Privacy Policy

This policy explains how Aurea Futura LTD collects, uses, stores, shares and protects personal data when you use My Tour Platform. It covers everyone who uses the Service: Tour Directors, tour companies, Group Leaders, guests (travellers), hotels, drivers, chaperones, taxi companies and visitors to our website.

1. Who is responsible for your data

It depends on whose data it is:

• Guests on a tour (travellers, Group Leaders, hotel, driver and chaperone users): the tour company or Tour Director who runs the tour is the data controller. They decide what is entered and why. Aurea Futura LTD is their data processor: we store and process that data only to run the Service for them. You can send questions or requests about guest data to the tour company or Tour Director, or to us, and we pass them on.
• Tour Director accounts, billing, support messages, security logs and website visitors: Aurea Futura LTD is the data controller.

Aurea Futura LTD
Company No. 11132111
18 Spencer Road, London SW20 0QP, United Kingdom
Email: hello@mytourplatform.com

2. Data protection manager and how we answer requests

Our data protection manager handles data protection questions, requests and complaints. Write to slim@aureafutura.com, or to hello@mytourplatform.com. We are not required by law to appoint a Data Protection Officer, and this role is not a statutory Data Protection Officer.

We answer requests within one month. If a request is complex, or you send several, we may extend this by up to two more months. If we do, we tell you within the first month and explain why.

EU representative (Article 27 EU GDPR): we have not appointed a representative in the European Union. If you live in the EU, contact us directly at the addresses above.

3. Information we collect

Tour Director account

Name, email, phone, company, country, languages, password (stored only as a hash), settings
Lawful basis: Contract (Art. 6(1)(b))

Billing

Plan, credits, amounts, dates, payment status and the payment provider's reference (Revolut, or PayPal for older payments). We never receive card numbers.
Lawful basis: Contract (Art. 6(1)(b)); legal obligation for tax records (Art. 6(1)(c))

Tour data

Destinations, itineraries, hotels, rooms, guest names, supplier and driver contacts
Lawful basis: We are the processor. The Tour Director or tour company, as controller, decides the lawful basis.

Guest data

Name, room, birthday if entered, answers to tour forms (may include dietary or medical details), meal and activity replies, luggage scans and optional luggage photos, guest app email and password (stored only as a hash)
Lawful basis: We are the processor for the Tour Director or tour company. Before a guest first sees the tour, they read a short notice and tap "I agree"; we record that.

Group Leader, hotel, driver and chaperone users

Access code used, sign-in times, room and headcount updates, dinner confirmations (name of the person confirming), driver meal choices
Lawful basis: We are the processor for the Tour Director or tour company. The same "I agree" notice is shown and recorded.

Taxi and transfer bookings

Guest name, phone, email, flight number, pick-up details and notes; the taxi company's contact details and its drivers' names
Lawful basis: Steps the guest asks for to arrange the ride (Art. 6(1)(b))

Tour Director's own money records

Expenses, receipt images, earnings, daily rate, tips, currency choices
Lawful basis: Contract (Art. 6(1)(b))

Supplier data

Company name, phone, email, address, driver name, notes
Lawful basis: For a tour: we are the processor. In a Tour Director's own supplier book: legitimate interests (Art. 6(1)(f))

Security data

Sign-in times, IP addresses, role, failed sign-ins, security events, error reports
Lawful basis: Legitimate interests: keeping the Service secure (Art. 6(1)(f))

Support data

Emails to our support address, contact-form messages, help requests and help chats, our notes on them
Lawful basis: Legitimate interests: answering you (Art. 6(1)(f))

TD Radar

City (taken from your itinerary), availability status, status note, who may see you. No GPS, hotel or address.
Lawful basis: Consent (Art. 6(1)(a)): you switch it on and can switch it off

Tour update notifications

The push address your phone gives us, its keys and the tour
Lawful basis: Consent (Art. 6(1)(a)): your phone asks you first, and you can turn it off

4. Health data (dietary, medical and mobility details)

Dietary needs, allergies, medical conditions and requests for mobility help are health data, a special category under Article 9 of UK and EU GDPR. Giving these details is optional. In the guest app, a guest gives them only if they choose to answer. On school tours, guests do not enter them; the Tour Director or Group Leader does. The Tour Director or tour company, as controller, decides the lawful basis for this data and the condition under Article 9.

