Get my videos
Legal

Privacy policy

Last updated: 25 August 2026 · Applies to tourmarquee.com

This policy explains what we do with personal data when you use tourmarquee.com. We have written it in plain English on purpose. If anything is unclear, ask us and we will explain it.

1. Who is responsible

The controller of your personal data is Edvânia Costa Fernandes, sole trader, Rua Frei Carlos 12, 1600-095 Lisbon, Portugal, taxpayer number PT315499966. Contact for anything in this policy: support@tourmarquee.com.

We are not required to appoint a data protection officer, so your request goes straight to the owner of the business.

2. What we collect and why

When you buy a pack

  • Email address, collected by Stripe at checkout. Used to open your workspace, send you the link and send you your videos. Legal basis: performance of the contract.
  • Billing details and payment identifiers such as country, the Stripe session and customer references, the amount and the currency. Used to take payment, issue receipts and meet accounting duties. Legal basis: performance of the contract, and legal obligation for the accounting records.
  • We never receive your full card number. The card is handled entirely by Stripe on Stripe's own page.

When you submit a brief

  • The brief itself: property name, location, optional listing link, the description you write and any notes. Legal basis: performance of the contract.
  • The photographs you upload. If a photograph shows an identifiable person, that is personal data about them, and by uploading it you confirm you have their permission. Legal basis: performance of the contract, and your confirmation of consent for anyone shown.

When you contact us

  • Your message and email address, kept so we can answer and so we have a record if the same issue comes back. Legal basis: our legitimate interest in answering you and keeping a support record.

Cookies and similar

Strictly necessary cookies only, unless you turn on optional ones in the cookie banner. Full detail is in the cookie policy. Legal basis: your consent for anything that is not strictly necessary.

3. What we do not do

  • We do not sell, rent or trade personal data. Ever.
  • We do not ask for, receive or store your login details for any booking platform.
  • We do not use your photographs to train any machine learning model.
  • We do not make automated decisions that produce legal effects about you.
  • We do not send marketing email unless you explicitly ask to receive it.

4. Who processes data for us

We use a small number of providers, each bound by a data processing agreement and each allowed to use the data only to provide their service to us.

  • Stripe — payment processing and checkout. Acts as an independent controller for fraud prevention and its own regulatory duties.
  • Vercel — hosting of the site, storage of the photographs you upload, and storage of your briefs in encrypted form.
  • Resend — sending transactional email.

We do not run a separate customer database. Your pack, its credits and its status are held on your customer record at Stripe, which already processes the payment, and your briefs are stored as encrypted files at Vercel. Fewer places holding your data means fewer places it can leak from.

5. Transfers outside the European Economic Area

Some of these providers are based in, or process data in, the United States. Where data leaves the EEA it is protected by the European Commission's standard contractual clauses, and, where the provider is certified, by the EU-US Data Privacy Framework. You can ask us for a copy of the safeguards that apply.

6. How long we keep things

  • Photographs and briefs: 12 months after delivery, so we can handle revisions and re-send files, then deleted.
  • Workspace and order records: for as long as the workspace has unused credits, and then 12 months.
  • Invoices and accounting records: 10 years, because Portuguese tax law requires it.
  • Support emails: 24 months.

You can ask us to delete your photographs earlier than that and we will do it within seven days, unless we need them for an ongoing order.

7. Your rights

Under the GDPR you can ask us to:

  • give you a copy of the personal data we hold about you;
  • correct anything that is wrong;
  • delete it, where we have no overriding reason to keep it;
  • restrict how we use it while a dispute is resolved;
  • send it to you or another provider in a portable format;
  • object to processing based on our legitimate interests, and withdraw any consent you gave, at any time, without affecting what was done before.

Write to support@tourmarquee.com from the address you used with us. We answer within 30 days. There is no charge unless a request is clearly excessive or repetitive.

8. Your workspace link

Your workspace is protected by a private link containing a random key rather than a password. Anyone holding the link can see the briefs in that workspace, so do not post it publicly. Ask us and we will issue a new link and disable the old one immediately.

9. Security

The site is served over HTTPS only, with a strict content security policy and HSTS. Your brief, including anything you type into it, is encrypted with AES-256-GCM before it is stored, using a key that exists only on our server, so the stored file is unreadable to anyone who does not hold that key. Your workspace link is signed, so a link cannot be altered to reach somebody else's workspace. Uploads are validated by file type and size. No system is perfect, and if a breach ever affects your rights we will tell you and the supervisory authority within the deadlines the GDPR sets.

10. Children

The service is sold to people aged 18 or over. We do not knowingly collect data from children. If you believe a child has sent us data, tell us and we will delete it.

11. Complaints

Please come to us first. If you are not satisfied, you can complain to the Portuguese data protection authority, Comissão Nacional de Proteção de Dados (CNPD), or to the authority in the EU country where you live or work.

12. Changes

If we change this policy we update the date at the top. Where a change is significant and affects data we already hold about you, we email you before it takes effect.