Privacy Policy – Smart Living

Last updated: 6 November 2026

This policy explains what personal data we process through the "Smart Living" app and service (iOS, Android and web, available at https://smart.torcip.com), for what purposes, on what legal basis, and what your rights are. It is written in accordance with Regulation (EU) 2016/679 (GDPR) and Romanian Law no. 190/2018.

1. Who we are (the data controller)

The data controller is:

• TORCIP S.R.L.
• Registered office: Str. Weiner Palada 12, Sat Roșu, Comuna Chiajna, Județul Ilfov, Romania
• Company registration no.: CUI 49862521 · Reg. Com. J2024002471231
• Contact e-mail: contact@torcip.com

We have not appointed a Data Protection Officer (DPO), as our processing does not fall within the cases that make a DPO mandatory under GDPR art. 37. For any matter concerning personal data, the controller can be contacted at contact@torcip.com.

2. What Smart Living is

Smart Living is a smart-home control service for residential apartments. The structure is hierarchical: developer → building → apartment. Users may be residents and family members, property managers, installers, and system administrators, each with different roles and permissions.

Devices are controlled through a hub located in the apartment. Safety automations (closing the water valve when a leak is detected, smoke/CO detection, panic button) run locally on the hub and work even without an internet connection. One exception: on an installation that has only the Zigbee gateway, with no local computer to run the rules, and where protection through the server was explicitly turned on, closing the valve on a leak is decided by our server and does not work without internet. The app shows this mode.

3. What data we process

We process only the data needed to run the service:

• Account data: e-mail address, name, password (stored only as a hash, never in clear text).
• Sign in with Google or Apple (optional): if you choose "Continue with Google" or "Continue with Apple", we receive from that provider only your name, your e-mail address (with Apple this can be a private relay address from "Hide My Email", which works normally) and the provider's account identifier — and we use them only to create your account and sign you in. We do not receive or store your Google/Apple password, profile picture or contacts. The one exception, for Apple: we keep the refresh token Apple issues, encrypted, solely so we can revoke the link with Apple when you delete your account (an Apple requirement); it is used for nothing else and is deleted with the account. We do not use these providers for advertising or tracking. Accounts created this way do not have a password; you can set one at any time with "Forgot password". In the web app, the Google button is loaded directly from Google (accounts.google.com) when the sign-in page opens, so Google can see the browser's IP address even if you do not choose that button; on Android and iOS nothing is loaded from Google before you press the button.
• Sessions: device label/name and timestamps. We do not store IP addresses for sessions. IP addresses are used only transiently, in memory, for rate limiting (anti-abuse protection) and are not saved.
• Account security log: to protect your account against password guessing, we record sign-in events: wrong password, temporary account lock (after 10 wrong passwords in 15 minutes the account is locked for 15 minutes), unlock, wrong 2FA code, password reset requested and completed, password changed, sessions closed and attempts on a suspended account — with the date and time, the platform (Android/iOS/web) and the app version. We do not record the IP address, the password or tokens. Events tied to your account are deleted together with the account. An attempt on an e-mail address that has no account does not keep the address: we keep only a keyed cryptographic hash (a code from which the address cannot be read), which is deleted automatically after 90 days.
• Membership and roles: the apartment(s) you have access to and your assigned role.
• Home invitations: the e-mail address of the person you invite, the proposed role and their answer.
• Device states and commands: the state of devices and the commands sent.
• Audit log of safety-relevant actions.
• Energy consumption: energy readings (kWh, cost).
• Alerts generated by the system.
• Push notification tokens (Expo / Apple APNs / Google FCM).
• Installer evidence: photos/PDFs for safety sign-off of the installation.
• Administrator 2FA (TOTP) secrets, stored encrypted.
• Crash logs and diagnostics: when the app crashes or hits an error, it automatically sends a technical report only to our own server: the error type and message, where in the code it happened (stack trace), the current screen and the last technical actions in the app (screens opened, server calls, command status — no device or room names), the app version and build, the operating system, the phone model, the language and the device identifier (see below). This includes errors in the native part of the app (Android/iOS) and user interface freezes longer than 1 second; these are first saved to a local file in the app's private storage on the phone and sent at the next start, after which the file is deleted. We also collect aggregated performance measurements (start-up time, screen load time, server call duration), linked only to the device identifier. E-mail addresses, tokens, URL parameters (query strings) and push tokens are removed on the phone before sending and again on the server. If you are signed in, the report is linked to the account through a pseudonym (hash), and the internal list of problems also keeps which accounts were affected, so our team can help you — the report itself contains no e-mail, no name and no IP address. Errors of our own server are recorded in the same place, without personal data. You can stop sending at any time in Settings → "Send diagnostics"; reports not yet sent are deleted from the phone.
• Device identifier: at first launch the app generates a random code (UUID) of its own and keeps it on the phone (in the system's secure storage — Keychain/Keystore — so it survives updates; in a browser, in the site's local storage). It sends it only to our own server, together with crash reports, performance measurements and the session (at sign-in and at the periodic account check), so we can compute per-device statistics: errors and performance per device, how many installations are active and which app versions are running. On the server we keep only a keyed cryptographic fingerprint (hash) of the code, with the platform, app version, operating system, the first and last day it was seen and, if you are signed in, the account signed in on that device. It is not an advertising or hardware identifier (we do not use IDFA, AAID/GAID, IMEI, MAC address, serial number or Android ID), we do no device fingerprinting, we do not associate it with the IP address and we do not use it for tracking or advertising. On an iPhone, the code is not copied to another phone when a backup is restored. The code goes with the session even when diagnostics are off, because the count of active installations and versions is part of running the service. When you turn off "Send diagnostics" in Settings, the code is deleted from the phone and nothing is sent until the next start; then a new one is generated, unrelated to the old one, which goes only with the session (not with crash reports or performance measurements, as long as diagnostics stay off).
• The Smart Living Bridge program (optional): if you install on a PC in your home the program that adds Matter devices over Wi-Fi (bulbs, LED strips), it connects only to our own server, through a single encrypted connection started by the PC. It sends: the devices' manufacturer and model, their Matter type, their identifier on our Matter network (a node and endpoint number, not the serial number or a name you gave them), what they can do and their state (on, brightness, colour), whether they are online, and the program's version. On the server we keep this as for any other device, only a cryptographic hash of the program's access key, and the time of its last connection. We do not store the IP address of the PC or of the devices. The pairing code you enter in the app passes through our server on its way to the program, is used once and is not saved: not in the database, not in any log. On the PC, the program keeps locally the access key (readable only by your Windows account), the devices' technical Matter data and a local technical log, from which keys, codes and IP addresses are removed. It sends no data to third parties and contains no analytics. When you remove a device, it disappears from the app and its state and history are deleted, while a minimal record (its type and name, nothing about you) stays with the actions already recorded in the audit log. You can revoke the program's access at any time in Settings.
• Support requests: the text of your messages and the files you attach; we remove metadata from images (e.g. the GPS position) before saving them.
• Log attached to a support request ("Send log"): only if you tick this option on the support form (and only while "Send diagnostics" is on), we attach to the request the last technical actions in the app (the same as above, already cleaned on the phone), the current screen, the phone model, the operating system and the app version, so the support team can understand the problem. The log stays with the request and is deleted together with it or with the account.

