LEGAL

Privacy Policy

Last updated: 3 March 2026

This Privacy Policy explains how Tourium collects, uses, stores, and protects your personal information when you use our platform. We are committed to safeguarding your privacy and being transparent about our data practices.

Information We Collect

Personal Information

Name (first and last) and email address, provided during registration or OAuth sign-in.
Password (hashed and salted - we never store plain-text passwords).
Authentication data from third-party OAuth providers (such as Google), including your profile name and email.
Payment information processed securely by PayFast - we do not store your full card details.
Email interaction data (delivery status, open and click events) for transactional emails, collected via our email provider's webhooks.

Organisation Information

Organisation name, contact email, contact phone number, and type (Supplier, Agent, or both).
Headquarters address (country, city, street address, and postcode).
Brand details including name, website, social media links, and review platform URLs.
Property and service listings including descriptions, images, room types, amenities, and rate information.

Usage & Technical Data

Search queries, result counts, and execution times logged within your tenant workspace.
AI chat session history including messages and queries submitted to Touri Chat.
Document content (uploaded PDFs) processed for text extraction, embedding generation, and AI-powered search indexing.
Browser and device information, IP addresses, and page interaction data collected through cookies and error monitoring tools (Sentry).

How We Use Your Information

We use the information we collect for the following purposes:

To provide, operate, and maintain the Platform, including tenant provisioning, user authentication, and feature access.
To process payments, manage subscriptions, and administer usage-based billing through PayFast.
To enable AI-powered features including Touri Chat, document analysis, intelligent search, and embedding generation using OpenAI and Anthropic services.
To facilitate connections and communication between Suppliers and Agents, including contract distribution, document sharing, and messaging.
To send transactional emails including account verification, team invitations, contract notifications, and billing receipts.
To monitor Platform performance, diagnose issues, and improve service reliability through error tracking and analytics.
To enforce our Terms and Conditions and protect against fraudulent, unauthorised, or illegal activity.

Data Sharing & Third Parties

We share your data only as necessary to operate the Platform and provide our services:

PayFast - Payment and subscription data for billing processing. PayFast is subject to PayFast's privacy policy.
OpenAI & Anthropic - Document content and chat queries are sent for AI processing (embeddings, chat responses, analysis). These providers process data per their respective data processing agreements.
SignWell - Contract documents and signer information for electronic signature processing.
Resend - Recipient email addresses and email content for transactional email delivery and tracking.
Sentry - Technical error data, performance metrics, and limited user context for application monitoring and debugging.

We do not sell, rent, or trade your personal information to any third party for marketing purposes.

Data Storage & Security

Your data is stored on secure servers using PostgreSQL with a schema-per-tenant architecture, ensuring that each organisation's data is logically isolated from other tenants. Files and documents are stored in S3-compatible object storage with appropriate access controls.

We implement industry-standard security measures including encryption in transit (TLS/SSL), hashed passwords, CSRF protection, and input sanitisation. Access to production systems is restricted to authorised personnel.

While we take reasonable steps to protect your data, no method of transmission or storage is 100% secure. We cannot guarantee absolute security and encourage you to use strong, unique passwords and enable available security features.

Cookies & Tracking

We use cookies and similar technologies to operate the Platform:

Essential cookies - Required for authentication, session management, CSRF protection, and tenant identification. These cannot be disabled.
Functional cookies - Store your preferences such as theme (light/dark mode), language settings, and UI state.
Analytics & monitoring - Sentry collects performance and error data to help us maintain service reliability. This may include page load times and interaction traces.

You can manage cookie preferences through your browser settings. Disabling essential cookies may prevent the Platform from functioning correctly.

Your Rights

Depending on your jurisdiction, you may have the following rights regarding your personal data:

Right of access - Request a copy of the personal data we hold about you.
Right to rectification - Request correction of inaccurate or incomplete personal data.
Right to erasure - Request deletion of your personal data, subject to legal retention obligations.
Right to data portability - Request your data in a structured, machine-readable format.
Right to restrict processing - Request that we limit how we process your data in certain circumstances.
Right to object - Object to processing of your data for specific purposes.

To exercise any of these rights, contact us at [email protected]. We will respond to valid requests within 30 days. We may need to verify your identity before processing certain requests.

Data Retention

We retain your personal data for as long as your account is active or as needed to provide our services. If you delete your account, we will delete or anonymise your personal data within 30 days, except where we are required to retain it for legal, accounting, or regulatory purposes.

Aggregated, anonymised data that cannot be used to identify you may be retained indefinitely for analytics and service improvement purposes.

Children's Privacy

Tourium is a business-to-business platform and is not intended for use by individuals under the age of 18. We do not knowingly collect personal information from minors. If we become aware that we have inadvertently collected data from a minor, we will take steps to delete that information promptly.

Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements. Material changes will be communicated via email and/or a notice on the Platform at least 30 days before taking effect. The "Last updated" date at the top of this page indicates when the policy was last revised.

Contact Us

If you have questions or concerns about this Privacy Policy or our data practices, please contact us at:

[email protected]