Version: October 2026
TOURtoDO is a service of InQbator Internet BV. We handle personal data with care and comply with the General Data Protection Regulation (GDPR). This privacy statement explains which data we process, why, with whom we share it and which rights you have.
We do not sell personal data, show no advertisements and use no tracking or analytics services.
1. Who is responsible?
InQbator Internet BV is responsible for processing the data of account holders (tour creators), payments and contact requests.
When you play a tour in the app, the organiser of that tour decides which data is requested. The organiser is then responsible, and we process the data on their behalf under our processing agreement.
2. Which data do we process?
Tour creators (account)
- First and last name and email address
- Password (stored only in hashed form) and, if you set them up, two-factor authentication or passkeys
- Login data such as the time of your last login, your IP address and browser
- The tours, texts, images and other media you create or upload
Billing
- Company or personal name, billing address, invoice email address, Chamber of Commerce number and VAT number
- Subscription, payments and invoices. Bank and card details are processed by Mollie; we do not store them.
Players (app)
- A random app ID created at installation. Players do not need an account.
- A team or player name, if the organiser asks for it
- Answers, scores, start and finish times, and photos, drawings, audio and video recordings you make during a tour
- Name and email address, if you have a certificate sent to you
The app uses your location (GPS) only on your own device to check whether you have reached a tour point. We do not receive or store your coordinates. The camera, microphone and photo library are only used when you grant permission in the app and a part asks for it.
Contact
- Your message and, if you provide it, your email address
3. What do we use this data for?
- Providing the service: your account, creating and playing tours and showing results to the organiser (performance of the contract).
- Invoicing and our bookkeeping (legal obligation).
- Service emails, such as invitations, certificates and messages about your subscription (performance of the contract).
- Security and preventing abuse (legitimate interest).
- Answering your questions (legitimate interest).
We do not send newsletters or advertising.
4. Who do we share data with?
We only share data with service providers we need to deliver TOURtoDO. We have agreements with these parties about protecting your data.
- OVHcloud: Hosting of the website, the database and stored files (S3 storage) in data centres in the EU (France).
- Mollie B.V.: Payment processing (the Netherlands).
- Moneybird B.V.: Invoicing and bookkeeping (the Netherlands).
- Proton AG: Sending and receiving email (Switzerland, a country with an adequate level of protection according to the European Commission).
- OpenAI: Only when you use the AI assistant: your instruction and the relevant tour content are processed to produce an answer or image. OpenAI is based in the United States; transfers are based on the EU-US Data Privacy Framework and standard contractual clauses. We plan to switch to a European provider.
- OpenStreetMap Foundation: Maps in the app and address search in the tour builder. OpenStreetMap receives your IP address, the displayed map area and the search term (United Kingdom, adequate level of protection).
- YouTube (Google): Only when a tour contains a YouTube video: the video is loaded directly by YouTube.
Therefore, do not include personal data in instructions to the AI assistant unless necessary.
5. Cookies
We only use functional cookies required for the website to work: a session cookie, a security token, your language choice and, if you choose it, "stay logged in". We do not use analytics or tracking cookies.
6. How long do we keep data?
- Account data and tours: as long as your account exists. When you delete your account, we also delete your tours, the related media and the player data.
- Player data: as long as the tour exists. If the organiser deletes the tour, the related player data is deleted as well. If you are a player and want your data deleted, contact the organiser or us.
- Invoices and payment data: 7 years, due to the statutory tax retention period.
- AI assistant log: 180 days.
- Contact requests: as long as needed to handle your question.
Data in the app (such as progress and photos) is stored on your own device. You remove it by removing a tour from your history or uninstalling the app.
7. Security
We take appropriate measures to protect your data. Connections are encrypted (HTTPS), passwords are stored only in hashed form, billing details are stored encrypted and player media can only be viewed through temporary, secured links. You can further protect your account with two-factor authentication or a passkey.
8. Your rights
You have the right to access, correct, delete or transfer your data, and to object to or request restriction of processing. As an account holder you can download your data and delete your account via Account > Data. For other requests, email info@tourtodo.com. We respond within one month.
If you are not satisfied with how we handle your data, you can file a complaint with the Dutch Data Protection Authority.
9. Changes
We may update this privacy statement. We will inform account holders by email of important changes.
10. Contact
InQbator Internet BV
Vossenlaan 191
6531 SH Nijmegen
info@tourtodo.com