Privacy Policy

Effective 2026-06-04 · Updated 2026-10-24

1. Who we are

Tourbox Systems Limited ("Tourbox", "we", "us", "our") is a company registered in England and Wales under company number 15613075, incorporated on 3 April 2024. Our registered address is 125 Freshfield Road, Brighton, England, BN2 0BR.

We are registered with the Information Commissioner's Office (ICO) under registration number ZC103797.

For data protection enquiries, contact us at privacy@tourbox.com.

2. About this policy

This Privacy Policy explains how we collect, use, store, and share personal data when you use Tourbox as a tour operator, including our web application, APIs, and related services.

Tourbox is a software-as-a-service (SaaS) platform that helps tour operators manage bookings, customers, itineraries, communications, and finances.

If you are a traveller using the Tourbox consumer app, this policy does not apply to you. Please see our Consumer Privacy Policy.

3. Our dual role: controller and processor

We act in two distinct capacities:

Data controller: for personal data we collect about you as a Tourbox user (your account, billing, and usage data). We decide how and why this data is processed.
Data processor: for personal data you enter into Tourbox about your customers, bookings, and business operations. You (the tour operator) remain the controller of that data, and we process it only on your instructions. Our Data Processing Agreement governs this relationship.

4. Data we collect as controller

4.1 Account data

When you create a Tourbox account, we collect:

Your name and email address (authenticated via Hanko, our passwordless authentication provider)
Your organisation name
Your role within the organisation (owner, admin, or editor)
Your avatar image (if provided)

4.2 Billing data

Where we invoice you directly, we hold your organisation's billing name, address, VAT number where given, invoice history, and payment status. Where you subscribe through the in-app checkout, billing is handled by Paddle, who acts as our Merchant of Record and collects and processes your payment information directly; we receive from Paddle transaction references, subscription status, invoice amounts, and tax information. In either case we do not store your card details or bank account information.

4.3 Usage data

We collect data about how you use the platform, including:

Feature usage and interaction patterns
AI token consumption and associated costs (input tokens, output tokens, cost, and processing duration), tracked per organisation
Error reports and performance data (via our self-hosted, EU-based error tracker)

4.4 Integration credentials

When you connect third-party services (such as Zoom, Slack, Vamoos, Xero, HubSpot, Felloh, Duffel, Gmail, or Outlook), we store the necessary authentication credentials. These are encrypted at rest using AES-256-CBC encryption.

5. Data we process on your behalf

When you use Tourbox to manage your business, you may input the following categories of personal data about your customers and contacts. You are the data controller for this information; we process it solely on your instructions.

5.1 Customer personal information

Names: first name, last name, preferred name, middle name, and title
Date of birth
Postal address (up to four address lines, city, postcode, and country)
Email addresses (one or more per customer)
Phone numbers (one or more per customer)

5.2 Booking and enquiry data

Booking details: dates, reference numbers, status, and cancellation information
Financial summaries: amounts in one or more currencies
Enquiry data: source, marketing source, qualification status, and contact information

5.3 Travel documents

Files you upload are stored in OVHcloud private object storage, hosted in the United Kingdom (London). We use content hashing to ensure file integrity.

5.4 Communications

When you use Tourbox to manage email communications, we process:

Email subject lines, body text and HTML content
Sender and recipient information
Delivery status and metadata

5.5 Financial documents and payments

Invoices and quotes: amounts, tax, and version history
Customer payment records: payment method, amount, currency, and exchange rates

6. AI data processing

Tourbox includes AI-powered features such as document intelligence and content generation. When you use these features:

Document content and text are sent to our AI provider for processing
Text generation, document OCR, classification, and voice dictation transcription use Mistral AI (Mistral AI SAS), hosted in the EU. Text and image embeddings used for search use Jina AI (Jina AI GmbH, now part of Elastic), also hosted in the EU
All AI processing of your customers' personal data is performed by EU-based providers. We do not route customer personal data through US-based AI providers
We track token usage per organisation (input tokens, output tokens, cost, and duration) for billing and monitoring purposes
No AI provider uses your data for model training. All providers are contractually prohibited from training on data submitted through Tourbox

Separately, certain optional, business-tier media features (such as video streaming and AI image editing) use specialist providers based in the United States. These process uploaded media files only, never text prompts containing personal data, and operate under a Data Processing Agreement with UK IDTA / EU SCCs transfer safeguards. See our Sub-processor List for details.

