---
title: "Privacy"
url: https://tourcockpit.com/privacy
lang: en
description: "What TourCockpit collects, where it is processed, who else touches it, and how to get it back or have it deleted. Written to be read rather than to be survived: the specifics are in it, including the region the database is in and every company we depend on."
---

# Privacy

What TourCockpit collects, where it is processed, who else touches it, and how to get it back or have it deleted. Written to be read rather than to be survived: the specifics are in it, including the region the database is in and every company we depend on.

## Who is responsible for what?

TourCockpit is operated by IdeaPlaces. For the data about your company and the people who sign in, we decide what is collected and why, so we are the controller. For the operational data your office puts into the product, above all the guests on your tours, your company decides what goes in and what it is used for, and we hold it and act on your instructions, so you are the controller and we are the processor.

In practice: a passenger name on a manifest belongs to the tour company that entered it. We do not use it for anything except running the product for that company.

## What is collected?

| Category | What it is | Why |
| --- | --- | --- |
| Account | Name, email address, role, the company and the language chosen | To sign a person in, decide what they may see, and write in their language |
| Credentials | A password hash (Argon2id, never the password) and the sessions a person has open | To sign in, and to end every other session when a password changes |
| Operational | Bookings, passengers, pickup times, hotels, vehicles, guides, tour operators, the notes an office writes | This is the product: the daily board, the manifests and the month-end settlement are built from it |
| Messages | The emails the product sends, stored with what was actually sent | So an office can answer "what exactly did this person receive" |
| Audit | Who changed what and when, inside a company | Because a booking that moved has to be explainable the next morning |
| Technical | Request logs with timings and error traces, for a short period | To find what is slow or broken |
| Usage | Which screens are opened, as product analytics | To see which parts of the product are used, never to profile a guest |

There is no advertising on TourCockpit, no advertising network in it, and nothing about a guest is sold or shared for anyone else's marketing. That is a property of the product, not a promise about intent.

## Which cookies does TourCockpit set?

Only what the product needs to work. No advertising cookies, no advertising network, and nothing that follows you to another site.

| Cookie | What it does |
| --- | --- |
| tp_session | Keeps you signed in. Without it there is no product |
| tp_co | Which company you are currently working in, so the right subdomain answers |
| tp_company | The company to offer first the next time you sign in |
| tp_view_as | Set while a manager is looking at the product as one of their own operators, so the app knows whose view it is showing |
| tp_invite_hint | Remembers that you closed the hint about inviting a colleague, so it stays closed |
| tp_theme | Light or dark, so the page does not flash the wrong one |
| tp_nav | Whether the sidebar is open or collapsed |
| locale | The language you chose, so every page keeps it |

The product also keeps four small things in the browser's own storage. These are never sent to us: they stay on your device and exist so the product does not repeat itself.

| What the browser keeps | Why |
| --- | --- |
| tp_learn | Whether you turned learn mode on |
| tp_inbox_toasted | Which notifications have already been shown to you once, so the same one does not pop up twice |
| tp_changelog_autoopened | That What's new has already opened itself for this release |
| tp_deployment_reload_at | When the page last reloaded itself after an update, so it cannot get stuck in a reload loop |

## Where is the data processed, and by whom?

The application and the database run on Microsoft Azure in Canada Central. That is where your bookings and passengers live. Canada is recognised by the European Commission as providing an adequate level of protection for personal data, which is what makes that transfer lawful for a company in the European Union.

These are every company we rely on to run the product. There are no others.

| Who | What they do for us | Where |
| --- | --- | --- |
| Microsoft Azure | Runs the application and the database; sends the product's email | Canada |
| Microsoft Azure OpenAI | Answers the in-product assistant's questions. It is sent the question and the help pages, never your bookings | United States |
| PostHog | Product analytics: which screens are used | United States |
| Meta (WhatsApp Business) | Delivers the WhatsApp messages a company chooses to send to its own operators and guests | United States and Ireland |
| Cloudflare | Domain name service and the network in front of the site | Global network |

For the transfers to the United States we rely on the European Commission's standard contractual clauses, which those providers offer as part of their terms.

## How long is it kept?

- Operational data is kept while your company uses TourCockpit. A booking is cancelled rather than erased, because the audit trail is what makes the day explainable, and it goes when the company's data goes.
- Your company's data is deleted within 30 days of the account closing, on request, or kept longer only where an invoice has to be kept for tax purposes.
- Request logs are kept for 30 days.
- Sign-in tokens are masked at rest the moment they are written, so a credential is never stored in readable form.

## What are my rights, and how do I use them?

If you are in the European Union or the United Kingdom, you can ask for a copy of your personal data, have it corrected, have it deleted, object to how it is used, or ask for it in a portable form. If you are in Canada, the equivalent rights under PIPEDA apply. If you are a guest whose name is on a tour manifest, the company that took your booking is the one that holds it: write to them, and if you write to us we will pass it on and help them answer.

Write to chip@tourcockpit.com with Privacy in the subject. We answer within 30 days. If we get it wrong, you may complain to your national data protection authority.

## How is the data protected?

- Two layers of isolation between companies. Every query is scoped to one company by the application, and the database refuses anything else underneath with row-level security, so a mistake in the first layer is still caught by the second.
- Passwords are hashed with Argon2id and never stored or logged in readable form.
- Everything travels encrypted over HTTPS, and the database is encrypted at rest.
- Every change is audited inside a company, with who did it and when.
- An API key acts only as what it is bound to: a company, or a single tour operator, and never more.

To report a vulnerability, see [/.well-known/security.txt](/.well-known/security.txt).

## How will I know if this page changes?

When what we do changes, this page changes with it in the same release, and the change is listed on the [What's new](/changelog) page. Last updated 12 September 2026.

This page is published in six languages. Where a translation and the English differ, the English version is the one that applies.