Privacy Policy

1. Data controller

2. Data we may process

• Browsing and analytics: pseudonymous visitor and session identifiers, pages viewed, referrer, language, approximate country, device, browser, operating system, screen size, interaction, scroll depth and external or affiliate clicks.
• Security data: cryptographically transformed IP address, user agent and technical records used to prevent abuse. Our private analytics does not retain the plain IP address.
• Contact form: name, email address, subject and message.
• PDF delivery: email address, requested guide, country, language, title, date and document link.
• Chatbot: your message, language, current page and temporary conversation context stored for the browser session. The query is currently processed by TourBookGo's local search and is not sent to external artificial intelligence providers. Please do not include personal data in the query.
• Telegram bot: your technical Telegram user and chat identifiers, chosen language, active or stopped status and the cities you choose to follow. TourBookGo does not receive your phone number through the bot.
• TourBookGo account: email address, password protected with a cryptographic hash, language, verification status, sessions, last activity, saved plans, favorites and comparison selection. Exact coordinates used to create a plan are not stored in the account.
• Marketing preferences: subscription state, date, source, accepted notice version and pseudonymised technical evidence. Marketing is optional and unchecked by default.
• Privacy preferences: accepted or rejected categories and the date of your choice.

TourBookGo does not request payment data or complete bookings. A booking is made directly on the selected third-party provider's website.

3. Purposes and legal grounds

We do not use contact messages, PDF requests or chatbot conversations to send email advertising without specific permission.

4. Providers and recipients

• Hostinger: web hosting, infrastructure and email.
• Telegram: messaging platform used only when you choose to open the bot. Telegram processes data on its platform under its own Privacy Policy.
• Microsoft Clarity: user-experience analytics, only with consent.
• Meta: advertising measurement through Meta Pixel, only with consent.
• GetYourGuide and other affiliate partners: external content and bookings when you consent to the relevant category or choose to follow a link.
• OpenStreetMap infrastructure: map delivery on pages that provide this feature.
• Google or Apple sign-in providers: only when you expressly choose one of these methods and it is enabled. We receive the identifier required to link access and, where provided, the verified email address.

We may also disclose information when required by law or by a valid request from a competent authority.

5. International transfers

Some providers, including Google, Microsoft, Meta, Telegram and international affiliate platforms, may process information outside the European Economic Area. Where applicable, transfers rely on adequacy decisions, Standard Contractual Clauses or other safeguards recognised under data-protection law. Please review each provider's policy for details.

6. Retention periods

• Privacy choices: 6 months.
• Private analytics events: automatically deleted after 365 days.
• Analytics visitor identifier: up to 395 days; session identifier: 30 minutes, only after analytics consent.
• PDF requests: up to 12 months, with automatic removal afterwards.
• Contact messages: as long as necessary to resolve the communication and meet legal responsibilities.
• Chatbot context stored in the browser: until the browser session ends.
• Telegram bot: while your alerts remain active. After you stop them, we retain the technical identifier, stopped status and preferences only as long as needed to honour the opt-out, prevent unintended messages and resolve incidents; you may request erasure.
• Saved plans: 12 months from creation.
• Synced favorites and comparison: while the account remains active.
• Account: while it is used. We plan to warn you at about 23 months of inactivity and may delete it after 24 months without activity.
• Marketing consent and opt-outs: evidence is retained as necessary to demonstrate consent, together with a minimal suppression record to honour opt-outs.

Information may be blocked and retained for longer where this is necessary to establish, exercise or defend legal claims.

7. Your rights

You may request access, rectification, erasure, restriction, objection and data portability where applicable. You may withdraw consent at any time without affecting processing that took place before withdrawal.

Contact info@tourbookgo.com and identify the right you wish to exercise. We will request additional information only where necessary to verify identity.

You may complain to the Estonian Data Protection Inspectorate or the competent supervisory authority in your country.

8. Children

TourBookGo is not intended for children acting without adult supervision and does not knowingly seek personal data from children. We may delete information submitted without valid authorisation.

9. Security and automated decisions

We use reasonable access controls, data minimisation, pseudonymisation and file protection. No internet-connected system can guarantee absolute security.

We do not make automated decisions that produce legal or similarly significant effects. The chatbot provides guidance and links but does not complete bookings.

10. Cookies and preferences

See our Cookie Policy. You can change or withdraw consent at any time through the “Privacy and cookies” button shown on every page.

11. Changes

We will update this page when our processing or providers change. Where a change requires new consent, we will ask for it again.

Last updated: 3 September 2026.