Privacy Policy

Wyndham Knox Limited, trading as Tourviewer ("we", "us"), follows the New Zealand Privacy Act 2020. This policy explains what personal information we collect, why, and your rights. Contact us at will@mytourviewer.com.

What we collect

• Operator accounts: name, email, company name and contact details. Payments are handled by Stripe. We do not see or store card numbers; we keep only Stripe's customer and subscription references and plan status.
• Guides and staff: name, email, the company they belong to, and their role.
• Guests: session and join data (the join code and an anonymous device token), language choice, which slides were shown during the session, and any photos that guides or guests upload. Guests don't need an account, and we don't ask guests for their name or email.
• Usage and device logs: basic technical data such as IP address, browser and device type, pages used, and error logs.

Why we use it

To provide and secure the service; run live tour sessions; translate tour content; manage accounts, plans and billing; give support; fix problems and improve the service; and meet our legal obligations. We don't sell personal information and don't use it for third-party advertising.

Who we share it with

• Lovable Cloud / Supabase: hosting and database. Data may be stored or processed overseas.
• Stripe: payment processing for paid plans.

Some of these providers keep information outside New Zealand. Under Information Privacy Principle 12, we only disclose information overseas where the provider is required to protect it in ways that are, overall, comparable to the Privacy Act. We may also disclose information where the law requires it.

How long we keep it

We keep account information while your account is active. Guest admission tokens expire within minutes after a session. We delete or anonymise information we no longer need, usually within 12 months of an account closing. We keep billing records for as long as the tax laws require.

Security

We use encrypted connections, access controls that limit each company to its own data, and reputable hosting providers. No system is perfectly secure. If a privacy breach is likely to cause serious harm, we'll tell affected people and the Privacy Commissioner as the law requires.

Operators and their guests

Operators decide what content is shown to guests and invite their own staff. Operators are responsible for telling their guests and guides how Tourviewer is used on their tours, including any photos they upload, and for having the right to share that information with us.

Your rights

Under Information Privacy Principles 6 and 7, you can ask to see the personal information we hold about you and ask us to correct it. Email will@mytourviewer.com. We'll respond within 20 working days.

If you're not happy with how we've handled your information, you can complain to the Office of the Privacy Commissioner.

Cookies and local storage

We use browser storage to keep you signed in, to remember a guest's language and their seat in a tour session, and for basic preferences. We don't use advertising cookies.