---
title: "Privacy"
url: https://tourcockpit.com/privacy
lang: en
description: "What TourCockpit collects, where it is processed, who else touches it, and how to get it back or have it deleted. Written to be read rather than to be survived: the specifics are in it, including the region the database is in and every company we depend on."
---

# Privacy

What TourCockpit collects, where it is processed, who else touches it, and how to get it back or have it deleted. Written to be read rather than to be survived: the specifics are in it, including the region the database is in and every company we depend on.

## Who is responsible for what?

TourCockpit is operated by IdeaPlaces. For the data about your company and the people who sign in, we decide what is collected and why, so we are the controller. For the operational data your office puts into the product, above all the guests on your tours, your company decides what goes in and what it is used for, and we hold it and act on your instructions, so you are the controller and we are the processor.

In practice: a passenger name on a manifest belongs to the tour company that entered it. We do not use it for anything except running the product for that company.

## What is collected?

| Category | What it is | Why |
| --- | --- | --- |
| Account | Name, email address, role, the company, the language the person chose and when they chose it, which notifications they receive at each company they work for and how each reaches them, the way they last sent the day's board out: the file, the days, and which of their own colleagues it went to, and, at a reseller's desk, whether they have already seen or closed the invitation to bring in their colleagues | To sign a person in, decide what they may see, write in their language, open the Export sheet as they left it, and not ask a desk again what it has already answered |
| Credentials | A password hash (Argon2id, never the password), the time somebody last signed in with Google where that is how they sign in, the day a person first came in, and the sessions a person has open | To sign in, to know an invitation has been taken up so the reminders stop, and to end every other session when a password changes |
| Operational | Bookings, passengers, pickup times, hotels, vehicles, guides, tour operators, the notes an office writes | This is the product: the daily board, the manifests and the month-end settlement are built from it |
| Messages | The emails the product sends, stored as written, and each WhatsApp message it sends, as the message and the words filled into it. In the copy that goes out, each link passes through TourCockpit and a one-pixel image is added, so we record when the person opened the email, which links they clicked, and the name their browser or mail program gives | So an office can answer "what exactly did this person receive", and so we can tell which emails are read and which links are used |
| Faro conversations | What somebody asked Faro and what it answered, kept with the company's own data. Beside an answer that drew a piece of the board, a day, a departure or one booking, the lines that piece was drawn from are kept with it: the guests, the rooms, the phone numbers and the cash as they stood at that moment, and nothing the person asking could not already see. They are read back only when someone reviews that conversation: an owner of the company, for the office's own conversations and never for a reseller desk's, or TourCockpit's own staff, who may read any of them and play back the sound of their calls, every play and download recorded under the name of the person who made it | So a wrong answer can be explained from what the person was actually shown, and not only from what Faro said about it |
| WhatsApp chats | Every WhatsApp message between the product's number and the people of a company who use it, in both directions: what was written, who wrote it (the person, Faro, or the product itself), when, and whether it arrived and was read. Kept with the company's own data and never cleared on its own. The chats of the company's office are read back only by the person whose chat it is and by an owner of the company | So an office can see what its people asked on WhatsApp and what they were told, and whether a message reached them |
| Audit | Who changed what and when, inside a company | Because a booking that moved has to be explainable the next morning |
| Technical | Request logs with timings and error traces, for a short period. A message sent to the product's own WhatsApp number from a number no account carries is not answered at all, and leaves one line holding that number, what kind of message it was and how long it was | To find what is slow or broken, and to be able to say who wrote to a number nobody at the company recognises |
| Usage | Which screens are opened and where clicks go, and on the board the searches asked (how many guests, which language, which pickup place) and how long a booking takes, as product analytics, linked to the person's internal account number, their company, their role and their desk. Never their name or email address, and the text on what they click is masked | To see which parts of the product are used and by whom (the office or a desk), and where people struggle, never to profile a guest |

There is no advertising on TourCockpit, no advertising network in it, and nothing about a guest is sold or shared for anyone else's marketing. That is a property of the product, not a promise about intent.

## Which cookies does TourCockpit set?

Only what the product needs to work. No advertising cookies, no advertising network, and nothing that follows you to another site.

| Cookie | What it does |
| --- | --- |
| tp_session | Keeps you signed in. Without it there is no product |
| tp_co | Which company you are currently working in, so the right subdomain answers |
| tp_company | The company to offer first the next time you sign in |
| tp_view_as | Set while a manager is looking at the product as one of their own operators, so the app knows whose view it is showing |
| tp_oauth_req | Set for ten minutes while you connect an app such as Claude or ChatGPT to TourCockpit. It holds the request you are asked to allow, so the screen shows exactly what the app asked for |
| tp_google | Set for ten minutes while you sign in with Google, where that is offered. It ties Google's answer to this browser, so a sign-in started somewhere else cannot finish in yours |
| tp_theme | Light or dark, so the page does not flash the wrong one |
| tp_nav | Whether the sidebar is open or collapsed |
| tp_faro | Whether you have Faro, so the page keeps room for its rail instead of jumping once it loads |
| locale | The language you chose, so every page keeps it |
| locale_at | Who chose the language in this browser, and when, so a newer choice you make on another device wins here too |
| tp_tz | Your time zone, as your browser reports it, so a time on the screen is said on your own clock |

