Privacy policy

1. What this document covers

This Policy explains what personal data Tourricon collects, why, who it is shared with, how long it is kept and what rights you have. It applies to the website https://tourricon.app, the installable web app, the Tourricon mobile app and the Telegram bot @TourriconBot (together, the "Services") and forms part of the Terms of Use: https://tourricon.app/terms.

The data controller is Highland Haven LLC (ОсОО «Хайленд Хэйвен»), Kyrgyz Republic, 720040, Bishkek, Pervomaisky District, Logvinenko Street 55/239, INN 02508202610112 ("we", "us"). For any question about your data write to support@tourricon.app or call +996 505 900800.

We process data under the Law of the Kyrgyz Republic "On Personal Information". If you use the Services from another country, we also take its requirements into account where we can, for example the EU General Data Protection Regulation (GDPR).

The Services are intended for people over 18. We do not knowingly collect children's data; if you learn that a child has registered, write to us and we will delete the account.

2. What data we collect

We collect only what the Services need. Most of it you enter yourself.

• Account: email address, password (stored as an irreversible hash), first and last name, username, profile photo, phone number, a short "about me", chosen language, traveller / organizer mode, registration date.
• Google sign-in: the name, email address and profile photo that Google passes to us. We never receive your Google password.
• Telegram sign-in: your Telegram user ID, first and last name, username, profile photo and, only if you allow it, your phone number. We do not receive your contacts, chats or other Telegram data. If you have no email address, we create a technical one of the form tg<id>@users.tourricon.app; no email is sent to it.
• Telegram bot: the chat ID with the bot, whether it is connected and your notification settings, your answers to the bot's buttons (accept or reject a request, the reason for a rejection).
• WhatsApp sign-in: the phone number we send a one-time code to and the time of the sign-in. The code is kept only as an irreversible hash for no longer than two days and works for 10 minutes; to prevent abuse we keep a hash of the IP address the code was asked from. If the account has no email address, we create a service address like wa<number>@users.tourricon.app; no emails go to it.
• Organizer profile: company or personal name, type (private guide or company), region and city, description, logo, phone, WhatsApp, Telegram, website and social links, tours with their descriptions, photos, prices and dates.
• Booking requests: contact name and phone, optionally an email, the desired date, the number of participants, a comment, the request status and the cancellation reason.
• Reviews: the rating, the review text, the organizer's reply, reports about reviews.
• Likes (👍): which tours you liked and when. A tour shows only its total. The tours you liked make up «Want to go» on your traveller profile. You decide who sees it: only friends by default; if you open it to everyone, guests and organizers see it too. Nobody sees it until you first open the new profile and confirm these settings.
• Friends and trips together: friend requests and your friends list, blocks, the visibility settings of your profile's sections and of single tours, your city and profile cover, «I'll go with you», 👍 matches with friends, trips together (the tour, the preferred date, the seats, a note, the members and their status), friends' feed events, notifications on the site and reports about profiles.
• Contests: uploaded photos and their description, the place, a link to the post and your Instagram handle, your consent to the rules and the licence, your age confirmation, likes and comments, reports.
• eSIM: the chosen plan, the order number, the amount and currency, the payment mark, the provider's order ID, the ICCID and installation details (QR code, SM-DP+ address and activation code), the validity period, the email address for order messages.
• Support correspondence: the emails, messages and attachments you send us.
• Technical data: IP address and browser type in the logs of our hosting and content delivery network, request times, errors. We keep no visit logs of our own per user; the anonymous tour view counter is described in section 7.
• Administrator actions: a log of the changes our staff make (moderating tours and reviews, changing request statuses, blocking accounts), with who made them and when.

We do not collect data about race, religion, health or other special categories. If you tell an organizer about medical conditions relevant to a tour, that happens in your conversation with them.

