Privacy policy

This policy explains how TheTourKo ("we") handles personal data in TheTourKo: the website, web app, Chrome recorder extension and published demos. It is written to meet the Digital Personal Data Protection Act 2023 (DPDP Act) and the Information Technology Act 2000 and its rules. We never sell personal data.

1. Our two roles

• Your account. For the people who sign up and use the app, we decide how the data is used (we are the data fiduciary).
• Your demos' viewers and leads. When a customer's demo collects analytics or a lead form, the customer decides what is collected and why; we process it on their behalf (as a data processor). Questions about that data are best sent to the company whose demo you viewed; we will help them answer.

2. What we collect

Account and workspace

• Name, email address and a password, which we store only as a salted scrypt hash. With Google sign-in, your name and email from Google.
• Two-step sign-in settings, and for each session the time, device (browser) and IP address, so you can see and sign out of your sessions.
• An activity log of actions in a workspace (for example "published a demo"), with time, IP address and device, shown to workspace and organization admins.
• Your role, workspaces, organization, plan and usage (seats, demos, AI credits, storage), and billing contact details when you buy a plan.

What you record and create

• The recorder captures the screens of the pages you choose to record (their text and images), the elements you click, and the page titles. It records only while you have started a recording. Fields marked for redaction are hidden before upload. Avoid recording pages that show personal data you are not allowed to share.
• Captions, chapters, voice recordings you make, generated voice and presenter videos, and other media you add.

Viewers of published demos

• A random visitor id kept in the viewer's browser, a session id, which steps were seen, time spent, whether the demo was finished, the referring site and the site it was embedded on. We do not use advertising trackers.
• If a demo has a lead form or an email-gated link: the email address and any name or company the viewer types, and, when the demo asks for it, a record of the consent given (the wording, the time and the policy link).

Contact and support

What you send us when you write to us.

3. Why we use it

• To provide the Service: accounts, sign-in, workspaces, recording, editing, publishing, sharing and analytics.
• To keep it secure: sessions, two-step sign-in, rate limits, activity logs and preventing abuse.
• To send service emails: account confirmation, password resets, invitations, plan requests and important notices. We do not send marketing email without your consent.
• To bill paid plans and keep tax and accounting records.
• To meet legal obligations and respond to lawful requests.

We rely on your consent (given when you sign up, which you can withdraw) and on the legitimate uses allowed by the DPDP Act, such as providing the service you asked for and complying with the law.

4. Who we share it with

Only with service providers that help run TheTourKo, under contracts that limit them to that purpose:

We may also disclose data when the law requires it, to protect people's safety or our rights, or to a buyer if our business is transferred (who must keep this policy's protections).

5. Where it is stored

Our servers and those of our providers may be outside India. We transfer personal data only as the DPDP Act allows, and protect it in transit and at rest.

6. How long we keep it

• Account data: while your account is active. Ask us to delete it and we will within 30 days, except what the law requires us to keep (such as invoices).
• Sign-in sessions expire after 30 days, or earlier when you sign out.
• Workspace content, analytics and leads: while the workspace exists, or until its admins delete them. A deleted workspace or organization is permanently erased after 30 days.
• Billing and tax records: as long as Indian law requires.

7. Security

Connections are encrypted (HTTPS). Passwords are stored as scrypt hashes and session tokens as SHA-256 hashes. Workspaces are isolated from each other, roles limit who can do what, two-step sign-in is available (and can be required by admins), and admin actions are logged. No system is perfectly secure; if a breach affects your personal data we will tell you and the Data Protection Board of India as the law requires.

8. Your rights

Under the DPDP Act you can ask us to:

• tell you what personal data we hold about you and how it is processed;
• correct, complete or update it;
• erase it (unless we must keep it by law);
• withdraw a consent you gave (this doesn't affect what was done before);
• nominate someone to exercise these rights for you in case of death or incapacity;
• resolve a grievance (see below).

Most account details can be changed in Settings. For anything else, write to [email protected]. We may need to confirm your identity first. If you were a viewer of someone else's demo, contact that company; we will help them respond.

9. Children

TheTourKo is for businesses and is not meant for anyone under 18. We do not knowingly collect children's data; if you believe we have, contact us and we will delete it.

10. Cookies

We use only the cookies and browser storage the Service needs to work; there are no advertising cookies. See our Cookie policy.

11. Grievance Officer

Complaints about how we handle personal data can be sent to our Grievance Officer. We acknowledge them within 48 hours and aim to resolve them within one month. You may also approach the Data Protection Board of India.

Business

TheTourKo

Email

[email protected]

Grievance email

[email protected]

12. Changes

We will post updates here with a new date, and tell account owners by email about material changes.