We do not use analytics, crash-reporting (e.g. Sentry, Crashlytics) or advertising SDKs, we do not perform third-party tracking, we do not collect geolocation, and we do not collect IP addresses for analytics.

4. Purposes and legal bases

5. Who has access to data (processors and providers)

We do not sell your data. We disclose it only to the recipients below, within the limits described for each:

• Hosting: our own server at DigitalOcean, Frankfurt data centre (EU) — DigitalOcean as processor.
• DNS: the name smart.torcip.com is managed at Cloudflare, as a DNS service only. The traffic of the app, the website and the Smart Living Bridge program does not pass through Cloudflare: it reaches our server in Frankfurt directly, and the encrypted (TLS) connection ends on our server.
• Crash logs and diagnostics: not shared with any third party (we do not use Sentry, Crashlytics or similar services); processed only on our own server in Frankfurt (EU).
• E-mail delivery: the service's e-mails (for example address verification, password reset, invitations) are sent through Resend. Resend receives the recipient's address and the message content and may process them outside the EU as well, including in the United States, under its contractual terms.
• Sign-in providers (only if you use them): Google (Google Ireland Ltd.) and Apple (Apple Distribution International Ltd.) handle the sign-in step on their side under their own privacy policies; they confirm your identity to us and we do not send them any data about your home, devices or use of the app.
• Push notifications: Expo, Apple (APNs) and Google (FCM) (processors). These providers may process data outside the EU; transfers rely on the EU-US Data Privacy Framework and/or Standard Contractual Clauses (SCCs). We send only the minimum information needed to display the notification.
• Devices/hub (our Zigbee gateway): devices are connected through our Zigbee gateway in the apartment and our own Zigbee2MQTT service on our server in the EU (Frankfurt). We do not use any device vendor cloud; commands, states and sensor readings do not transit a third-party device vendor's servers. The one exception is the Tuya demonstration bridge, described just below.
• Demonstration bridge with a Tuya wall panel (optional): a demonstration feature, off by default and not meant for ordinary homes, which we turn on on the server (there is no option in the app), only if the home's owner wants it. Only there, the Tuya cloud (its Central Europe data centre) carries just the technical identifiers of the linked devices and values: on/off commands and the sensor values shown on the panel (temperature, humidity, leak), with no names, e-mail or address. The Smart Life account and the panel are subject to Tuya's terms and privacy policy.