The product also keeps a few small things in the browser's own storage. These are never sent to us: they stay on your device and exist so the product does not repeat itself.

| What the browser keeps | Why |
| --- | --- |
| tp_learn | Whether you turned learn mode on |
| tp_inbox_toasted | Which notifications have already been shown to you once, so the same one does not pop up twice |
| tp_deployment_reload_at | When the page last reloaded itself after an update, so it cannot get stuck in a reload loop |
| tp_install_dismissed_at | When you last closed the banner that offers to add the app to your home screen, so it stays away for three days, or that the app is installed, so it stays away for good |
| tp_launch_recorded | That this visit was already counted as opened from the home screen or from the browser, so it is counted once |
| tc.gridView.planning | Whether you last read Tour planning by week or by month, so a visit opens the way you left it |
| tc.gridView.availability | The same for Driver Availability |
| tp_history_layout | Whether you last read a day's History by departure or by time |
| assistant:open | Whether Faro's panel is open |
| assistant:width | How wide you dragged Faro's panel |

## Where is the data processed, and by whom?

The application and the database run on Microsoft Azure in Canada Central. That is where your bookings and passengers live. Canada is recognised by the European Commission as providing an adequate level of protection for personal data, which is what makes that transfer lawful for a company in the European Union.

These are every company your data can reach through the product, and there are no others. All but the last are companies we rely on to run it. The last is an app one of your own people connects, so nothing reaches it unless they do.

| Who | What they do, and what they are sent | Where |
| --- | --- | --- |
| Microsoft Azure | Runs the application and the database; sends the product's email; holds a copy of every board an office exports for twelve months, so the record of what was downloaded or sent can show which file it was; holds the sound of a call to Faro for 120 days, in private storage, so that the person who made the call, the owner of their company and TourCockpit's own staff can play it back. Its speech service is also the ear and the voice of a call to Faro: your voice is sent to it as you speak, it turns what you said into words, and it speaks the answer back in the voice of your own language. The words it heard are then answered the way a typed question is, in the row below | Canada |
| Microsoft Azure OpenAI | Answers Faro, the in-product assistant. It is sent your question, the conversation that question belongs to, and the help pages, and, when Faro looks something up for you, the bookings and reference data your own account is already allowed to see, in your company only. When you ask who changed something, it is sent that record's own history as well: what moved, from what to what, when, and the name of the colleague, or of the person at a reseller's desk, who made each change. That is the same history the product shows you on the record itself, and never more of it than you may see there. A question typed in Faro's panel also carries a picture of the screen you asked it from, so Faro can see what you mean; that picture is sent with the question and never stored. A picture you hand it, pasted, dropped, chosen or sent as a photo on WhatsApp, is sent with the question and never stored either. No picture is kept, but a line or two of what one showed is: Faro writes down the facts it read off it, the day, the tour, the names and the numbers, because the picture is gone by the next question and the next question is usually about it. That line is kept with the conversation it belongs to, and is held exactly as the rest of that conversation is. A voice note you record on WhatsApp instead of typing, or a sound clip you forward to it, is sent to be turned into words so that the question can be answered; the recording itself is not stored. When a question points at something you asked before, it is sent an extract of your own earlier conversations, yours alone and none older than 90 days, and a few counted lines about how you use the product, such as the screens you ask from most. On a call it is sent the words of each question, once the speech service above has heard them, exactly as a typed question is sent; your voice itself is not sent to it, and the sound of the call is kept for 120 days as the row above says. It also writes the other languages of the text your own office types for resellers and guests to read: a child seat's description, and a tour's name, its description and the details a reseller reads on the tour. Those words are sent with your company's other tour names as context, so a place name is not translated away, and the answer is written back into your company's languages. No booking, no guest and no passenger is sent to have text translated | United States for text, which includes the words of a question asked out loud on a call; Canada for the sound of a call, its recording and a voice note |
| PostHog | Product analytics: which screens are opened and where clicks go, and on the board the searches asked and how long a booking takes, each tied to the person's internal account number, their company, their role and, at a reseller's desk, their desk. Never their name or email address, and the text of what they click is masked | United States |
| Meta (WhatsApp Business) | Delivers the WhatsApp messages a company chooses to send to its own operators and guests, the notices each person chooses to receive on WhatsApp rather than by email on their own profile, and the day's board itself when an office sends it that way to its own guides and drivers, or to an owner or manager who asked for tomorrow's board every evening. It also carries a call made to TourCockpit from the WhatsApp chat, the one Faro answers: the voices on that call travel over WhatsApp, as on any WhatsApp call. What Faro answers somebody in their own WhatsApp chat travels the same way, whether they typed the question or asked it out loud on the call, and so does a day's board they ask it to send them: a long answer goes as a few messages, or as one text file when it would take more than a few, and that answer carries whatever they asked about, a list of bookings with its guests among it | United States and Ireland |
| Stripe | Bills the subscription: the monthly invoice and the payment for it. It is sent your company's billing details, and one number for each day, the value of the bookings the platform took for you, which its meter adds into the usage line of that month's invoice. No booking, no guest and no passenger is ever sent to it | United States and Ireland |
| Cloudflare | Domain name service and the network in front of the site | Global network |
| Discord | Tells our own team when somebody who is signed in opens an address in TourCockpit that does not exist, so a broken link is found and fixed. It is sent that address, the page of TourCockpit they came from, when it happened, and the person's name, role and company. Nothing about your bookings, guests or passengers is sent to it | United States |
| Google | Signs a person in when they press Continue with Google instead of using a password: their browser signs in at Google, and Google tells TourCockpit only the address that account carries and whether it has verified it, so Google knows that the address signed in here, and when. It also hosts TourCockpit's own mailboxes, so a reply to any email TourCockpit sends reaches it, and so do a message sent from the contact page and a question somebody passes from Faro to a person, with the conversation it came from | The United States |
| An app you connect yourself (Claude, ChatGPT) | Nothing, until somebody in your office connects one, which they do from inside that app by signing in here and allowing it. The app then works as that person: it is sent whatever they ask it for, which is the same bookings, reference data and change history their own account may already see, and their own earlier conversations with Faro when they ask about one, in your company only, and a day's board with its guests' names and rooms when they ask for one. Those answers stay in their conversation with the app, held by the company that runs it under that person's own agreement with it rather than ours. Nothing is ever changed without the app showing them first and waiting for their yes. Disconnect on My profile stops it at once, and so does switching that person's account off. Your own office does not have to wait for either: a manager or an owner ends any app connected to your company from the Company screen, it stays out of your company even if that person connects it again, and only your office can let it back in | The United States, for Claude and ChatGPT |

