Privacy Policy

1. Who we are

TourTide ("TourTide", "we", "us", "our") is operated by Noxidsoft (ABN 74 421 798 989) at tourtide.com.au. We provide guest journey automation tools to Tasmanian boutique tour operators.

Our platform enables subscriber businesses ("Operators") to manage bookings, automate guest communications, collect payments, and maintain itineraries and run sheets for their own experiences.

TourTide operates in two capacities:

• As a data controller: for personal information we collect directly from Operators and their staff who register and use the platform (account data, subscription information).
• As a data processor on behalf of Operators: for personal information that Operators collect from their own guests through our booking, dietary confirmation, and itinerary tools (guest names, contact details, dietary and emergency contact information). Operators are responsible for their own obligations to those guests under the Privacy Act.

2. What personal information we collect

2.1 Operator and account data

When an Operator registers and uses TourTide, we collect:

• Business name, contact name, email, and phone number
• Owner, admin, and guide user names, email addresses, and passwords (stored as bcrypt hashes — we never store plaintext passwords)
• Subscription and billing details (processed by Stripe — see section 5)
• IP addresses and browser/device information collected in server logs

2.2 Experience and booking content

Experience names, descriptions, gear lists, pricing, and booking records (departure dates, PAX counts, payment status) that Operators enter to run their business.

2.3 Guest data

Operators use TourTide to collect information from their own guests in connection with a booking. This data, stored on behalf of the Operator, may include:

• Guest name, email address, and mobile number
• Pickup location and time
• Dietary requirements and allergy information, submitted by the guest via a token-secured public form or entered by the Operator
• Emergency contact name and phone number

TourTide stores this data as a processor on behalf of the Operator. Operators bear responsibility for their own duty-of-care and privacy obligations to their guests — see section 6 of our Terms of Service.

2.4 Past guest data (CSV import)

Operators may import a list of past guests (name, email, experience, and travel date) to enable post-trip re-engagement sequences. This is treated the same as guest data described in section 2.3.

3. How we collect personal information

We collect personal information:

• Directly from you when you register, create a booking, or contact us
• From Operator staff when they add a guest to a booking
• From guests directly who complete a dietary confirmation form via a token-secured public link (no TourTide account required)
• Automatically via server logs, which record IP addresses and request metadata for security and operational purposes
• From Stripe — confirmation of payment events (we receive confirmation of successful payment; full card data is handled exclusively by Stripe and never passes through our servers)

We collect personal information only by lawful and fair means, and not in an unreasonably intrusive way.

4. Why we collect and use personal information

We collect and use personal information for the following purposes:

• Providing and operating the TourTide platform and its five modules
• Processing subscription and guest payments via Stripe
• Sending automated transactional email — pre-arrival sequences, balance reminders, post-trip follow-ups, account confirmations, and receipts
• Generating itineraries and guide run sheets on behalf of Operators
• Responding to support requests via the in-app Support & Feedback hub
• Improving the platform (aggregated, anonymised analytics only)
• Complying with our legal obligations, including under the Privacy Act

We will not use or disclose personal information for a secondary purpose unless: (a) the individual would reasonably expect us to; (b) we have consent; or (c) we are required or authorised by law.

5. Disclosure to third parties

We do not sell, rent, or trade personal information. We may disclose personal information to:

5.1 Infrastructure and service providers

• Akamai Technologies (Sydney, ap-southeast-2): Our hosting provider. All application data is stored on Akamai infrastructure located in Sydney, Australia.
• Stripe Inc.: Payment processing for both Operator subscriptions and guest deposit/balance payments. Stripe receives billing information necessary to process payments. Stripe is PCI DSS Level 1 certified. Charges are processed under the merchant name Noxidsoft. See Stripe's Privacy Policy.
• SMTP2GO: Our transactional email delivery provider, used to send account, booking, and guest communication emails. Email content may include guest names and booking details.

5.2 Legal and regulatory disclosure

We may disclose personal information where required or authorised by Australian law, including:

• In response to a valid court order, subpoena, or regulatory request
• To prevent, detect, or investigate suspected fraud, illegal activity, or a threat to safety

5.3 Business transfers

If TourTide is acquired, merged, or its assets transferred, personal information may form part of the transferred assets. We will notify affected users of any such transfer and the new entity's privacy policy before any change in data handling occurs.