7. Third-party integrations

All integrations are initiated by you and only active when you explicitly connect them. We do not activate integrations on your behalf.

Gmail / Outlook: You connect your own email account to send and receive emails through Tourbox
Zoom: Server-to-server OAuth connection for video conferencing features
Slack: Outbound notifications for enquiries and events to your chosen Slack channels
Vamoos: Synchronisation of travel product data with your Vamoos account
Xero: Synchronisation of accounting and financial data with your Xero account
HubSpot: CRM connection to your HubSpot account (contact and deal sync)
Felloh: Payment requests and reconciliation through your Felloh account; Felloh receives customer name, email, travel dates, booking reference, and payment amounts
Duffel: Flight availability search using your own Duffel account; searches contain routes, dates, and passenger counts and ages, never traveller names or contact details
Google Ads, Microsoft Ads, and Meta Ads: Offline conversion uploads (advertising click identifiers and conversion events) to your own advertising accounts

You can disconnect any integration at any time from your organisation settings.

8. Legal bases for processing

We rely on the following legal bases under UK GDPR Article 6:

Legal basis	Processing activity
Contract (Art. 6(1)(b))	Account creation and management, service delivery, processing your subscription and billing through Paddle
Legitimate interests (Art. 6(1)(f))	Security monitoring, fraud prevention, service improvement, error monitoring via our self-hosted error tracker, and maintaining platform integrity
Consent (Art. 6(1)(a))	Optional third-party integrations you choose to connect, and marketing communications (if any)
Legal obligation (Art. 6(1)(c))	Retaining tax and billing records as required by UK law, and complying with legal requests

Where we rely on legitimate interests, we have carried out balancing tests to ensure our interests do not override your rights. You may request details of these assessments by contacting us.

We share personal data with the following categories of sub-processors, each of which is bound by appropriate data processing agreements:

Authentication: Hanko (identity verification)
Billing: Paddle (payment processing, invoicing, tax, for in-app purchases only)
Infrastructure: Northflank (hosting, UK), Cloudflare (Pages, DNS, Turnstile bot protection, edge caching of media renders and video; no processing of content)
Object storage: OVHcloud (uploaded media, generated PDFs, attachments; UK, London)
Off-site backups: Scaleway (client-side encrypted backup ciphertext only; EU, France)
Email and SMS delivery: Sinch, including its Mailgun product (transactional and operator email sending; SMS sending and receiving from a Tourbox-owned number, covering phone numbers and text message content; EU)
Mapping: MapTiler (map tile rendering, geocoding)
AI providers: Mistral AI (text generation, OCR, classification; EU) and Jina AI / Elastic (embeddings; EU)
Media processing: fal.ai (AI image editing) and RunPod (GPU vision) for business-tier media features (US, under IDTA / SCCs); Black Forest Labs (AI image editing; EU) is being introduced to replace fal.ai. Uploaded video is transcoded on our own EU infrastructure
OAuth providers: Google and Microsoft (where operators connect Gmail or Outlook)

Error monitoring is performed by a self-hosted, EU-based error tracker running on our own infrastructure; it is not a third-party sub-processor, and personal data in error reports is disabled by default.

For a complete and up-to-date list of sub-processors, including their locations and purposes, see our Sub-Processors page.

We do not sell your personal data to anyone.

10. International data transfers

Your data is primarily hosted in the UK, on Northflank infrastructure, with uploaded files in OVHcloud's London region. If you are based in the EEA, transfers to the UK are covered by the European Commission's UK adequacy decisions. Some of our sub-processors are based in or transfer data to countries outside the UK and EU, including the United States.

