Who handles your information
TARHINI SYSTEMS operates the TOURSICO platform. Activity providers are identified separately on their offers and reservation records. A provider handles the information needed to fulfill its activity under its own applicable privacy obligations. A provider website must identify its business and publish its own privacy and cookie information.
Information used by the platform
Account information includes your account identifier, email address, authentication identity and the profile details you supply. Business users also supply business, contact, website, staff and tour information. Reservations may include traveler contact details, participant counts, dates, pickup details, payment preferences and provider correspondence. Financial and fulfillment records include amounts, collection status, provider references and ticket or voucher events.
We use this information to authenticate users, apply business permissions, publish authorized listings, process reservations, coordinate activity fulfillment, deliver transactional messages, provide support, prevent abuse and preserve operational records. Required fields are identified in the relevant form; avoid putting sensitive information in public website content or free-text fields unless the booking requires it.
Google sign-in and connected Gmail senders
Google sign-in is separate from connecting a Gmail sender. Sign-in uses Google account identity, verified email and the profile information permitted by the sign-in authorization to authenticate your platform account. Signing in does not authorize the platform to send email from your mailbox.
An authorized platform administrator can separately connect a business sender through Google's consent screen. That feature requests OpenID identity, email, permission to send Gmail messages and basic Gmail settings access. It verifies the account and approved send-as address, then sends the operational messages authorized in the Email Center or transactional workflows. The connection reads send-as settings to verify the sender; it does not change those settings or read inbox message contents. Google may describe the settings scope more broadly on its consent screen.
The sender connection stores the verified Google account identifier, email, authorized scopes and an encrypted refresh credential. Message records may retain the recipient, authored message, provider message identifier and delivery status. Server-side delivery uses the refresh credential to obtain a short-lived access token. Sender authorization does not by itself send a message.
Google authorization data is used for the sign-in or connected-sender feature for which access was granted. It must not be sold, used for advertising or used to train general-purpose AI models. Access and transfers must follow the Google API Services User Data Policy, including its Limited Use requirements. Any human access must be limited to the user's specific authorization, necessary security investigation or applicable legal obligations.
You can revoke the application's access in your Google Account connections. Revocation prevents future authorized use once Google rejects the credential; it does not recall a message already delivered or erase a booking record. Contact the platform operator to request removal of a sender connection and review of retained account data.
Automated email and business replies
TOURSICO uses Resend to send automated account, reservation, fulfillment and support messages. This requires sharing the recipient address and the message content with Resend. Booking messages may contain a private viewing link; keep it confidential. Provider and operations notifications require sign-in to see traveler details. Google Workspace handles the info@toursico.com inbox and replies. These services have separate delivery records; an email provider accepting a message does not prove it reached the recipient's inbox.
Marketing messages use a separate newsletter sending domain. A reservation, account or contact request does not by itself subscribe you to marketing. Newsletter delivery requires an appropriate subscription and a working unsubscribe process. Automated operational messages are distinct from marketing. We do not transfer stored Google sender credentials to Resend.
Recipients and service providers
Necessary reservation details are shared with the identified activity provider and authorized fulfillment staff. Hosting, authentication and Storage use the platform's configured Vercel and Supabase services. Connected Gmail delivery uses Google; other enabled email delivery may use the configured SMTP provider. Existing payment records may refer to their original payment processor. Service providers may process information outside your country. Applicable processing arrangements and transfer safeguards must be documented for the final policy.
Browser storage and external content
Necessary browser storage supports authentication, security, cart state, language, currency and website preferences. Provider storefronts keep their preferences separate from marketplace accounts and disable optional advertising and analytics. Optional advertising and analytics are disabled in the TOURSICO canonical release configuration while their consent and configuration review is pending. Fonts, maps or other external content may contact their identified provider when displayed.
Security and retention
Access controls separate providers and staff permissions. Sender refresh credentials are encrypted, and authenticated operations require valid sessions. No system can guarantee absolute security. Information is retained while needed for the account, reservation, support, security, legal obligations or dispute handling. Record-specific retention periods and deletion procedures remain part of the final policy review; a rebrand does not silently delete earlier transactions or change their contracting parties.
Your requests and policy changes
Contact the operator below to request access, correction, deletion, restriction or information about processing where applicable. We may need to verify your identity and preserve records required for another person's rights or a legal obligation. For activity-provider processing, contact the identified provider as well. Material changes to Google data use require a new disclosure and any necessary consent before that use begins.