Privacy Policy

Responsible for processing

JP Tech Applications is responsible for the processing of personal data processed in Tour Assistant. For privacy, security or exercise of rights requests, use jptechapplications@gmail.com.

Processed data

• Account: email, user identifier, authentication status and technical records required to log in via code sent by email, Google or Apple. The app receives an identity credential from the provider; you do not receive your Google or Apple password.
• Profile and operation: name, role, location, optional profile photo, professional contacts you choose to save, calendar, gigs, unavailability, notes, riders, sessions, backline, technical documents and uploaded files.
• Substitutions and shares: recipient emails, names, request status, minimum gigs snapshots and private accesses accepted or denied.
• Professional directory: only the profile data you voluntarily publish, including visibility, optional profile photo, professional areas, contact and availability.
• Community and security: professional connections, private conversations, messages, blocking and reporting profiles or messages, including the optional reason indicated by the complainant.
• Notifications: Web Push subscriptions and APNs tokens by device, technical endpoint and subscription public keys where applicable, platform, environment, user agent and creation/last use dates.
• Optional analytics: after you consent, Google Analytics may process pages visited, visit sources and approximate browser, device and location information. If you accept usage measurement, we also store the account identifier, UTC day and type of web action (interaction, date creation or confirmation, substitution request or confirmation), without the contents of dates or contacts. Reports show aggregate counts only.
• Google Calendar, when you turn it on: Google account email, calendar list and properties, events from today onwards in the chosen calendars, synchronization identifiers and encrypted OAuth credentials. We do not import events prior to the day of activation.
• Local data: session, offline cache, interface preferences, backup reminders, and manually exported JSON backups on your device.

Purposes and basis

• Create and maintain the account, authenticate by email, Google or Apple and synchronize data between devices: execution of the terms of use.
• Save calendar, technical files, contacts and substitution requests: execution of terms and legitimate interest in providing a reliable operational tool.
• Publish opt-in professional profiles and allow contact by other users: consent/affirmative action for publication, withdrawable when unpublishing the profile.
• Send push notifications requested by the user, including tests and message warnings: browser or operating system consent, withdrawable in the device or app settings.
• Measure aggregate site usage and repeated account use on the web: consent, which you can refuse or withdraw at any time using the Cookies button. Usage records associated with the account are removed when the account is deleted.
• Sync future dates with user-chosen Google calendars: OAuth consent and execution of requested functionality, withdrawable by turning off the integration.
• Security, abuse prevention, technical diagnosis and compliance with legal obligations: legitimate interest and legal obligation when applicable.
• Analyze reports and apply user-requested blocks: legitimate interest in protecting the community and complying with the platforms' rules.
• Voluntary contributions or external feedback are only processed by third-party services chosen by the user, in accordance with their policies.

Subcontractors and recipients

• A contracted technical provider handles authentication, data synchronization, and file storage used by the app.
• Vercel or another hosting provider may process technical request, delivery, and application security data.
• Google Analytics only receives usage data after you accept analytics in your cookie preferences.
• Browser/operating system push providers deliver notifications to subscribed devices according to platform policies.
• Google and Apple process the necessary data when you choose to log in with these providers. Account authentication is separate from Google Calendar access.
• Google also processes the Google Calendar data required for synchronization. Tour Assistant only asks for this authorization after you turn on the integration and only for the list of calendars and events in the chosen calendars.
• User-triggered external services, such as email, WhatsApp, Tally or Stripe, only receive data that the user decides to send outside of the app.
• Gigs private data and files are only shared with recipients authorized by the app's permissions or by links/actions that the user performs.

Google data: access and use

• When you connect Google Calendar, we use your Google account ID and email only to identify the linked account; the calendar list and properties only to display available calendars; and events from the calendars you select just to show and synchronize them on the Tour Assistant.
• The Events permission allows you to read future events from selected calendars and create, update, or delete events in the target calendar in response to actions you perform in Tour Assistant. This permission is required for two-way synchronization, including shared calendars where you have write access; Permissions limited to events created by the app do not allow importing or updating other events chosen by the user.
• We don't access Gmail, Google Drive, Google contacts, photos, unselected calendar content, or events from before the day you turned on sync.
• Google data is not used for advertising, creating advertising profiles, granting credit, selling data or any purpose other than the calendar features requested by the user.