We store these details encrypted (see section 11). Only the Tour Director, co-directors they add, and the people they give a tour access code to whose role needs a detail (for example the hotel, for meals) can see them. They are removed 90 days after the tour ends.

5. Children's data

On school tours the Service holds the names, rooms and dietary needs of children. The Tour Director or Group Leader enters these details; children do not enter dietary or medical details themselves. Only the Tour Director, the Group Leader and the people they give a tour access code to (for example the hotel, for rooms) can see them.

Children may take part in a photo challenge that their Tour Director sets up. They upload their own photos and team answers. These are deleted 90 days after the challenge closes, after 90 days without activity, or straight away if the Tour Director deletes the challenge or their account. Photos are never sent to an AI service.

The school or tour company that arranges the tour is responsible for any permission needed from parents or guardians. If you think a child's data has been entered without permission, contact us straight away.

6. How we use your data

• To provide, run and improve the Service.
• To sign people in and to give each role only what it needs.
• To manage plans and credits.
• To create emails, vouchers, lists and reports that Tour Directors send to suppliers.
• To give Tour Directors AI help with text, documents and receipts (section 7). Guests cannot ask AI anything.
• To show weather forecasts (OpenWeather receives city names only).
• To answer support requests.
• To send service emails, such as sign-in codes, confirmations and notices.
• To count things such as the number of tours and guests, without naming anyone, so we can run the Service.
• To detect and stop misuse, fraud and security problems.
• To meet legal duties and enforce our Terms.

6A. What our admin team can see

We collect and show only what each task needs (data minimisation, Article 5(1)(c)).

• The admin home page shows totals only, such as the number of Tour Directors, guests and tours.
• To run accounts, billing and support, these admin pages show Tour Director names and email addresses: Tour Directors (the list and each account page, including the last sign-in date), Subscriptions, Support, Search, Referrals and Promo codes. Email and Broadcast send messages to Tour Directors by name and email address.
• The support inbox shows every message sent to our support address or contact form, so it can include messages from guests or suppliers who write to us.
• The data protection desk shows the name or email a person gives with a request, and how we checked who they are. Only the owner can download one guest's data, to answer an access request.
• The security and error logs show account identifiers and IP addresses (section 10 says how long).
• No admin page lists a tour's guests, itinerary, suppliers or money records. For support, the owner or a permitted staff member can use "View as Tour Director". It is read-only, and its start and end are recorded in the admin activity log.
• Staff see only the admin pages their permissions allow. Their sign-ins and actions (for example account edits and deletions, credits, support replies and messages sent) are recorded in the tamper-evident admin activity log.
• The owner, who runs the platform, can also reach the database and files through our hosting account, as the operator of any web service can. We use this only to fix faults, restore a backup, answer a data protection request or meet a legal duty. This access happens outside the platform, so it is not recorded in the platform's own activity log.

We do not monitor or profile Tour Directors, tour companies or guests.

7. Who we share data with

We do not sell, rent or share personal data for marketing.

No access between accounts: one Tour Director cannot see another Tour Director's tours or guests, unless they are added to that tour as a co-director. Access codes (guest, Group Leader, hotel, driver, chaperone) open only the tour they were made for.

People on the tour: the Tour Director decides who gets an access code. Hotels, drivers, Group Leaders and chaperones see only the part of the tour their role needs.

Finding your name on a tour: when a Tour Director turns on Quick join, guests on that tour can find their own name to sign in. After at least two letters, up to five matching names are shown, with their initials and whether each name is already registered in the guest app (by that guest or by someone in their group). Nothing else about the other guests is shown.

Taxi and transfer bookings: when a guest books a transfer, we send the guest's name, phone number and trip details to the taxi company that takes the job. Its dashboard hides the guest's details 24 hours after pick-up.

Payments: online checkout is currently unavailable, so no new payment details go to Revolut. When checkout is available, Revolut receives the data listed in section 17.