3. Why we process data

• To run the Services: creating an account and signing in, the profile, the catalogue, sending requests to organizers and passing their answer to the traveller, reviews, contests, selling and issuing eSIMs — performance of our contract with you (the Terms of Use).
• To connect a traveller and an organizer: once a request is accepted, both receive each other's contact details for that request only — performance of the contract.
• To notify you about what matters: emails and Telegram messages about requests and their status, eSIM orders, account security and changes to the terms — performance of the contract and our legitimate interest in a predictable service.
• To send news and offers — only with your separate consent, which you can withdraw at any time.
• To moderate tours, reviews and contest entries, handle reports, prevent fraud and abuse, protect users' rights and our own — our legitimate interest and legal requirements.
• To keep accounting and tax records of paid orders — legal requirements.
• To understand how the site is used and improve it — our legitimate interest; the analytics are described in section 7 and use no cookies.
• To answer your requests — performance of the contract and legitimate interest.

4. Who we share data with

We do not sell personal data and do not pass it to advertising networks.

Other users. Public: your username, name and profile photo (in reviews, comments and contest entries), organizer profiles and tours with their contact details, reviews and replies, approved contest entries with the author's Instagram handle. A traveller's contact details from a request (name, phone, email, comment) are seen only by the organizer of the tour the request was sent to; the traveller sees the organizer's contacts on the tour page and once the request is accepted.

Your traveller profile opens at a link with your username: everyone sees your name, photo and cover. Tours done, «Want to go», trips ahead, reviews and your friends list are seen only by those you allow in the visibility settings (friends by default, reviews — everyone); any tour can be hidden. Friends see your city and «About me». Your phone, email and request contacts are never shown to other people; friends see the day of a trip ahead, everyone else only the month. The organizer of a tour sees the first names of the members of a trip together, but not their profiles or contacts: a request has one contact — the person who gathered the group.

Processors who handle data on our behalf and only as far as needed:

• Supabase (through the Lovable Cloud platform) — database, file storage, sign-in, server functions. Servers in the European Union and the United States.
• Cloudflare — content delivery network and site protection; sees the IP address and requests.
• Resend — email delivery (email confirmation, requests, eSIM orders, contests). United States.
• Telegram Messenger Inc. — Telegram sign-in and the bot's messages; processes data under its own policy.
• Meta Platforms Ireland Ltd. (WhatsApp Business) — sending the sign-in code to WhatsApp: receives the phone number and the message with the code; processes data under its own policy.
• Google LLC — Google sign-in; processes data under its own policy.
• TransitPay — the eSIM provider: receives the chosen plan and the order number, issues the eSIM and keeps its records; your phone number and name are not passed to it.
• PostHog (servers in the EU) — site usage analytics, only once enabled; see section 7.

Public authorities — only on a lawful request in the cases provided by the law of the Kyrgyz Republic.

A successor — in a reorganisation, sale or merger of the company, data may pass to the new owner of the Services on the same terms; we will notify you.

5. Cross-border transfers

Our processors' servers are outside the Kyrgyz Republic, in the European Union and the United States. By using the Services you consent to the cross-border transfer of your personal data to these processors. We choose processors whose protection of data is no weaker than the law of the Kyrgyz Republic requires, and we enter into data processing agreements with them. This consent and the list of processors are always available in this Policy.

6. Notifications and mailings

Service notifications (about requests, eSIM orders, account security, changes to the terms) are sent to your email and, if the bot is connected, to Telegram. You can turn them off in your profile settings; Telegram notifications also with the /stop command in the bot. Organizers need the connected bot to receive requests, so with notifications off they may miss one.

Marketing emails and messages are sent only with your separate consent. You can unsubscribe through the link in the email or in your profile settings. Emails about contests you take part in can be turned off through the "Unsubscribe" link in the email.

7. Cookies, local storage and analytics

We use no advertising or tracking cookies. For the site to work, the browser keeps data locally (localStorage): your sign-in session, the chosen language, catalogue display settings, marks of viewed collections and shown hints, service data of the installed web app. This data stays on your device, except for the sign-in session, which the browser sends to our server with every request.

