest |
| Website analytics | Consent (cookie banner) |
| Marketing communications | Consent |
| Legal compliance | Legal obligation |
You have the right to object to any processing based on legitimate interest. Contact legal@innovatorly.ai to exercise this right.
Your business plans, financial models, session transcripts, discovery sessions, and all Project content are stored locally on your device in encrypted form (AES-256-GCM).
We do not have access to your locally stored data. If you lose your device, we cannot recover your local data.
The only data we store on our servers is:
All server-side data is hosted in the United Kingdom (AWS eu-west-2, London).
When you use the free AI-powered assessment on the Website, your input is transmitted from your browser to our servers, forwarded to the AI provider (currently Anthropic Claude Haiku), processed, and returned. Neither we nor the AI provider retain your content after the request completes.
When you use AI-powered features on the Desktop App (business plan generation, financial modelling, interview preparation, agent conversations, autopilot):
When using BYOK, your data is sent directly from your device to your chosen provider. We do not intermediate, log, or store any AI request or response content. You are responsible for reviewing your chosen provider's privacy policy.
When using BYOK on a paid plan, your device sends AI requests directly to your chosen provider. TorlyAI does not intermediate, log, or have access to these requests.
The Desktop App generates an anonymous device identifier when you first sign in. This identifier is created using non-reversible hashing on your device. It does not contain your device serial number, MAC address, or any personally identifiable hardware details.
We use it for:
You can view devices associated with your account on torly.ai, deactivate a device at any time, or request deletion of all device data by contacting us.
The Website uses cookies. When you first visit, you will see a cookie banner allowing you to accept or decline non-essential cookies.
We do not use third-party advertising cookies or retargeting pixels. The Desktop App does not use browser cookies. Desktop analytics (if enabled) are aggregated, anonymised, and controllable via Settings > Privacy.
| Data | Retention |
|---|---|
| Account data | Account lifetime + 30 days |
| Business plans & Project content | Until you delete (stored locally) |
| Session transcripts | Until you delete (stored locally) |
| Billing records | 6 years (UK tax law) |
| Consent records | 6 years from withdrawal |
| Aggregated analytics | 24 months |
| Error logs | 30 days |
Under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018, you have the right to:
AES-256-GCM for all locally stored data including credentials and business plans
TLS 1.2+ for all network communications between your device and servers
PBKDF2 key derivation, API keys stored in your OS keychain
Full compliance with UK GDPR and Data Protection Act 2018, registered with the ICO
In the event of a personal data breach, we will notify the ICO within 72 hours where required and notify affected individuals without undue delay where the breach poses a high risk to their rights and freedoms.
The Service is not intended for individuals under the age of 18. We do not knowingly collect personal data from children. If you believe a child has provided data to us, please contact legal@innovatorly.ai immediately and we will delete it.
If you are unhappy with how we handle your personal data, we encourage you to contact us first at legal@innovatorly.ai so we can try to resolve the issue.
If you are not satisfied with our response, you have the right to complain to the Information Commissioner's Office (ICO) at ico.org.uk or call 0303 123 1113.
We may update this Privacy Policy to reflect changes in our practices, new features, or legal requirements. For material changes, we will notify you by email at least 14 days before they take effect. Your continued use after changes constitutes acceptance.
Email: legal@innovatorly.ai
Company: Innovatorly Ltd (trading as TorlyAI)
Registered in: England and Wales
The full, legally binding version of this Privacy Policy is available at docs/legal/PRIVACY_POLICY.md.