AI services:

• AI is used in tools for Tour Directors and our admin team: checking an imported document (the itinerary, hotel and supplier sections; guest lists and guest sections are filtered out on a best-effort basis, so a guest detail written inside an ordinary itinerary line may still be sent), writing itinerary and message text, city information sheets, rewriting and summing up supplier feedback, the introduction and next step in the daily email digest, the Tour Director help chat, and reading the Tour Director's own receipts (Expenses, My Money and tour accounts).
• Guests cannot ask AI anything. The guest Tour Book may show a short AI-written narration. It is written when a guest first opens the book, and again if the itinerary changes, from the tour name, city names and itinerary titles; guest names are masked.
• What is sent: itinerary titles, times and places; the tour name, dates and cities; hotel names and addresses; supplier names and details from imported documents; the Tour Director's own questions and comments; and the Tour Director's own receipt photos.
• Guest records (names, contacts, diets, health notes) are never sent to an AI provider. Text a Tour Director chooses to improve with AI is sent with the tour's guest names hidden. Messages about guests (such as pre-contact emails, welcome messages and announcements), help chat questions and supplier feedback also pass a best-effort automatic check that blocks common diet and health details; it cannot catch everything, so do not include them. Rooming and guest lists are read without AI. The daily digest sends a count of birthdays, never names. Guest voucher details are typed by hand, not read by AI.
• All AI requests go through one gateway. It refuses any request marked as containing guest data. On every request, in the text it sends, it replaces the names of the tour's guests, Group Leaders and chaperones, guest app email addresses, Group Leader phone numbers, booking references and room numbers (such as "room 123", in several languages) with a placeholder. In the tools where a Tour Director types free text (the help chat, supplier feedback and itinerary text), it also replaces the email addresses and phone numbers it recognises (best effort; unusual formats may be missed). Imported documents keep supplier contact details; their guest sections are filtered out on a best-effort basis. It never changes images.
• Receipt photos are sent as taken and cannot be masked. Tour Directors must not photograph documents that list guests.
• Providers: the text tools use one provider at a time, OpenAI or Anthropic, chosen in our settings. Receipt reading in Expenses and My Money always uses OpenAI. Receipt reading in tour accounts sends each photo to both Anthropic (all details) and OpenAI (total, currency and date, as a cross-check). Under their standard API terms, the providers do not use data sent through the API to train their models. Our admin team can switch each AI feature off.
• The AI cannot change your data or act for you. A Tour Director must check AI text before using it.

Google Calendar: if a Tour Director connects a Google calendar, we send the tour's schedule items (title, time and place) to that Google account.

Legal requests: we may disclose data if the law requires it, or to protect the rights, property or safety of people or of the Service.

TD Radar: if you switch on TD Radar, other Tour Directors who use it and are in the same city that day can see your name, company, city, availability and status note. By default only colleagues from your own company see you; you can widen this to all Tour Directors after a confirmation. Hotel names, addresses and GPS positions are never shared. You can switch it off, or set yourself to invisible, at any time. If you switch it off, you must opt in again to use it.

8. Service providers

These providers process personal data for us:

IONOS (1&1)

Web hosting
Data shared: All platform data (stored on their servers)
Location: UK

Revolut Ltd

Payment processing (online checkout is currently unavailable)
Data shared: Customer ID, subscription ID, plan type, billing amounts, name, email
Location: UK / EU

OpenAI, Inc.

AI tools for Tour Directors: text tools when OpenAI is the chosen provider; reading their own receipts (Expenses, My Money, tour accounts)
Data shared: Itinerary, hotel and supplier details and the Tour Director's own questions, with the tour's known guest names, booking references, known guest emails and room numbers replaced; receipt photos as taken (cannot be masked). We do not send guest personal data on purpose.
Location: US

Anthropic PBC

AI tools for Tour Directors: text tools when Anthropic is the chosen provider; reading receipts in tour accounts
Data shared: Itinerary, hotel and supplier details and the Tour Director's own questions, with the tour's known guest names, booking references, known guest emails and room numbers replaced; receipt photos as taken (cannot be masked). We do not send guest personal data on purpose.
Location: US

Your phone's push service (Google Firebase Cloud Messaging, Apple Push Notification service, Mozilla Push or Microsoft Windows Push Notification Services)

Delivering tour update notifications you allowed
Data shared: The update text and tour name, end-to-end encrypted so the service cannot read them; the push address of your device
Location: Varies by provider

IONOS (email)

Sending platform emails (sign-in codes, confirmations, notices) and receiving email sent to our support address
Data shared: Recipient or sender name and email address, and the message
Location: EU

