Privacy Policy

When you create a Tourbook account and use the service, we collect:

• Account info: email address and a hashed password (handled by our authentication provider, Supabase). We never see your password in plain text.
• Tour data: shows, dates, venues, guarantees, expenses, merch sales, personnel records, payouts, account balances, notes — everything you choose to log.
• Uploaded documents: files you upload (W9s, contracts, EPK, etc.), stored in encrypted object storage.
• Payment info: when you subscribe, we use Stripe to handle payment. We never store card numbers — Stripe handles that directly. We receive a customer ID and subscription status from Stripe.
• Email content: if you use the email-to-promoter feature, the messages you send (and any attachments) pass through our email provider, Resend.
• AI feature inputs:if you choose to use one of Tourbook's optional AI features, the specific data that feature needs — a receipt image, a question you type and the tour data needed to answer it, an advance-email context, a settlement description, or prepared settlement statistics — is sent to our AI provider to generate a suggestion. See AI features below for details.
• Standard server logs: IP address, browser type, pages visited, and error reports — used for debugging and security.

• To provide the core Tourbook service (storing your data, computing your P&L, sending emails on your behalf).
• To process subscription payments and manage billing.
• To communicate with you about your account (confirmations, payment receipts, trial notices, important service updates).
• To detect, prevent, and respond to fraud, abuse, or technical issues.

We do not sell your data. We do not use your tour data for marketing or share it with advertisers.

We share data only with the service providers that make Tourbook work:

• Supabase — authentication, database, and file storage.
• Vercel — application hosting.
• Stripe — payment processing.
• Resend — outbound email (auth confirmations, promoter messages).
• Anthropic— the AI provider that powers Tourbook's optional AI features. Data is sent to Anthropic only when you actively use one of those features. See AI features below.

Each of these providers has their own privacy practices and is contractually obligated to protect your data. We do not share data with any other third parties unless required by law.

Tourbook offers several optional AI features that generate suggestions to save you time — scanning receipts, answering questions about your tours, drafting advance emails, reading a plain-English settlement description, and flagging possible anomalies after a settlement. These features are powered by our AI provider, Anthropic, which acts as a data processor on our behalf.

When — and only when — you actively use one of these features, Tourbook sends the specific data that feature needs to Anthropic to generate the suggestion:

• Receipt scan: a downscaled image of the receipt you upload.
• Ask about your tours: the question you type, plus the portions of your own tour and financial data needed to answer it (limited to tours you already have access to).
• Advance-email drafts: the show and tour context used to draft the email.
• Settlement description: the sentence or two you write describing the night's numbers.
• Anomaly flags: prepared summary statistics about the settlement (not your raw records).

A few things we want to be clear about:

• Server-side only. All AI calls are made from our servers. Our AI provider API key never reaches your browser, and your device does not talk to Anthropic directly.
• Optional, always. Every AI feature has a manual equivalent. You can use Tourbook fully without ever invoking AI, and if an AI call fails the feature falls back to the manual flow.
• Suggestion-only. AI output is a suggestion. Nothing is saved to your tour until you review it and tap to confirm.
• Not for training. We do not use your data to train AI models, and under Anthropic's commercial terms of service, Anthropic may not train models on customer content submitted through its API.

Anthropic processes this data only to return the suggestion, acting as a data processor under a data processing addendum incorporated into its commercial terms. Per Anthropic's published data-retention policy, API inputs and outputs are automatically deleted from its systems within 30 days, except where content is flagged for abuse (retained up to 2 years) or retention is required by law. Contact us if you need current specifics for your own compliance review.

If you invite collaborators to a tour (band members, tour manager), they will have access to the data on that tour according to their assigned role (owner, editor, or viewer). You control who gets invited and at what permission level. Owners can remove collaborators at any time from the tour Settings page.

We keep your data while your account is active. Archived tours are kept for 30 days before permanent deletion. If you cancel your subscription, your data is preserved and read-only — you can reactivate anytime and pick up where you left off. If you delete your account, we permanently remove your tours, documents, and account data within 30 days, except where retention is required by law (e.g., financial records for tax purposes).

You can:

• Access and export your data — every tour has a CSV export.
• Update any account info or tour data from inside the app.
• Delete tours, documents, or your entire account at any time.
• Request a copy of all data we hold about you by emailing us.

If you're in California, the EU, the UK, or another jurisdiction with specific privacy rights (CCPA, GDPR, etc.), those rights apply in full. Contact us to exercise them.

We protect your data with industry-standard practices: TLS for data in transit, encryption at rest, row-level security on all multi-user data, and isolated storage for sensitive documents. No system is 100% secure, but we take this seriously and respond quickly to any vulnerability disclosure.

Tourbook is not directed to anyone under 13. We do not knowingly collect data from children under 13.

We'll update this policy when our practices change. The “Last updated” date at the top reflects the most recent change. For material changes, we'll notify you by email.

Questions, requests, or concerns? Email support@tourbook.band.