Data Protection — PDPA & GDPR
TourVilo is built with Sri Lanka's Personal Data Protection Act (PDPA) and the EU/UK GDPR in mind, because our customers serve travellers from around the world.
Last updated: 22 July 2026
The short version
We handle traveller data as a processor on your behalf, host it in AWS Singapore, and give you the tools to export or delete it whenever you need.
1. Our PDPA approach
We process personal data lawfully and only for the purposes of running your agency's workspace. We apply purpose limitation — data you enter is used to provide the service, not repurposed.
Our security measures include:
- Encryption in transit and at rest
- Role-based access within each agency
- Row-level security isolating every agency's data
- Audit logs of sensitive actions
- Private file storage with short-lived, expiring links
If a data breach ever affects your data, we're committed to investigating promptly and notifying affected agencies without undue delay.
2. For agencies with EU/UK clients
If your agency serves travellers in the EU or UK, GDPR terms matter. For the traveller data your agency enters, you are the data controller and TourVilo acts as your data processor.
What we provide to support you:
- Data hosted in AWS Singapore, with the sub-processors below
- Export and deletion tools built into the product
- Support for responding to data-subject requests
- A Data Processing Addendum (DPA) available on request — email us
| Sub-processor | Purpose | Region |
|---|---|---|
| Supabase | Database & authentication | AWS Singapore |
| Cloudflare R2 | File & document storage | Global (private buckets) |
| Brevo | Transactional & notification email | EU |
| Vercel | Application hosting & delivery | Global edge |
| Secure payment gateway | Card payment processing (planned) | Named here once live |
3. Security summary
- Encryption in transit (TLS) and at rest
- Role-based access and per-agency data isolation (RLS)
- Private document storage with expiring download links
- Audit logging of sensitive actions
- Regular, encrypted backups
Found a security issue? Please report it responsibly to security@tourvilo.com.