Google LLC (Calendar, Maps)

Calendar sync a tour director turns on; maps shown or opened in the app
Data shared: Calendar: the tour's schedule items (title, time, place) and the Google account that connects them. Maps: the place shown and your device's IP address
Location: US

OpenStreetMap Foundation (map tiles)

Map images in the guest app, after you tap "Show map"
Data shared: Your device's IP address (the map images load from their servers)
Location: UK / EU

PayPal (Europe) S.à r.l. et Cie, S.C.A. (historic)

Past subscription payments; not used for new payments
Data shared: Name, email, payment amounts and subscription ID of past PayPal payments
Location: EU

We keep these providers in our records of processing. For some of them, we are still completing the record of their data processing terms and transfer safeguards.

Services that receive no personal data from us:

• European Central Bank: we download its public daily exchange rates. Nothing about you is sent.
• OpenWeather: our server sends city names to get weather forecasts.
• OpenStreetMap place search (Nominatim): our server sends place names typed for a tour.
• GitHub (Microsoft): holds our source code and runs our deployments. The platform does not send its database to GitHub. When we look into a fault, recent server error lines are copied into our private deployment log after email addresses, phone numbers, codes and other values are masked.

We do not use any analytics, advertising, tracking or profiling services. There is no Google Analytics, no Meta Pixel, no Hotjar and nothing similar.

9. International transfers

Our servers are in the United Kingdom (IONOS). Data from the European Union comes to the UK under the European Commission's adequacy decision for the UK.

Some providers in section 8 are in the United States or elsewhere:

• OpenAI and Anthropic (United States): we use them under their standard business API terms. We are still putting their data processing terms and international transfer safeguards in place. Until then we send them no guest records, and the best-effort checks in section 7 apply to everything else.
• Google Calendar: data goes to the Google account a Tour Director chooses to connect, under that account's Google terms.
• Push services (Google, Apple, Mozilla or Microsoft, depending on your phone or browser): the message is end-to-end encrypted, so the push service cannot read it.
• Revolut: only when online checkout is available; Revolut may process payment data outside the UK and EU.

Data in transit is protected by HTTPS, including when Tour Directors use the Service abroad.

10. How long we keep data

A clean-up job runs every night and applies these rules:

