SECURITY AND DATA
Written to be checked, not to reassure.
A tour plan is not innocuous data. It says where a named group of people will be, and at what time, for several days running. Here are the answers in the plain form a security reviewer wants, including the one place where the answer is no.
Where does the data live?
In the European Union. The application database runs in Google Cloud europe-west1, in Belgium, and backups stay in the same region. Every sub-processor and the transfer safeguard for each is named in our Data Processing Agreement.
Who can see a tour?
Only the account that owns it, the tour managers the owner has added to it, and whoever holds a valid driver link. Separation between accounts is enforced on the server by database security rules rather than by the interface, so it cannot be worked around by manipulating the app in a browser.
How are driver links protected?
A driver link on its own shows nothing. The driver enters a PIN, which a rate-limited server function verifies before issuing a short-lived credential scoped to that one tour. Links expire after the tour’s last dated day, and revoking one ends any session already open on a driver’s phone within about an hour, when its short-lived credential next refreshes.
Do you keep a record of driver PIN entries?
Yes. When someone enters a PIN on a driver link, we record the time, the result (PIN accepted, wrong PIN, locked after too many wrong PINs, link expired, no PIN set), the name of the link, a shortened IP address (/24 for IPv4, /48 for IPv6) and the browser and operating system. We never record the PIN, the link itself or the full IP address. Repeated attempts during a temporary lock, malformed requests, unknown links and requests blocked by rate limiting are not recorded one by one. The account owner and its administrators can see the log in the app, and each entry is deleted automatically after about 90 days. A driver who is already signed in is not recorded again each time they look at the tour; the log covers PIN entries, which is how access is granted.
How do people sign in?
Guides sign in with Google or an emailed sign-in link. Tour managers open a personal link and enter a six-digit PIN, which gives them a session scoped to the tours they were added to. The PIN is stored only as a hash, wrong guesses lock the link for increasing periods, and the guide can replace or disable it at any time. We store no passwords at all, so there are none to lose. Sessions can be revoked centrally.
How long is data kept?
Operational logs for 30 days. The driver PIN log for about 90 days. Database backups for 30 days, with point-in-time recovery for 7. A limited set of infrastructure audit logs is held by our cloud provider for up to 400 days and cannot be shortened, which is why we say operational logs rather than all logs. Billing records are kept for 7 years because Dutch tax law requires it.
Can we get our data out?
Yes, whenever you like, without asking us. Any tour exports to a spreadsheet from inside the app and imports back the same way. There is no lock-in mechanism and no export fee.
Can we get our data deleted?
Yes, and you do it yourself. Deleting an account withdraws every access immediately, cancels the subscription, and destroys share links and PINs. The account and its content are irreversibly erased after a 30-day recovery window, after which we keep only a dated record that the erasure happened, holding no personal data.
Is there a DPA?
Yes, and it is published in full rather than promised on request. It carries the Article 28 terms, the processing details, our technical and organisational measures and the sub-processor list. If you need a countersigned copy, ask.
What about cookies and tracking?
Strictly necessary cookies and local storage only, to keep you signed in and to work offline. No advertising, no third-party tracking, and no consent banner, because there is nothing here that requires consent.
A question this page does not answer, or something your procurement team needs in writing? Ask directly. The answer comes from the person who wrote the software.