Privacy Policy

TourBNT (“we”) is the controller of the personal data described here. Contact: [email protected], 123 Travel Lane, Sydney, NSW 2000, Australia.

• Account data: name, email address, phone number, password (stored only as a one-way hash), profile picture and role.
• Booking data: the tour, date and number of travellers; the contact details you give; names and nationality of travellers; special requests; price and payment status. If you book as a guest we keep the contact details you enter.
• Messages and enquiries: what you send us, an Operator or a Provider through the contact form, enquiry form or inbox.
• Reviews and posts: ratings, comments and anything else you publish.
• Operators, Providers and advertisers: business details, documents you upload for approval, and payout bank details.
• Technical data: IP address, browser and device type, pages visited, and error logs, collected automatically for security, performance and to keep the site working.
• Approximate location, only if you allow it: if you choose “Show businesses near me”, your browser shares your location with the page. It is rounded to about 1 km, kept only for your browser session, and used once to find nearby destinations. We do not store it on our servers or in logs.

• To provide the service — create your account, take and manage bookings, send confirmations and receipts, enable messages with Operators (contract).
• To keep the platform safe — prevent fraud, abuse and spam, apply rate limits, investigate problems (legitimate interests).
• To improve the site — understand how it is used and fix errors (legitimate interests, or your consent for analytics cookies where required).
• To show relevant local ads — sponsored businesses are chosen from the tour, destination or search you are looking at, not from a profile of you (legitimate interests).
• To meet legal obligations — accounting, tax and responding to lawful requests.
• To send you news — only if you subscribe to the newsletter (consent), and you can unsubscribe in every email.

• The Operator and Providers of your trip, who need your booking details and contact information to deliver it. They are responsible for their own use of that data.
• Service providers that run the platform for us: cloud hosting; our database host (Neon); content delivery, security and file storage (Cloudflare); email delivery (Maileroo); and, where enabled, error monitoring, analytics, bot protection and payment processing. They may only use data to provide their service to us.
• Authorities where the law requires it, or to protect rights, safety and property.
• We do not sell your personal data.

Our servers and database are located in Asia-Pacific, and some providers process data in other countries. Where data leaves your country, we rely on safeguards such as contractual protections appropriate to the transfer.

We keep account data while your account is open. Booking, payment and invoice records are kept for as long as accounting and tax law requires, which is commonly several years. Messages and reviews are kept for as long as they are needed for the booking or the public review. Technical logs are kept for a short period. You can ask us to delete your account at any time; we will delete or anonymise what we are not required to keep.

Passwords are hashed, sign-in uses secure HTTP-only cookies, connections are encrypted, access to systems is limited, and we monitor for abuse. No online service is perfectly secure; tell us at once if you suspect a problem.

Depending on where you live, you can ask us to: give you a copy of your data; correct it; delete it; restrict or object to some processing; move it to another service; and withdraw consent you gave (for example for newsletters or analytics cookies). To use these rights email [email protected]. You may also complain to your local data-protection authority.

We use a small number of cookies and browser storage. See our Cookie Policy for details and how to change your choices.

The site is not for people under 18, and we do not knowingly collect their data. Parents or guardians may book on behalf of children and provide their details for the trip.

We may update this policy and will change the date above when we do. For important changes we will notify you on the site or by email.