Legal
Privacy Policy
Last updated: July 07, 2026
This Privacy Policy describes how Bugs Monkey ("we", "us", or "our") collects, uses, and shares information when you use Tourly ("the Service") at www.bugsmonkey.com.
By using Tourly, you agree to the collection and use of information in accordance with this policy.
1. Information We Collect
1.1 Account Information
When you register for Tourly, we collect:
- Full name
- Email address
- Password (stored as a one-way hash — we cannot read it)
1.2 Payment Information
Payments are processed by third-party providers:
- Razorpay — for Indian users paying in INR. We store only the Razorpay Order ID and Payment ID returned after a successful transaction. We never store your card number, CVV, UPI PIN, or bank credentials.
- Stripe — for international users paying in USD. We store only the Stripe Checkout Session ID. Card details are never transmitted to or stored on our servers.
1.3 Walkthrough Trace Data
When a visitor views a page where a Tourly script is embedded, we automatically collect:
- Domain name and page path
- Browser user agent string
- IP address (used for analytics only, not sold or shared)
- Referring URL
- Walkthrough event type (load, step view, complete, skip, exit)
- Step index
- Timestamp
This data is collected on behalf of Tourly customers (our users) when their visitors interact with embedded walkthroughs.
1.4 Usage Data
We collect standard server logs including access times, pages viewed, and error reports to maintain and improve the Service.
2. How We Use Your Information
We use the information we collect to:
- Provide, operate, and maintain the Tourly service
- Process payments and send payment receipts and invoices
- Send important service-related communications (plan expiry, limit alerts)
- Respond to support enquiries
- Monitor for unauthorised script usage and security threats
- Improve the Service and fix bugs
- Comply with legal obligations
We do not sell, rent, or trade your personal information to third parties for marketing purposes.
3. Cookies
Tourly uses the following cookies:
- Session cookie — keeps you logged in during your browser session. Expires when you close your browser or after 120 minutes of inactivity.
- CSRF token — protects against cross-site request forgery attacks.
- Currency preference — remembers whether you prefer INR or USD pricing.
Tourly does not use advertising cookies or third-party tracking cookies.
4. Data Sharing
We share your data only with:
- Razorpay — name and email for payment processing (India). Privacy policy: razorpay.com/privacy
- Stripe — name and email for payment processing (international). Privacy policy: stripe.com/privacy
- Hosting infrastructure — our servers are hosted on [YOUR_HOSTING_PROVIDER]. Data is stored in [YOUR_DATA_CENTER_LOCATION].
- Legal authorities — if required by law or valid legal process.
5. Data Retention
- Account data — retained while your account is active. Deleted within 30 days of account deletion request.
- Transaction records — retained for 7 years as required by Indian tax regulations (GST compliance).
- Trace data — retained for 12 months, then automatically purged.
- Server logs — retained for 30 days.
6. Data Security
We implement industry-standard security measures including:
- HTTPS/TLS encryption for all data in transit
- Bcrypt hashing for passwords
- CSRF protection on all forms
- HMAC signature verification for all payment webhooks
- Access controls limiting who can view user data
No method of transmission over the internet is 100% secure. We cannot guarantee absolute security but we take reasonable precautions.
7. Your Rights
You have the right to:
- Access — request a copy of the personal data we hold about you
- Correction — request correction of inaccurate data
- Deletion — request deletion of your account and personal data (subject to legal retention requirements)
- Portability — request your data in a machine-readable format
- Objection — object to certain types of processing
To exercise these rights, contact us at hello@bugsmonkey.com.
8. Children's Privacy
Tourly is not directed at children under 13. We do not knowingly collect personal information from children under 13. If you believe a child has provided us personal information, please contact us immediately.
9. International Transfers
Your data may be processed in countries outside your country of residence. We ensure appropriate safeguards are in place for any such transfers.
10. Changes to This Policy
We may update this Privacy Policy from time to time. We will notify registered users by email of any material changes at least 7 days before they take effect. Continued use of Tourly after changes constitutes acceptance of the updated policy.