How creators and Tourli use your email address

This page applies to marketing emails sent by a creator through Tourli. The creator whose form you used, or whose email you received, is named on the form where you signed up and at the foot of every email, together with their postal address and contact details.

Who is responsible for your data

The creator whose form you used decides why and how your email address is used for their marketing emails. In data protection terms, that creator is the "controller".

TOURLI LTD (Company no. SC880729, 18 Young Street, Office 311, Edinburgh, Scotland, EH2 4JB) provides the tools and sends the emails on the creator's instructions. Tourli is the "processor" for this. Tourli also keeps some records for its own purposes: see "What Tourli keeps for itself" below.

What we collect

• Your email address.
• A record of your consent: where you signed up, the exact wording you saw, the version of this notice, the date and time, how you confirmed, and any later change or withdrawal. Your IP address is not stored with this record.
• Delivery records for each email: whether it was delivered, bounced, or reported as spam.

We do not track whether you open emails or click links inside them.

Why, and on what legal basis

• Sending you marketing emails from the creator: your consent (UK GDPR / EU GDPR Article 6(1)(a); PECR regulation 22). You can withdraw it at any time.
• Keeping a record that you unsubscribed, so you are not emailed again unless you opt in again: legal obligation and legitimate interests.
• Keeping a scrambled record of an address that bounced or reported an email as spam, so it is not emailed again by mistake: legitimate interests.
• Keeping evidence of your consent: legal obligation (we must be able to show it was given) and legitimate interests.

Who sees your data

• The creator can see your email address and your subscription status.
• Tourli's service providers, used only to run the service: email delivery (Amazon Web Services), database hosting (Supabase), application hosting (Railway), background processing (Trigger.dev), transactional email for confirmation links (Resend), error monitoring (Sentry). None of them use your data for their own purposes.
• Nobody else, unless the law requires it.

Where your data goes

Tourli is based in the United Kingdom. Some service providers process data in the United States. Transfers are protected by an approved safeguard: the UK–US Data Bridge where the provider is certified, or the UK International Data Transfer Agreement or Addendum; for EU residents, the EU–US Data Privacy Framework or Standard Contractual Clauses. Details for each provider: tourli.com/legal/subprocessors.

How long we keep it

• Your email address and subscription: until you unsubscribe, your subscription lapses after 24 months without activity, or the creator or you delete it. Deleted records are removed within 30 days.
• Evidence of your consent and withdrawal: 6 years after your subscription ends, in a form that no longer shows your email address.
• Delivery records: 13 months after the last event.
• Signups you never confirmed: the link expires after 72 hours and the record is deleted within 13 months.
• If you unsubscribe: a record that you did, for as long as your subscription record exists, so you are only emailed again if you opt in again.
• If an email to you bounces permanently or you report one as spam: a scrambled record of your address, for as long as it is needed to stop us emailing you again by mistake.
• If you ask us to erase your data: we unlink your address from our records and keep only the scrambled consent evidence above and any bounce or spam record. If you later sign up again with the same address, that is a new opt-in.

Your rights

You can ask to access, correct, erase, or receive a copy of your data, or to restrict or object to its use, and you can withdraw consent at any time without affecting anything done before.

• To stop emails: use the unsubscribe link in any email. It takes effect immediately.
• For anything else: contact the creator using the contact details shown where you signed up and at the foot of every email. If you can't reach them, contact Tourli at privacy@tourli.com and we will act on your request or pass it to the creator. We respond within one month.
• You can complain to the UK Information Commissioner's Office (ico.org.uk) or, if you are in the EU, your local data protection authority.

What Tourli keeps for itself

Separately from the creator's list, Tourli keeps scrambled records of addresses that bounced or reported spam, and records of consent, to keep its sending safe and to meet its legal obligations. For these Tourli is the controller. Tourli's full privacy notice: tourli.com/privacy.