How we protect your data

Pages are served over HTTPS, and browsers are told to use HTTPS only (HSTS), so a connection cannot be quietly downgraded.

Sensitive fields are encrypted in the database with authenticated 256-bit encryption (XChaCha20-Poly1305): guests' dietary, medical and mobility notes, meal notes, tour form answers, supplier and hotel contact details, driver names, Wi-Fi and tour passwords, calendar connection tokens and our own keys for outside services. The keys are kept outside the database. If encryption is not available, a new value is not saved, rather than saved unencrypted.

Backups: the database and uploads are backed up every day and kept for 14 days. Once the owner has set up a backup key, each backup is encrypted to a key kept offline, so the server itself cannot open it.

Each Tour Director's tours are kept apart from every other account. Another Tour Director sees your tour only if you add them as a co-director.

• Roles: Tour Directors, Group Leaders, hotels, drivers, chaperones and guests each see only their own part of a tour.
• Access codes: hotels, drivers, Group Leaders and guests reach your tour only with a code you share. Each code opens one tour only, and by default stops working 30 days after the tour ends.
• Our admin team: admin pages show Tour Director names and email addresses for accounts, billing and support. No admin page lists a tour's guests or details. For support, the owner or a permitted staff member can use "View as Tour Director", which is read-only and recorded, including when it ends. The owner can also reach the database through our hosting account to fix faults; that access is outside the platform and is not in its activity log. Details are in our Privacy Policy (section 6A).

• Passwords are stored only as one-way hashes (bcrypt).
• Two-step sign-in: Tour Directors enter an emailed code unless they chose to trust the device. Admin sign-in asks for an authenticator app code (TOTP), or an emailed code if no app is set up.
• Rate limits: sign-in, code entry and many other actions are limited, to slow down guessing.
• CSRF protection: every request that changes data must carry a security token.
• Content Security Policy: pages may load scripts, images and frames only from the places we allow.
• Tamper-evident log: the admin activity log (admin actions, account changes and changes to security settings) is hash-chained, so a changed or removed entry shows up. The nightly job checks the whole chain. Other security events, such as blocked sign-ins, go into a separate log that is not chained and is kept for 90 days.

We use no analytics, no advertising pixels and no tracking cookies. There is no Google Analytics, no Meta Pixel and no Hotjar. Fonts and scripts come from our own server.

Our cookies keep you signed in and secure, and two of them remember a choice in the guest app. Every cookie is listed in our Cookie Policy.

AI is used in tools for Tour Directors and our admin team, such as checking an imported document, writing itinerary and message text, and reading the Tour Director's own receipts. Guests cannot ask AI anything. The guest Tour Book may show a short AI-written narration, written when a guest first opens the book, and again if the itinerary changes, from the tour name, city names and itinerary titles. We do not send guest personal data to AI on purpose: rooming and guest lists are read without AI. One gateway handles every AI request: it refuses requests marked as guest data and, on every request, replaces the tour's guest names, guest app emails, Group Leader phone numbers, booking references and room numbers in the text it sends. Tools where a Tour Director types free text also mask the email addresses and phone numbers they recognise (best effort). Images are never masked. Receipt photos are sent as taken and cannot be masked, so Tour Directors must not photograph documents that list guests.

The text tools use one provider at a time, OpenAI or Anthropic; receipt reading uses OpenAI, and in tour accounts also Anthropic. Under their standard API terms, they do not use data sent through the API to train their models. The AI cannot change your data or act for you, and our admin team can switch each AI feature off. The full list of AI features is in our Privacy Policy (section 7).

For school group tours:

• Students' names, rooms and dietary needs are entered by the Tour Director or Group Leader. Students do not enter dietary or medical details themselves.
• Students' names, rooms and notes are anonymised automatically 90 days after the tour ends.
• Only people the Tour Director gives a tour access code to can see student data.
• We do not send student data to AI on purpose; the AI gateway also replaces the tour's guest names in the text it sends.
• Students who join a photo challenge upload their own photos. These are deleted 90 days after the challenge closes, after 90 days without activity, or when the Tour Director deletes the challenge or their account. Photos are never sent to AI.

• Download your data: Tour Directors can download a copy of their account, tours and records as a file (JSON) from their profile.
• Delete your account: from your profile, at any time. We erase the account and anonymise your tours straight away; we keep billing records for 6 years, as tax rules require.
• Guests can delete their own registration in the guest app.
• Review your sign-ins: your profile shows your last 10 sign-ins with the date, time and part of the IP address.

The platform and its database run on IONOS servers in the United Kingdom, under UK data protection law. Data from the EU comes to the UK under the European Commission's adequacy decision for the UK. Some providers are outside the UK and EU, for example OpenAI and Anthropic in the United States. Our Privacy Policy (sections 8 and 9) lists each provider, what it receives, where it is, and the safeguards we rely on.