• Tour Director accounts: kept while the account is in use. You can delete your account yourself at any time. We may also delete an account after 24 months without use. If we do, we email a warning at least 30 days before, and we never delete an account this way while it has a current or future tour or a running plan.
• Tour data (guests, rooms, suppliers, taxi bookings, guest app data): anonymised or deleted 90 days after the tour ends. Guest names become "Traveller 1", "Traveller 2" and so on, and birthdays, dietary and mobility details, booking references and contact details are cleared. A tour without an end date is handled 90 days after its start date, or after the date it was created if it has no start date.
• A company's supplier list: when a tour company closes its account, its supplier list (suppliers, contacts, notes and documents) is deleted 90 days after closing. If the company reopens before then, nothing is deleted. Each tour keeps its own supplier details.
• Billing records: kept for 6 years after the last transaction for UK tax and accounting rules (HMRC), then deleted.
• Driver payment receipts: the signature image and the driver's name on the receipt are deleted 6 years after payment. The amounts are kept as billing records.
• Private My Money records: only the account owner can see these, and their files are encrypted separately. Co-directors and "View as Tour Director" cannot open them. Removing a transaction can be undone and keeps its evidence. They are not removed when a tour ends; deleting your account erases them, so export them first if you need them.
• Expenses and receipts outside My Money: kept with the tour and removed when the tour data is removed.
• Luggage photos: optional, reduced in size and stored privately. They become unavailable at the end of the last tour day in the tour's time zone, and the clean-up job deletes the files. Scan records stay with the tour and follow its rule.
• Offline essentials on a guest's phone: saved only if the guest chooses. The copy holds meeting, hotel and Tour Director help details and expires after seven days or at the end of the tour, whichever is first. Signing out or "Remove saved details" clears it. Anyone who uses that browser may see it while it is there, and a copy that is offline cannot be updated or withdrawn.
• Tour update notifications: kept until you turn them off, delete your registration, the push service says the address has expired, or the tour data is anonymised.
• Join QR codes (Quick join): we keep only a fingerprint (hash) of each code, never the code. Records are deleted 30 days after the code expires. Sign-in emails wait in an encrypted queue for a few seconds and are deleted once sent (at most 1 day).
• Tour form answers: deleted when the tour data is removed.
• Photo challenges: photos, team selfies, answers and teams are deleted 90 days after the challenge closes, after 90 days without activity, or when the Tour Director's account is deleted.
• Sign-in records: kept for 12 months. The IP address is kept for 30 days, then replaced by a keyed hash (HMAC-SHA256) for records from October 2026, or a plain SHA-256 hash for older records.
• Failed sign-in attempts: 30 days. Security events: 90 days.
• Error reports: the IP address is removed after 30 days, and the whole report is deleted after 90 days.
• Admin activity log: kept for 24 months. Each entry is chained to the one before, so a changed or removed entry shows up.
• System alert log (alerts sent to the platform owner): 12 months.
• Support messages: emails to our support address, contact-form messages, help requests and in-app help chats, their attachments and our notes on them are deleted 24 months after the last message in the conversation.
• Spam: messages moved to our spam folder, by our staff or by our filter when it is on, are deleted after 30 days. Messages the filter only gives a spam score stay in the conversation and follow the support rule. The filter looks at: how many links a message has, shortened links, links whose text shows a different site, certain sales words, risky file types, a reply address on a different domain from the sender, a sender address written with non-English letters (a lookalike risk), and, for the contact form, its hidden field, how fast it was sent and how often it is sent from the same connection. Senders we have blocked or marked as not spam move the score up or down. We keep our list of blocked and trusted addresses and domains until it is removed or unused for 24 months.
• Contact form: to stop automated spam, the form records how fast it was sent and has a hidden field. No extra cookie is used: the check uses the session the form already needs.
• Consent records (each "I agree" tap on a tour notice): kept for 3 years. The IP address in a record is kept for 30 days, then replaced by a keyed hash (HMAC-SHA256).
• Data protection requests: the request, how we checked who you are (never a copy of an ID document) and our answer are kept for 3 years after the request is closed.
• Expired sign-ins and devices: deleted once they expire. "Keep me signed in" lasts at most 90 days, a trusted Tour Director device 90 days, a trusted guest device 30 days and a trusted taxi company device 60 days.
• Other records: company invitations that were never accepted are deleted 12 months after they end. Calendar sync history is deleted 12 months after the tour ends.
• Backups: daily copies of the database and uploaded files are kept for 14 days, so deleted data leaves the backups within 14 days.

11. How we protect data

• Passwords are stored only as one-way hashes (bcrypt).
• These fields are encrypted in the database with authenticated encryption (XChaCha20-Poly1305, 256-bit keys kept outside the database): each guest's dietary or medical note and mobility-help flag; the dietary answer in the guest app; meal-reply notes, and the meal notes of drivers and Tour Directors; tour form answers; a tour's overall dietary notes; supplier phone, email, address and notes; hotel phone and email; driver names; Wi-Fi passwords; tour passwords; calendar connection tokens; admin authenticator secrets; and our own keys for outside services. Older values are encrypted by the nightly clean-up job. While an update of the Service is being installed, a new value in the most recently added encrypted fields (hotel contacts, driver names, Tour Directors' supplier book details, driver meal notes and our own keys) can be saved as typed for a short time; the nightly clean-up job then encrypts it. If encryption is not available, a new value is not saved, rather than saved unencrypted.
• Data in transit is protected by HTTPS, and browsers are told to use HTTPS only (HSTS).
• Session cookies are HttpOnly, Secure and SameSite=Lax.
• Every request that changes data must carry a security token (CSRF protection).
• A Content Security Policy limits where pages can load scripts, images and frames from.
• Sign-in, code entry and many other actions are rate-limited to slow down guessing.
• Tour Directors confirm sign-in with an emailed code unless they chose to trust the device. Admin sign-in asks for an authenticator app code, or an emailed code if no app is set up.
• Each role sees only its own part of a tour (Tour Director, Group Leader, hotel, driver, chaperone, guest).
• Access codes are random and open only one tour.
• The Service makes a daily backup of the database and uploads, stored in a folder the web cannot reach, for 14 days. Encrypted fields stay encrypted inside it.
• Once the owner has set up a backup key, each backup is encrypted to a key kept offline, so the server itself cannot open it. Encrypted backups can then also be copied to storage away from the server; we will list that provider in section 8 when it is in use.