PostHog analytics starts only once we configure a key and works without cookies: the identifier is kept locally, automatic capture of clicks and form contents is off, screen recording is off, and the browser's Do Not Track setting is respected. We see page views and events such as "opened a tour" or "sent a request" without form contents. You can block the analytics with Do Not Track or a blocker.

Tour view counter. To show popular tours ("Popular"), the site counts how many times a day a tour's page was opened and its card clicked. So that one person is not counted several times, the server keeps, for no longer than two days, an irreversible hash (SHA-256) of the IP address and browser type with a salt that changes every day and is deleted together with the hashes; the IP address itself is not stored. After that only the totals per tour per day remain, with no link to a person. An organizer's visits to their own tours are not counted. If Do Not Track or Global Privacy Control is on in the browser, the site sends nothing. Together with these numbers, requests and likes over the last 14 days, the site works out a tour's score and picks "Popular" by it; the score is not linked to any person.

Third-party services embedded in pages (for example maps or videos) may set their own cookies under their own rules; we try to load them only after your action.

8. How long we keep data

• Account and profile — while the account exists. You can delete the account in your profile settings at any time.
• Requests and reviews — while the account exists; after deletion closed requests are deleted, and reviews may stay in anonymised form (without name or photo) so that tour ratings stay reliable. You can ask us to delete those too.
• eSIM orders and payments — for the periods required by accounting law (as a rule 5 years), then deleted or anonymised.
• Contest entries — until the contest ends and the results are published; approved entries stay in the gallery until you delete them or the account; the licence for already published promotional materials is described in the Terms.
• Administrator log and reports — 3 years from the record.
• Emails and support correspondence — 3 years.
• Technical logs of hosting and the delivery network — up to 30 days.
• Database backups — up to 30 days, after which deleted data disappears from them too.

9. How we protect data

The connection to the site is encrypted (HTTPS, HSTS). Passwords are stored as hashes. Access to data in the database is limited by row-level rules: every user sees only their own data, an organizer the requests for their tours, administrators what moderation needs, and each of their actions is logged. Files are checked by type and size. Keys and secrets are kept apart from the code and are available only to responsible staff.

No protection is absolute. If a breach affecting your data occurs, we will notify you and the supervisory authority within the periods the law sets.

10. Your rights

You have the right to:

• learn what data about you we process and get a copy of it;
• correct your data — most fields can be changed in your profile yourself;
• delete your account and data — in your profile settings; an organizer must first close open requests so that travellers are not left without an answer;
• withdraw consent to mailings and notifications — in your profile settings, through the link in an email or with the /stop command in the bot;
• unlink Telegram or change your sign-in method — in your profile settings;
• object to processing based on legitimate interest and ask us to restrict it;
• receive your data in a machine-readable form where technically possible;
• lodge a complaint with the personal data protection authority of the Kyrgyz Republic (the State Agency for Personal Data Protection under the Cabinet of Ministers of the Kyrgyz Republic) or, if you are in the EU, with the supervisory authority of your country.

To exercise these rights write to support@tourricon.app from the email address linked to your account or from your linked Telegram. We reply within 14 days; in complex cases we will tell you about an extension.

11. Organizers' data and duties

An organizer receives travellers' contact details only to handle requests. They agree not to use them for mailings or other purposes, not to pass them to third parties and to delete them once the trip is over, unless the law requires otherwise. The organizer is responsible for the data they collect from travellers outside the Services (for example passport details for permits) and for its protection.

12. Changes to this Policy

We may change this Policy as the Services develop. We give advance notice of material changes (new purposes, new processors, new categories of recipients) with a banner on the site and, if notifications are on, by email or a Telegram message. The version date is shown at the top of the page. By continuing to use the Services after a change takes effect you accept the new version.

This Policy is published in Russian, English and Kyrgyz. In case of discrepancies the Russian version prevails.

13. Contact us

Highland Haven LLC (ОсОО «Хайленд Хэйвен»)
Logvinenko Street 55/239, Pervomaisky District, Bishkek 720040, Kyrgyz Republic
INN 02508202610112
Phone: +996 505 900800
Email: support@tourricon.app