Google data: sharing, transfer and disclosure

• The raw Google data processed by the app includes the linked account's email, calendar list metadata, content of selected events, and encrypted OAuth credentials. The only data derived is technical synchronization metadata, such as identifiers, state, and last synchronization date; We do not create or share profiles or aggregated data sets for advertising or commercial analysis.
• JP Tech Applications processes this data to operate Tour Assistant. It is transferred only to our technical subcontractors for data storage and synchronization, and to Vercel for hosting and secure operation of the application and API calls. These providers may process the data only to provide these services on our behalf.
• Google receives the calendar operations you request, such as creating, updating or deleting an event, so that the change is reflected in your Google account. We do not send Google Calendar data to Google Analytics, push notification providers, advertisers, data brokers or other users.
• We don't sell Google data or share or transfer it to independent third parties. We may only disclose it to authorities or other recipients when a valid legal obligation requires it, or when it is strictly necessary to investigate fraud, abuse or a security incident, within applicable legal limits.

Google Limited Use and artificial intelligence

• Use of information received from Google APIs complies with the Google API Services User Data Policy, including Limited Use requirements.
• We do not use raw, aggregated, anonymized, or derived Google data to develop, improve, or train general or personalized artificial intelligence or machine learning models.
• We do not transfer Google data to third-party artificial intelligence or machine learning services, including services that may use that data to train their models.
• Human access to Google data is prohibited except with affirmative consent from the user to resolve a support request, when necessary for security reasons, to comply with law, or when the data has been aggregated and anonymized for internal operations permitted by Google policy.

Cookies and analytics

Google Analytics is optional and is not loaded before your acceptance. The choice is saved in the browser. You can reopen the Cookies button to refuse or accept again; When withdrawing consent, the app disables collection and deletes Google Analytics cookies accessible in this domain.

International transfers

Some providers may process data outside the European Economic Area. When this happens, there must be transfer mechanisms provided for in the GDPR, such as adequacy decisions, standard contractual clauses or equivalent measures applicable to the supplier.

Conservation

• Account data and operational data are retained as long as the account is active or as long as it is necessary to provide the app.
• The Delete account and data option, available in Settings, deletes the account identity and its data, profile, messages, invitations, tokens and active files. External backups remain under the user's control.
• Reports may be kept for the period necessary for analysis, prevention of abuse and compliance with legal obligations; when possible, they are dissociated from the deleted account.
• Data published in the professional directory remains visible until unpublished or changed by the user.
• Private shares and substitution requests are associated with the relevant gigs until they are revoked, deleted, or are no longer needed.
• Backups JSON exported, files downloaded and data sent by email/WhatsApp are under user control and outside of the app's automatic deletion.
• Technical backups may exist for limited periods at infrastructure providers.
• When you turn off Google Calendar, the OAuth credentials saved by the app are deleted and synchronization stops. Dates already projected in the calendar may remain as a record until they are removed by the user or by normal conservation policy.
• The Delete account and data option also deletes the Google connection, OAuth credentials, calendar selections, sync metadata, and copies of Google events saved on the Tour Assistant. We do not retain this data after active deletion, except for isolated technical backups during the limited vendor retention cycle.

Rights of holders

Under the terms of the GDPR, you can request access, rectification, erasure, limitation, opposition, portability and withdrawal of consent when applicable. The exercise is free, except for manifestly unfounded or excessive requests. You can also complain to the CNPD at www.cnpd.pt.

Security

The app uses code authentication sent by email or Google/Apple identity credentials, permissions per user in the database, isolation of files per account, private access to sensitive shares and encryption of Google Calendar OAuth credentials on the server. No measurement is absolute; avoid storing unnecessarily sensitive data and maintain control over the emails and files you share.

Automated decisions

The app does not make exclusively automated decisions with legal effects or equivalent impact. Conflict alerts, reminders and orders are operational aids that the user must confirm.