12. Data breaches

If a personal data breach is likely to put people's rights at risk, we will:

• Tell the Information Commissioner's Office (ICO) within 72 hours of becoming aware of it (Article 33 UK GDPR).
• Tell the people affected without undue delay where the risk to them is high (Article 34 UK GDPR).
• Record every breach, its effects and what we did, in our breach register.
• Act at once to contain it, for example by changing passwords and keys and fixing the weakness.

Where we are the processor for a tour company or Tour Director, we tell them without undue delay so they can meet their own duties.

13. Your rights

Under UK GDPR and EU GDPR you have these rights:

• Access (Art. 15): ask for a copy of your data. Tour Directors can download theirs from their profile.
• Correction (Art. 16): ask us to correct wrong or incomplete data.
• Erasure (Art. 17): ask us to delete your data. Tour Directors can delete their account from their profile. Guests can delete their registration at any time in the guest app: My trip → My account → Delete my registration. This also removes their phones' notification sign-ups. If we handle a guest's erasure request for them, we also anonymise the guest's entry on the tour list; any taxi booking keeps only the amounts. Group Leaders, hotels and guests who need anything else can write to hello@mytourplatform.com or ask their Tour Director.
• Restriction (Art. 18): ask us to limit how we use your data in some cases, for example while we check it is correct.
• Portability (Art. 20): receive your data in a machine-readable file (JSON). Tour Directors can download a copy of their account, tours, money records, supplier and hotel books, support history, sign-in history and consent records from their profile.
• Objection (Art. 21): object to processing based on legitimate interests. We will stop unless we have strong legitimate grounds that override your interests.
• Withdraw consent: where we rely on consent (TD Radar and notifications), you can withdraw it at any time. This does not affect what we did before.
• Automated decisions (Art. 22): you have the right not to be subject to decisions made only by automated means that have legal or similarly significant effects. We do not make such decisions.

Step-by-step guide: Delete your MyTour data.

To use any of these rights, write to our data protection manager at slim@aureafutura.com or to hello@mytourplatform.com, or use the options in your profile. We answer within one month, or up to two months more for complex requests, as explained in section 2.

14. Automated decisions and profiling

We do not use automated decisions or profiling that have legal or similarly significant effects on anyone. AI features write or read text for Tour Directors, and write the Tour Book narration; they decide nothing about people. Which features you can use depends on your plan and our admin settings, not on profiling.

15. Cookies and device storage

We use cookies to keep you signed in, to remember a device you trust, and to remember a few choices you make, such as the tour your phone last opened. We do not use analytics, advertising or tracking cookies. Our Cookie Policy lists every cookie, how long it lasts and why, and what we keep in your browser's storage.

16. Legitimate interests

We rely on legitimate interests for:

• Security records: to detect misuse and protect accounts.
• Support: to answer messages and keep a record of what we said.
• Tour Directors' own supplier books: to help them contact suppliers they work with.

You can object to this at any time by contacting us.

17. Payment providers

Online checkout is currently unavailable. No new payments go through the Service; contact us to buy a pass or credits. When checkout returns, Revolut will receive, to process your payment:

• Your full name and email address.
• The plan or credits you chose and the price.

We would receive from Revolut a customer reference, a payment reference and the payment status. We never receive card numbers, bank details or your Revolut sign-in details. Revolut handles payment data under its own Privacy Policy.

We also keep the records of older payments made through PayPal, under the billing rule in section 10.

18. Complaints

If you think your data protection rights have been broken, you can complain to a supervisory authority:

• United Kingdom: Information Commissioner's Office (ICO), ico.org.uk, tel. 0303 123 1113
• European Union: the data protection authority in the EU country where you live or work, or where the problem happened.

Please contact our data protection manager first so we can try to put things right.

19. Changes to this policy

We update this policy when our practices or the law change, and we change the "Last updated" date at the top. For important changes, we tell Tour Directors by email or with a notice in the Service.

20. Contact

Aurea Futura LTD
Company No. 11132111
18 Spencer Road, London SW20 0QP, United Kingdom
hello@mytourplatform.com
Data protection manager: slim@aureafutura.com