• AI assistants (only if you connect one yourself): you can optionally connect an AI assistant, for example Claude (Anthropic) or ChatGPT (OpenAI), to your home. You start the connection from the assistant, sign in to your Smart Living account and explicitly approve on our page what the assistant can see and whether it may control devices (control is off by default). The assistant receives only what it asks for in the conversation: your home's display name (building · unit), the devices with their names, rooms and state, sensor history, energy use, alerts, scenes, automations and schedules. This data reaches the assistant's provider (Anthropic or OpenAI), which processes it as an independent controller under its own terms and privacy policy, possibly outside the EU. We never send the assistant people's names, e-mail addresses or phone numbers, the home's address, your password, tokens or the devices' technical identifiers. Commands sent through the assistant are recorded in the audit log as your actions, marked as coming through the assistant. You can revoke access at any time in Settings → AI assistants; access is also revoked automatically when you change your password or request account deletion.

We can provide the current list of processors on request.

6. International transfers

Data is hosted in the EU (Frankfurt). The auxiliary e-mail and push services may involve transfers outside the European Economic Area. For push, these transfers are carried out with appropriate safeguards: the EU-US Data Privacy Framework (where the provider is certified) and/or Standard Contractual Clauses approved by the European Commission. For e-mail, the transfer takes place under Resend's contractual terms. The Tuya demonstration bridge, only where it is turned on, uses Tuya's Central Europe data centre; we have no information about other places where Tuya might process this data, and Tuya's terms apply to those. You can obtain a copy of the safeguards by writing to the address in section 1.

7. How long we keep data

• Account data: for as long as the account is active.
• Account deletion: on request, with a 30-day grace period (cancellable); after it expires, permanent deletion.
• Safety audit log and administrative action log: kept with no deletion term; they are not deleted automatically, nor when an account or a home is deleted. When an account is deleted, the actor is pseudonymized: your account identifier is replaced with a pseudonym, including where the account is the target of an administrative action (e.g. a role or task assignment). The audit log identifies the signer of a sign-off only by account identifier, never by name.
• Installer safety attestations (evidence of the physical test): kept with no deletion term; a completed attestation cannot be deleted. When the installer's account is deleted, the reference to the signer's account is removed and the name entered at sign-off is replaced with a pseudonym; the attestation stays valid.
• Backups: 14-day rolling cycle.
• Energy consumption data: 24 months.
• Push tokens: until sign-out or account deletion.
• AI assistant connections: the consent and access tokens (kept only as a cryptographic hash) until you revoke access, change your password or delete your account; an access token expires after one hour, a refresh token after 30 days. We keep the date each connection was last used, without the IP address.
• Crash logs and diagnostics: 90 days, then deleted automatically. When the account is deleted, the reports linked to the account pseudonym are deleted.
• Device identifier (on the server): 90 days after it was last used, then deleted automatically; deleted immediately together with the account signed in on that device.
• Support requests and attachments: until you delete your account.
• Home invitations: the invited person's address, the proposed role and the answer stay in the home's history, with no deletion term; an unanswered invitation does not expire by itself. The address is replaced with a value from which it cannot be read when the invited person deletes their account and when the home is deleted in the app ("Delete home"). When the account of the person who sent the invitation is deleted, only the link to that account is removed; the invited person's address stays.
• Account security log: 90 days, then deleted automatically; events tied to an account are deleted immediately together with the account, and attempts on addresses with no account (kept only as a keyed hash, with no IP address) expire after 90 days.

8. Account deletion

You can delete your account:

• in the app: Settings → Delete account (Setări → Șterge contul);
• on the web: https://smart.torcip.com/delete-account.

Deletion starts the 30-day grace period described in section 7. Certain safety records and attestations may be kept anonymized as per section 7.

9. Your rights

Under the GDPR you have the right to: access, rectification, erasure, restriction of processing, data portability, and objection (including to processing based on legitimate interest). To exercise your rights, write to the e-mail address in section 1.

If you believe we have infringed your rights, you can lodge a complaint with the supervisory authority:

• National Supervisory Authority for Personal Data Processing (ANSPDCP)
• Address: B-dul G-ral. Gheorghe Magheru 28-30, Sector 1, postal code 010336, Bucharest, Romania
• Web: www.dataprotection.ro · E-mail: anspdcp@dataprotection.ro

10. Children

The service is not directed at children under 16. Under Romanian Law no. 190/2018, the age of consent for information society services in Romania is 16. If an account is created for a minor under 16, it must be authorized by the holder of parental responsibility.

11. Security

We apply appropriate technical and organizational measures: passwords stored only as a hash, encryption of 2FA secrets, two-factor authentication for administrators, encrypted transmission (TLS), EU hosting, and data minimization (e.g. no IP storage). Critical safety automations run locally on the hub, except in the server mode described in section 2.

12. Changes to this policy

We may update this policy. The current version is marked with the date at the top of the document ("Last updated"). Material changes will be communicated through the app or by e-mail.

13. Contact

For any questions about personal data: contact@torcip.com, TORCIP S.R.L., Str. Weiner Palada 12, Sat Roșu, Comuna Chiajna, Județul Ilfov, Romania.