5.4 No overseas disclosure

We do not disclose personal information to overseas recipients as a matter of ordinary practice. All infrastructure and data storage is located in Australia (see section 6). In the unlikely event an overseas disclosure becomes necessary, we will comply with APP 8 and take reasonable steps to ensure the recipient handles the information consistently with the Australian Privacy Principles.

6. Australian data residency

Akamai's Sydney infrastructure holds ISO 27001:2022 and SOC 2 Type II certifications at the infrastructure layer. TourTide's application layer operates to an ISO 27001-aligned security posture.

7. Security of your information

We take reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access, modification, or disclosure. Our security measures include:

• TLS encryption for all data in transit (HTTPS enforced)
• Passwords stored as bcrypt hashes — plaintext passwords are never stored
• Role-based access control: owner, admin, and guide roles restrict access to sensitive records
• Rate limiting on login attempts to reduce the risk of credential-stuffing attacks
• ISO 27001:2022 certified hosting infrastructure (Akamai Sydney)
• Stripe handles all payment card data — card numbers never pass through or are stored on TourTide servers

Despite these measures, no transmission over the internet is completely secure. If you suspect a security breach affecting your account, contact us immediately at [email protected].

8. Retention and deletion

We retain personal information for as long as necessary to provide the platform and comply with our legal obligations. Specific retention practices:

• Account and Operator data: Retained while the subscription is active and for 7 years after account closure (required for tax and legal compliance).
• Booking and guest data: Retained while the related booking is active and for a reasonable period afterward to support post-trip re-engagement sequences (up to 13 months) and the Operator's own record-keeping needs.
• Server logs: Retained for 90 days for security and operational purposes, then deleted.

When a subscription is cancelled, Operators may export all their booking and guest records before account closure. We provide a 30-day post-cancellation window to complete this export, after which the data is deleted.

We will take reasonable steps to destroy or de-identify personal information that is no longer required for any purpose permitted under this policy.

9. Email communications and marketing

9.1 Transactional email

We send transactional email necessary to operate the platform and your account, and on your instruction as the Operator, to your guests. This includes:

• Account registration confirmation and email verification
• Pre-arrival sequences, balance payment reminders, and post-trip follow-ups sent to your guests
• Subscription confirmations, receipts, and renewal notices

Transactional email is sent as part of the service you have contracted with us. You cannot opt out of essential transactional messages while your account remains active.

9.2 Marketing email and the Spam Act 2003

Any marketing or promotional email we send to Operators complies with the Spam Act 2003 (Cth). This means we will only send marketing email to you if you have given express or inferred consent, every marketing email includes our full company name and contact details and a clear, functional unsubscribe mechanism, and we will process unsubscribe requests within 5 business days as required by the Spam Act. We do not send unsolicited commercial electronic messages, purchase email lists, or send cold email.

9.3 Unsubscribing

To unsubscribe from marketing communications, click the unsubscribe link in any marketing email, or contact us at [email protected] with "Unsubscribe" in the subject line.

10. Accessing and correcting your information

Under APP 12 and APP 13, you have the right to:

• Access the personal information we hold about you, subject to limited exceptions
• Correct personal information that is inaccurate, out of date, incomplete, irrelevant, or misleading

To request access to or correction of your personal information, contact us at [email protected]. We will respond within 30 days.

We may refuse access in certain circumstances as permitted by the Privacy Act. If we refuse, we will give you written reasons and advise of the available complaint mechanisms.

Note on guest data: if you are a guest and want to access or correct information held about you (for example, dietary information submitted before a trip), please contact the tour operator you booked with directly — they are the data controller for that information. If you don't know which operator to contact, email us and we will assist.

11. Privacy complaints

If you have a complaint about how we have handled your personal information, please contact us first:

• Email: [email protected]
• Subject line: "Privacy Complaint"

We will acknowledge your complaint within 5 business days and endeavour to resolve it within 30 days. If we cannot resolve the complaint to your satisfaction, you may lodge a complaint with the Office of the Australian Information Commissioner (OAIC):

• Website: oaic.gov.au
• Phone: 1300 363 992
• Post: GPO Box 5218, Sydney NSW 2001

12. Changes to this policy

We may update this Privacy Policy from time to time to reflect changes in our practices, technology, or legal requirements.

When we make material changes, we will:

• Update the "Last updated" date at the top of this page
• Display a notice on the TourTide dashboard for 30 days after the change takes effect
• Send an email notification to all active account owners if the changes materially affect how we handle their data

Your continued use of TourTide after the effective date of a revised policy constitutes acceptance of the updated policy.