Where data is transferred internationally, we ensure appropriate safeguards are in place:

UK transfers: UK International Data Transfer Agreement (IDTA) or UK Addendum to the EU SCCs
EU transfers: Standard Contractual Clauses (SCCs) approved by the European Commission

AI processing of your customers' personal data is kept within the EU: text and document AI runs on Mistral AI (France) and embeddings on Jina AI / Elastic (EU). We do not transfer customer personal data to AI providers outside the UK and EU. International transfers to the United States are limited to optional, business-tier media features (fal.ai and RunPod), which process uploaded photos only under UK IDTA / EU SCCs safeguards. Video files are processed on our own EU infrastructure; Cloudflare's global network caches and delivers them in transit only, the same transit-only role it plays for our other static assets, and does not process video content.

11. Data retention

We retain personal data only for as long as necessary for the purposes described in this policy:

Data category	Retention period
Account data	While your account is active, then deleted within 30 days of account closure
Customer data (processed on your behalf)	As directed by you; deleted or returned within 30 days of contract termination
Billing and tax records	7 years from the date of the transaction, as required by UK tax law
Error logs	90 days
Form visitor details (IP address, browser and referring page)	90 days from the submission; the answers are kept as directed by you
AI usage logs	12 months
Email delivery logs	30 days
Mailing-list webhook events (Mailchimp, Brevo)	The event is kept for 60 days; its content is emptied 7 days after it is processed, or after 30 days at most
Marketing opt-out records for an address no customer or connected marketing tool holds	Deleted two years after the opt-out
Encrypted backups	Up to 60 days from the date the backup was taken

When data is deleted, we remove it from our active systems straight away. Copies held in our encrypted backups expire automatically within 60 days of the backup being taken, after which no copy remains.

You have the following rights in relation to personal data we hold about you as controller:

Access: Request a copy of the personal data we hold about you
Rectification: Ask us to correct inaccurate or incomplete data
Erasure: Ask us to delete your data where there is no compelling reason for us to continue processing it
Restriction: Ask us to suspend processing of your data in certain circumstances
Portability: Request your data in a structured, commonly used, machine-readable format
Object: Object to processing based on legitimate interests
Withdraw consent: Where processing is based on consent, withdraw that consent at any time
Complain: Lodge a complaint with the Information Commissioner's Office (ICO) at ico.org.uk or by calling 0303 123 1113

To exercise any of these rights, contact us at privacy@tourbox.com. We will respond within one month.

For data we process on your behalf (as processor), please direct your request to the tour operator who controls that data. If they ask us to assist, we will do so promptly.

13. Additional rights for California residents (CCPA/CPRA)

If you are a California resident, you have additional rights under the California Consumer Privacy Act (CCPA) and the California Privacy Rights Act (CPRA):

Right to know: You may request details about the categories and specific pieces of personal information we have collected about you
Right to delete: You may request deletion of your personal information, subject to certain exceptions
Right to correct: You may request correction of inaccurate personal information
Right to opt out of sale: We do not sell personal information. We do not share personal information for cross-context behavioural advertising
Non-discrimination: We will not discriminate against you for exercising any of your privacy rights

To exercise these rights, contact us at privacy@tourbox.com.

14. Security

We take the security of your data seriously and implement appropriate technical and organisational measures, including:

Multi-tenant isolation: Row-Level Security (RLS) at the PostgreSQL database level ensures each organisation's data is strictly separated
Encryption at rest: Integration credentials are encrypted using AES-256-CBC
Encryption in transit: All data is transmitted over HTTPS/TLS, including Redis connections (TLS)
Authentication: Hanko JWT-based passwordless authentication
Access control: Role-based organisation access with owner, admin, and editor roles
Private storage: Files stored in OVHcloud object storage are not publicly accessible; access is controlled via signed URLs

No system is completely secure. If you discover a security vulnerability, please report it to privacy@tourbox.com.

15. Children

Tourbox is a business-to-business platform designed for use by tour operators. It is not directed at individuals under the age of 16, and we do not knowingly collect personal data from children. If you believe a child has provided us with personal data, please contact us and we will delete it promptly.