Privacy policy

For the data of the businesses that use Tourtify (account owners and their team members) and of visitors to this website, Tourtify is the controller.

For traveller data on an operator's booking website (bookings, enquiries, traveller details, waivers and reviews), the operator is the controller and Tourtify acts as their processor, following the operator's instructions. Our data processing terms set out how we do that.

• Account data: your name, email, business details and the team members you invite.
• Sign-in security: password hashes and, if you turn it on, two-step sign-in settings.
• Billing data: your plan, subscription status and invoices. Card details are handled by Stripe, not by us.
• Messages: what you send us through the contact form or by email.
• Activity records: a log of important changes in your console (who changed what and when), kept for security and support.
• Technical data: logs such as IP address and browser, used for security and to keep the service working.

When travellers book with an operator, Tourtify stores the booking, contact and traveller details the operator's forms ask for, payment records (not card numbers) and any waivers or reviews. We use it only to provide the service to that operator: for example to show the booking in their console, send booking emails and take payments through the operator's own payment provider.

Travellers who want to access, correct or delete their data should contact the operator they booked with. If they contact us, we pass the request on.

• To provide, secure and support the service (performing our contract with you).
• To send account, security and billing messages (performing our contract).
• To answer your questions (our legitimate interest in responding to you).
• To prevent abuse, for example bot checks on public forms (our legitimate interest in keeping the service safe).
• To meet legal, tax and accounting obligations.

We do not sell personal data, and we do not use traveller data for our own marketing.

We use these providers to run Tourtify. Each processes personal data only to provide its service to us:

• Amazon Web Services (Amazon S3): storage of uploaded files, such as tour photos, videos and PDFs, WordPress import files and files travellers add to their details forms.
• Stripe: billing for Tourtify subscriptions. When an operator connects Stripe to take traveller payments, those payments are processed in the operator's own Stripe account under the operator's agreement with Stripe.
• Cloudflare (Turnstile): checks that a person, not a bot, is sending public forms such as contact, enquiry and sign-in forms. It processes browser and device signals and the visitor's IP address.
• Anthropic: only when an operator uses the AI assistant plugin. The text needed for a draft (for example an enquiry, a review or tour details) is sent to generate a suggestion, which the operator checks before anything is sent or published.
• Our email delivery provider: sends account, booking and notification emails. Operators who connect their own email server with the SMTP plugin send through that server instead.

We will update this list before adding or replacing a sub-processor.

Operators can connect their own accounts with other services, such as payment gateways (PayPal, Razorpay, Mollie, Square, Xendit, Mercado Pago, Paystack, Flutterwave, iyzico, KOMOJU, PayMongo, Opn Payments, Tap, Khalti, eSewa, Fonepay), Mailchimp or Brevo, WhatsApp, SMS providers (Twilio or Sparrow), Google Analytics, Meta Pixel, resellers connected over OCTO and their own webhooks. Data sent to these services is sent on the operator's instructions and handled under the operator's own agreement with that provider. Website fonts are hosted by Tourtify and served from the website's own address, unless the operator chooses to load them from Google Fonts; then visitors' browsers fetch the fonts from Google, which receives their IP address, under the operator's choice.

Some of our providers process data outside the country you live in, including in the United States. Where data protection law requires safeguards for these transfers, such as standard contractual clauses, we rely on them.

Data is encrypted in transit, access is limited to people who need it, two-step sign-in is available for every account, and each business's data is kept separate at the database level. More on our security page.

We keep account data while your account is open. If a trial ends without a plan, your site is paused and your content is kept so you can pick up where you left off. After an account is closed, we delete or anonymise its data after a limited period, except records we must keep for legal, tax or security reasons. Operators decide how long traveller data is kept while their account is open.

Depending on where you live, you may have the right to access, correct, delete or export your personal data, to restrict or object to some uses, and to complain to your data protection authority. Travellers should first contact the operator they booked with. To make a request, email hello@tourtify.com.

This website counts visits with its own first-party analytics, run on our servers. No data is shared with advertising networks.

If you accept analytics cookies, we set tt_vid (a random visitor ID, 13 months) and tt_sid (a random session ID that expires after 30 minutes without activity) to understand which pages are useful and which campaigns bring visitors who sign up. We record the pages you view, the referring site and campaign tags, your browser, device type and country (from our network provider), and clicks on buttons such as "Start free trial". We never store your IP address.

If you decline, or your browser sends a Global Privacy Control or Do Not Track signal, no analytics cookies are set and only an anonymous page count is kept. Your choice is remembered in tt_consent (6 months). You can change it at any time with Cookie settings.

The contact form uses Cloudflare Turnstile to check that a person, not a bot, is sending it. Turnstile processes browser and device signals for that check only.

See our cookie policy for the cookies this website, the console and booking websites use.

If we make important changes, we will update the date above and tell account owners by email.