Torch CRM — Privacy Policy

Last updated: November 11, 2026 · Version 1.11

This Privacy Policy explains how JMcMahan LLC, a Texas limited liability company doing business as Torch CRM ("Torch CRM," "we," "us"), collects, uses, and shares personal information. It applies to our websites and to the personal information we process for our own purposes as a controller — such as account, billing, and support information.

A note on Customer Data. Businesses using the Torch CRM platform submit data about their own contacts and users into their workspaces ("Customer Data"). We process Customer Data as a processor (service provider) on our customers' behalf, under our customer agreements, including any Data Processing Addendum we have signed with them. If your information appears in a Torch CRM workspace operated by one of our customers, that customer controls it — please direct requests about it to them, and we will assist them as required.

1. Information we collect

Account and contact information. Name, business email address, phone number, company name, and role, when you create an account, sign up for a plan, or contact us.

Billing information. Subscription and payment records. Payments are processed by Stripe; we do not store your full payment card details.

Usage and log information. IP address, browser and device information, pages viewed, and timestamps, collected automatically to operate, secure, and improve the Service.

Communications. Messages you send to support and the information you choose to include.

Cookies. Inside the Service we use only essential cookies, such as authentication and security cookies. On our public web pages (such as our home, pricing, and sign-up pages, but not the Service itself), we use Google Ads and LinkedIn cookies (the LinkedIn Insight Tag) to measure whether a visitor who clicked one of our ads later signs up or registers interest. If you arrive through a link shared by one of our partners (our affiliate program, run with PromoteKit), a PromoteKit cookie remembers which partner referred you for up to 60 days, and if you then subscribe we pass that partner's referral ID to our payment processor, Stripe, so PromoteKit can calculate the partner's commission from your subscription payments. We turn off Google's ad personalization, and we do not use these cookies to show you ads on other websites or to build an advertising profile of you. We load these cookies only if you choose "Accept" on the cookie notice on our public pages; if you choose "Decline" or make no choice, they are not loaded. You can change your choice at any time with the "Cookie choices" link at the bottom of our public pages, and we remember your choice in an essential cookie for up to six months. If your browser sends a Global Privacy Control signal, we do not load the Google Ads, LinkedIn or PromoteKit cookies at all, and we do not show the notice. Our websites do not respond to browser "Do Not Track" signals. We do not sell personal information. LinkedIn may also use information its cookie collects for its own purposes under its own privacy policy; to the extent that counts as "sharing" for cross-context behavioral advertising under California law, it happens only after you choose "Accept," and choosing "Decline," using "Cookie choices," or sending a Global Privacy Control signal opts you out.

2. How we use information

We use personal information to provide and operate the Service; create and administer accounts; process payments; provide support; secure the Service and prevent fraud and abuse; communicate about the Service, including security, billing, and product updates; comply with legal obligations; and improve the Service. We do not sell personal information, and we do not share it for cross-context behavioral advertising except, with your consent, as described under "Cookies" in Section 1.

3. Legal bases (EEA, UK, and Switzerland)

Where the GDPR or similar laws apply, we process personal information: to perform our contract with you; for our legitimate interests, such as securing and improving the Service, in a way that does not override your rights; with your consent, where required, which you may withdraw at any time; and to comply with legal obligations.

4. How we share information

We share personal information with service providers (subprocessors) that help us operate the Service — including Vercel (hosting), Supabase (database, authentication, and file storage), Stripe (payments), Google Workspace (business email and productivity), Sentry (error monitoring), Better Stack (uptime monitoring and status page), Twilio (delivering text-message sign-in codes), PromoteKit (running our partner program, including the partner-referral cookie and commission calculations from Stripe payment records), Postmark (sending account emails such as invitations, password resets, and sign-in codes), Hetzner (servers we use to scan uploaded files for viruses), Cloudflare (storing encrypted backup copies of uploaded files), the U.S. Census Bureau and Zippopotam.us (looking up company addresses and ZIP codes), Trainual (training), Constant Contact (email marketing lists) and Gusto (payroll) for workspaces that connect them, and OpenAI and Anthropic (AI processing for features you choose to use, such as business-card scanning) — each bound by contractual data protection obligations. We may also share information with professional advisors; in connection with a merger, acquisition, or sale of assets, with notice; and where required by law. Government and law-enforcement requests are honored only when supported by valid legal process, construed narrowly, and, unless legally prohibited, we notify affected customers before disclosure.

Voice dictation. If you choose to dictate into the Service with your microphone, your web browser's own speech-recognition service (for example, Google in Chrome, Microsoft in Edge, or Apple in Safari, some of which can process speech on your device) converts your speech to text under that provider's terms. We do not receive, record, or store the audio; we receive only the resulting text, as if you had typed it.

Product tour video. Our home page has a product tour video hosted by YouTube (Google). Nothing is loaded from YouTube until you press play. When you do, your browser loads the video from YouTube's privacy-enhanced player, which receives your IP address and browser information and may store information in your browser, under Google's own privacy policy.

5. International data transfers

We are based in the United States. Personal information we process is transferred to, stored, and processed in the United States and in other countries where our service providers operate. In certain situations, we may be required to disclose personal data in response to lawful requests by public authorities, including to meet national security or law enforcement requirements.

6. Data retention

We retain personal information for as long as your account is active and as needed for the purposes described above, to comply with legal obligations, resolve disputes, and enforce agreements. In particular: account and contact information is kept while your account is active, and when an administrator removes a user or a workspace is closed the account is deactivated rather than erased, because the security and audit logs described below must keep referring to it; billing and payment records are kept for as long as tax and accounting laws require; security and audit logs, which record sign-ins and changes made in the Service, are kept for at least 12 months and for as long as needed to investigate security incidents, resolve disputes, and meet legal obligations, including after the records they describe are deleted; and support communications are kept while your account is active and as long as needed to resolve the matter. Customer Data is retained and deleted according to the applicable customer agreement, including any Data Processing Addendum we have signed with that customer.

7. Security

We protect personal information with safeguards including encryption in transit (TLS) and at rest, per-tenant database isolation, multi-factor authentication on administrative systems, and automated daily backups of our production database. No method of transmission or storage is completely secure, but we work to protect your information consistent with industry practices.

8. Your rights and choices

Depending on your location, you may have the right to access, correct, delete, or receive a copy of your personal information; to object to or restrict certain processing; to withdraw consent; and to not be discriminated against for exercising your rights. Residents of certain U.S. states have similar rights, including the right to opt out of targeted advertising or the sale of personal data, and the right to appeal a refusal. We do not sell personal data, and our advertising cookies load only with your consent (see "Cookies" in Section 1), which you can withdraw at any time.

To exercise any right, email privacy@jmcmahanllc.com. We will verify your identity, respond within the time required by applicable law (generally within one month under the GDPR, or 45 days under U.S. state privacy laws), and act on authorized-agent requests as the law provides. If you are in the EEA, UK, or Switzerland, you may also lodge a complaint with your local supervisory authority.

9. Text messages (SMS)

If you choose to sign in with a one-time code, or to use a text message as a second authentication factor, we use your mobile number solely to send that code and to secure your account.

Mobile information and text-messaging consent are not shared with third parties or affiliates for marketing or promotional purposes. We do not sell mobile numbers. We disclose your number to our messaging provider only to the extent needed to deliver the message.

Messages are transactional: you receive a code only when you request one, so message frequency varies with how often you sign in. Message and data rates may apply. Reply HELP for help or STOP to opt out; opting out disables text-message sign-in for that number, and you can continue to sign in by other means.

10. Children

The Service is intended for business use and is not directed to anyone under 18. We do not knowingly collect personal information from children.

11. Changes to this policy

We may update this Privacy Policy from time to time. We will post the revised version with an updated "Last updated" date, and we will provide notice of material changes through the Service or by email before they take effect.

12. Contact us

JMcMahan LLC · 6329 Fulton Drive, College Station, TX 77845 · privacy@jmcmahanllc.com · support@jmcmahanllc.com