Privacy policy
Draft. This text is not in force yet. Items in [square brackets] are filled in before launch, and a lawyer reviews it first.
Who we are
The service is run by [Legal entity name], [Registered address] ("we"). You can reach us at hi@tourgram.app.
We play two roles. For visitors, waitlist sign-ups and agency staff accounts, we are the controller. For the guest, booking and contract data that an agency puts into the service, the agency is the controller and we are its processor (see Data processing).
What we collect, and why
| Data | Why | Legal basis (GDPR Art. 6) | Kept for |
|---|---|---|---|
| Waitlist and contact: email, name if you give it | Tell you when the service opens and answer you | Consent; our interest in replying to you | Until you withdraw, or 24 months after the last contact |
| Agency account: agency name, the company details you add (legal name, address, tax number, licence number, website, phone), contact persons (name, job title, email, phone), staff names and roles, Telegram or WhatsApp ID, and a record of what you accepted (the terms and notices, with the time and version) | Run your account and secure it | Contract | While the account is open, then 12 months |
| Usage and security logs: time, action, IP address | Keep the service safe and fix faults | Our interest in security | 90 days |
| Agency business data: guest names and contact details, travel dates, bookings, contracts and rates, documents, messages you send the assistant | Do what you ask the assistant to do | Processed for the agency, on its instructions | As the agency decides; deleted within 30 days after the account closes (export first) |
| Payments: status and references of payment links | Match a payment to a booking | Contract | As accounting law requires |
We do not store card numbers. Payments run through a licensed payment partner.
AI processing
To read a contract or a message, we send the text to an AI provider. We choose providers under terms that do not let them use your data to train their models, we send only what the task needs, and the assistant asks you before it changes anything important. The providers are listed under Sub-processors.
Who gets your data
Only our sub-processors, and authorities when the law requires it. We do not sell personal data and we do not use it for advertising.
Transfers outside the EEA
We host in the EU where we can. If data goes to a provider outside the EEA, we rely on an adequacy decision or on the EU Standard Contractual Clauses (GDPR Art. 46) and add safeguards where needed.
Your rights
You can ask us to give you access to your data, correct it, delete it, limit or stop its use, or send it to you in a usable format (GDPR Art. 15 to 22). You can withdraw consent at any time. Write to hi@tourgram.app. We answer within one month.
If you are a guest of an agency, ask the agency first: it decides how your data is used. We will help it answer you.
You can complain to your data protection authority. Ours is [Supervisory authority].
Children
The service is for travel businesses. It is not meant for children.
Security and changes
See Security. If we change this policy in a way that matters, we tell account holders before it applies.