Tornado API, operated by Velys Software, a technology company specializing in web access engineering and large-scale automated data extraction ("we," "our," or "us"), is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our API services and website.
By accessing or using Tornado API, you agree to this Privacy Policy. If you do not agree with the terms of this policy, please do not access the Service.
When you create an account, we collect:
Eligible accounts can start a limited trial without a payment card. When you add a card for paid service or verification, it is collected and stored by our payment processor: we never receive or store your full card number. From that registration we retain a limited record for billing and abuse prevention:
We use these eligibility signals with your account and prior trial records to prevent repeated free allowances and investigate abuse. The browser hash is restricted to trial eligibility and is not sent to our product analytics. It is a risk signal, not proof of a unique person or device. If the browser blocks this check or the signals indicate reuse, we may request card verification. Adding a card does not renew an existing trial. Contact support if you believe an eligibility decision is incorrect.
We automatically collect certain information when you use our API:
To deliver downloaded content to your cloud storage, you provide us with storage credentials (such as AWS access keys, Azure connection strings, or GCS service account keys). The handling of these credentials is detailed in Section 4.
We use the collected information for:
We understand that cloud storage credentials are highly sensitive. We implement the following measures to protect them:
We strongly recommend that you provide credentials with the minimum permissions necessary for the Service to function (for example, write-only access to a specific bucket or container). Tornado uses only the permissions required to deliver files to your specified storage destination and does not access, read, modify, or delete any other data in your storage accounts.
You may rotate or revoke your cloud storage credentials at any time through your account dashboard or via the API. We recommend rotating credentials periodically as a security best practice. If you revoke credentials, any pending or in-progress download jobs that depend on those credentials may fail.
We maintain logs of download activity processed through the Service. This section explains what is logged, how long it is retained, and how it is used.
For each download request, we may log the following information:
Download activity logs are retained for up to 90 days for operational purposes. Aggregated and anonymized usage statistics may be retained indefinitely for analytics and service improvement. Billing-related records are retained as required by applicable law and our business needs.
Download activity logs are used for the following purposes:
We implement industry-standard security measures to protect your data:
Important: We do not persistently store the media content you download through our API. Files are transferred directly from the source to your specified cloud storage destination. Temporary processing data may exist in memory or ephemeral storage during the transfer process but is not retained after job completion.
We do not sell your personal information. We may share your information only in the following circumstances:
Depending on your location, you may have the following rights:
Our website uses essential cookies for functionality purposes. We use minimal analytics to understand how our website is used. You can control cookies through your browser settings.
We retain your account information for as long as your account is active and for a reasonable period thereafter. Usage logs are retained for operational, security, and legal purposes as described in Section 5. Billing records are retained as required by law and for our business purposes.
Free allowance eligibility records: the card fingerprint, browser eligibility hash, and signup IP address described in Section 2.2 are retained after an account is closed or suspended. This is deliberate and necessary: the allowance is granted only once, so the record of a prior grant has to outlive the account that received it, otherwise closing and recreating an account would reset it. This record contains no card number and is used for no purpose other than the eligibility check.
Data Deletion Requests: You may request deletion of your data by contacting us. However, we reserve the right to retain certain information as necessary for legal compliance, DMCA compliance, fraud prevention (including the eligibility records described above), dispute resolution, and enforcement of our Terms of Service. Billing records are retained for the period required by applicable accounting law. Data deletion requests do not entitle you to any refund.
While we implement reasonable security measures, we cannot guarantee the absolute security of your data. You acknowledge that:
Your information may be transferred to and processed in countries other than your own, including countries that may not have equivalent data protection laws. By using our services, you consent to such transfers.
Our services are not intended for individuals under the age of 18. We do not knowingly collect personal information from children. If you believe we have collected information from a child, please contact us immediately.
We may update this Privacy Policy at any time without prior notice. Changes become effective immediately upon posting. It is your responsibility to review this policy periodically. Your continued use of the Service after any changes constitutes acceptance of the updated policy.
If you have questions about this Privacy Policy or our data practices, please contact us: