Draft — reviewed by no lawyer yet.
This page describes, as plainly and accurately as we can, what Tourbook actually does today. It is a starting point for a lawyer to review before real users rely on it — not legal advice, and not a finished policy.
Privacy policy
Last updated: 2 September 2026
Who is responsible for your data
Tourbook Agency, 28 rue Le Bua, 75020 Paris, France, is the data controller for Tourbook. For any question or request about your data, email antonio@tourbook.agency.
Who uses Tourbook
Four kinds of people interact with Tourbook, and each sees a different amount of it:
- Booking-agency staff (agents and managers) who sign in to the console.
- Tour managers and artists who open a private tour-book link, or sign in to a read-only portal.
- Promoters and venue/tech contacts who fill in a form at a one-time private link.
- Fans who read a public artist page.
What we collect, and why
Booking-agency staff
Your email address and role (agent or manager), tied to your account and your agency — so you can sign in and so the right people see the right data. Your password is handled entirely by Supabase, our authentication provider; Tourbook never sees or stores it in the clear.
Everything you enter to run the console: artist names, bios, links, and logos; show dates, cities, venues, and status; fees and other costs; tour-manager and van/travel notes; and any promoter or tech contact details you add while advancing a show. This is the core of the product, and we store it because your agency’s console does not work without it.
Legal basis: performing our contract with your agency.
Tour managers and artists
If you have a login (portal “manager” role), the same email and role fields as above apply to you. If you instead open a tour-book share link — a URL with a token in it, no login — we collect nothing from you at all. You see the shows and advancing details your agency’s staff have entered for that artist, which can include promoter or tech contact information.
Legal basis: performing our contract, for logged-in managers; our legitimate interest in giving a linked artist or tour manager visibility into their own tour, for link-only viewers.
Promoters and venue/tech contacts
When a booking agent asks a promoter to confirm show details, the promoter (or a venue’s tech contact) can fill in a form at a private, one-time link. That form can collect: venue name and address; load-in, soundcheck, doors, and show times; promoter name, phone, and email; tech contact name, phone, and email; hotel name, address, and notes; hospitality and parking notes; and any other free-text notes they choose to add. This is entered directly by the promoter or venue and sent to the booking agency to advance the show. It is never shown on any public page.
Legal basis: our and the agency’s legitimate interest in coordinating a live show between agency, promoter, and venue.
Fans
A fan reading a public artist page is not asked for anything, and we collect nothing from them beyond what any web page unavoidably generates: basic server logs (such as IP address, requested URL, and timestamp) created by Vercel, our hosting provider, as part of serving the page. We do not use these logs to track or profile visitors — they exist for security and for operating the service. The page itself shows only what the agency chose to publish: artist name, bio, links, logo, and confirmed show dates, cities, countries, venues, and ticket links.
Cookies
Tourbook sets one cookie: a session cookie from Supabase, our authentication provider, used to keep you signed in to the console or artist portal. It is strictly necessary — without it the app can’t tell you’re logged in — and it is not used for advertising or analytics.
As of this writing, Tourbook sets no advertising or analytics cookies, and runs no analytics or tracking scripts of any kind. If that ever changes, this page will be updated first. The public artist pages, the promoter form, and tour-book share links don’t set this cookie at all — they’re built to work without a login.
Who we share data with
We use a small number of service providers (subprocessors) to run Tourbook:
- Supabase — our database, authentication, and file-storage provider. Data is hosted in Supabase’s eu-west-3 (Paris) region.
- Vercel — hosts the application and serves it through its content delivery network.
- Google Workspace — runs our own business email (antonio@tourbook.agency). If you email us, that message is handled through Google Workspace.
- OpenStreetMap Nominatim — when a show is saved with a city and country, our server sends just that city and country text to Nominatim to look up map coordinates. No account or personal data is sent, and this request is made server-to-server, never from your browser.
We do not sell your data, and we do not share it with advertisers or data brokers.
Where your data lives
Your data is stored in Supabase’s eu-west-3 (Paris) region, inside the EU. Vercel, our hosting provider, runs a global content-delivery network, so the page you request may be served from a location outside the EU/EEA as part of how that network normally works — the underlying data itself stays in Supabase’s EU region.
Note for legal review: confirm whether Vercel’s request handling for this app counts as a transfer of personal data outside the EU/EEA that needs its own safeguards, and add any required wording.
How long we keep data
Tourbook doesn’t yet have an automated data-retention or deletion schedule. Your agency’s data is kept for as long as your agency’s account is active. A promoter form link keeps working until a booking agent accepts or rejects the submission, or until its expiry date passes (30 days by default) — after that the link stops working, but data already submitted stays attached to the show record it belongs to. If you want data deleted, email us and we’ll do it by hand.
Note for legal review: this product needs an explicit, written retention schedule before this section can be tightened.
Your rights
If GDPR applies to you, you have the right to access the data we hold about you, correct it, ask us to delete it, restrict or object to certain processing, and receive a copy of it in a portable format. To exercise any of these, email antonio@tourbook.agency. You also have the right to lodge a complaint with your national data protection authority — in France, the CNIL.
Children
Tourbook is a business tool for touring professionals. It isn’t directed at children, and we don’t knowingly collect data from anyone under 16.
Changes to this policy
We’ll update this page as the product changes, and update the date at the top when we do.
Note for legal review: once reviewed, add how existing users will be notified of material changes.
Contact
Tourbook Agency, 28 rue Le Bua, 75020 Paris, France — antonio@tourbook.agency