Privacy Policy

1. Who we are

TourixAI (“we”, “us”, “our”) operates the TourixAI platform, an AI-powered service that makes social media ads and short travel films for travel agencies. We are the data controller for personal data collected through this service.

TourixAI · hello@tourixai.com

For privacy enquiries, contact us at hello@tourixai.com.

2. Data we collect

We collect the following categories of personal data:

• Account data: Your name, email address, and profile picture (from Google OAuth or email sign-in).
• Agency data: Your agency name, brand colours, logo, voice preferences, and any photos you upload (for example of a hotel you sell).
• Usage data: The trips you describe, the posts, captions and films you generate, film descriptions and scripts, and the photos or ads you choose for a film.
• Billing data: Your plan, its start and end dates, and records of the payments you make (amount, date, method and reference). Plans are paid by cash or bank deposit, so we never collect card details.
• Technical data: IP addresses, browser type, and session information collected automatically for security and diagnostics.
• Optional analytics: With your consent, page visits, browser and device information, and a randomly generated browser identifier. These identifiers are not necessarily anonymous. We do not record your sessions.

3. Why we collect it

How we improve TourixAI. We keep the ads, films and design records made in your account (what was asked for, what was made, and what you chose, edited, published or deleted) and study them to make TourixAI's designs, captions and suggestions better for every agency. This happens inside TourixAI: we do not sell this material, we do not use it for advertising, and we do not give it to our providers to train their own models. You can object to this use at any time by emailing us (see section 6); deleting an ad, a film or your account removes it from this use from then on.

4. Who we share data with

We share data only with the following third-party processors:

• OpenAI: AI image, caption and film script generation (your post and film inputs are sent to OpenAI's API)
• Replicate: Video generation. Your film description or script, and any photos or video ads you choose for a film, are sent to its API, which runs the video model that makes the film.
• Higgsfield: Video generation, only when we switch films to it instead of Replicate. The same film inputs are then sent to its API. Our Higgsfield account is set to exclude our inputs and outputs from model training.
• Post for Me: Publishing to Instagram and Facebook, used only if we enable it and you connect an account. It holds the connected account's access; we keep the account's name, what we publish for you and those posts' results (reach, views, saves and similar counts). Disconnecting an account removes that access and the earlier posts we read for your benchmark. Deleting your TourixAI account also deletes your accounts at Post for Me, and the posts still waiting to go out.
• Meta (Facebook and Instagram ads): Boosting a published post, used only if we enable it and you connect your own Meta ad account. We keep that account's access, encrypted, to create the boosts you ask for and read their spend and results; Meta charges your ad account directly. Disconnecting removes our access.
• Cloudinary: Image and video storage and delivery
• Neon / Vercel: Database and hosting infrastructure
• Upstash: Redis for rate limiting and the queue that runs post generation
• Google: Sign-in, only if you choose “Continue with Google”
• Resend: Transactional email delivery
• Sentry: Error diagnostics. Session recording and browser performance tracking are disabled.
• PostHog: Optional product analytics, enabled only after you allow analytics in Cookie settings. Session recording is disabled. Analytics stays off when your browser sends Do Not Track or Global Privacy Control.
• Vercel Web Analytics: Optional counts of visits to our public pages (the address without its query, the referring site, country and device type), enabled only after you allow analytics in Cookie settings. It sets no cookies and does not identify you across sites.

Our providers (Vercel, Neon, OpenAI, Replicate, Higgsfield, Cloudinary, Resend, PostHog, Sentry, Upstash, Google) process data in the United States and elsewhere. We rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission's Standard Contractual Clauses. You can ask us for a copy at hello@tourixai.com.

We do not sell your personal data to third parties. We do not use your data for advertising.

5. Data retention

We retain your data for as long as your account is active. Deleting your account deletes your account, posts, films, brand kits and uploaded and generated media. Security logs are kept without any link to your account. Copies held by our video provider expire under its own policy. Copies in our database backups expire within 30 days.

Your payment history in TourixAI is deleted with your account. Invoices and receipts we must keep for tax purposes are kept separately, for as long as the law requires.

Ads and films are not deleted because of their age: they stay in your library until you delete them or your account.

6. Your rights

Depending on where you are, including in the EU, the UK and Kosovo, you have the following rights:

• Access: Request a copy of the data we hold about you
• Rectification: Correct inaccurate data
• Erasure: Delete your account and its associated data, as described in section 5
• Restriction: Ask us to limit how we use your data
• Portability: Receive your data in a machine-readable format
• Objection: Object to processing based on legitimate interest
• Withdraw consent: Turn off optional analytics at any time in Cookie settings. Withdrawing consent does not affect processing that already took place with your consent.

To exercise any of these rights, email us at hello@tourixai.com. We will respond within 30 days.

You can complain to your data protection authority (in Kosovo, the Information and Privacy Agency; in the EU, your local authority).

7. Security

We protect your data using industry-standard measures: HTTPS for all data in transit, signed Cloudinary upload requests so only you can add files to your account, and access checks on every request so no one can see another account's posts. Our infrastructure is hosted on Vercel and Neon (US East).

8. Cookies

We use essential cookies and browser storage and, only with your permission, optional analytics storage:

• Sign-in cookies: Keep you signed in (up to 30 days) and secure the sign-in itself (HttpOnly, Secure)
• Age confirmation: Remembers for 1 year that you confirmed you are 18 or older
• Cookie preference: Stored in your browser for up to 180 days to remember whether you allow analytics
• App storage: Remembers in-progress ads, unsent form drafts and dismissed tips in your browser until you clear it
• PostHog: Optional analytics cookies and browser storage, used only after you choose “Allow analytics”

We do not use advertising cookies or sell cookie data.

Refusing analytics does not prevent you from using TourixAI. You can change your choice or withdraw consent using Cookie settings. See our Cookie Policy for details.

9. Changes to this policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email. Changes to this policy do not grant consent to optional analytics.

10. Contact

Questions about this Privacy Policy? hello@tourixai.com