For the transfers to the United States we rely on the European Commission's standard contractual clauses, which those providers offer as part of their terms. An app one of your own people connects is not one of those transfers: they agreed that company's terms themselves when they signed up to it, and we are not a party to them. Nor is a sign-in with Google, which is somebody's own Google account, used at Google, under the agreement they already have with it.

## How long is it kept?

- Operational data is kept while your company uses TourCockpit. A booking is cancelled rather than erased, because the audit trail is what makes the day explainable, and it goes when the company's data goes.
- Your company's data is deleted within 30 days of the account closing, on request, or kept longer only where an invoice has to be kept for tax purposes.
- A day's board that was exported, as the PDF, spreadsheet or picture an office downloaded, emailed or sent on WhatsApp to its own people, is kept for twelve months so the record can show exactly which file someone had. Only the person who exported it and the company's owners can open it again.
- The sound of a call to Faro, made in the app or over WhatsApp, is kept for 120 days and then deleted, so a call can be played back while it still matters. A call during which the caller moved to another company is cut where they moved, and each company keeps only the time spent in it, so no company holds another's part of the call. In the rare call where that cut cannot be made exactly, none of its sound is kept. The written record of what was said on it is operational data, and goes when your company's data goes.
- Request logs are kept for 30 days.
- Sign-in tokens are masked at rest the moment they are written, so a credential is never stored in readable form.

## What are my rights, and how do I use them?

If you are in the European Union or the United Kingdom, you can ask for a copy of your personal data, have it corrected, have it deleted, object to how it is used, or ask for it in a portable form. If you are in Canada, the equivalent rights under PIPEDA apply. If you are a guest whose name is on a tour manifest, the company that took your booking is the one that holds it: write to them, and if you write to us we will pass it on and help them answer.

Write to chip@tourcockpit.com with Privacy in the subject. We answer within 30 days. If we get it wrong, you may complain to your national data protection authority.

## How is the data protected?

- Two layers of isolation between companies. Every query is scoped to one company by the application, and the database refuses anything else underneath with row-level security, so a mistake in the first layer is still caught by the second.
- Passwords are hashed with Argon2id and never stored or logged in readable form.
- Everything travels encrypted over HTTPS, and the database is encrypted at rest.
- Changes to bookings, departures and reference data are audited inside a company, with who did it and when.
- An API key acts only as what it is bound to: a company, or a single tour operator, and never more.

To report a vulnerability, see [/.well-known/security.txt](/.well-known/security.txt).

## How will I know if this page changes?

When what we do changes, this page changes with it in the same release, and the change is listed on the [What's new](/whats-new) page.

Last updated 20 October 2026.

This page is published in seven languages. Where a translation and the English differ, the English version is the one that applies.