Privacy Policy
Effective Date: May 1, 2026 · Last Updated: May 1, 2026 · Version: 2026-05-01
VAST BRANDS LLC ("VastBrands," "we," "us," or "our") operates TourFlip at tourflip.com and provides the TourFlip platform and related services (collectively, the "Service"). This Privacy Policy describes how we collect, use, share, and protect your personal information when you use the Service.
By using the Service, you agree to the collection and use of information as described in this Privacy Policy.
1. Information We Collect
1.1 Information you provide directly
- Account information: name, email address, password, role (fan, artist, promoter, venue, festival, crew, services, industry professional), display name, optional profile information (real name, band/company name, biography, location, genres of interest)
- Identity verification information: when required for sellers or pro buyers, we may collect government-issued ID, business registration documents, tax forms (W-9, W-8BEN), and similar
- Payment information: payment card details are collected and processed by Stripe; we do not store your card numbers. We receive limited information from Stripe such as the last four digits, card type, and billing zip code
- Listings and content: any goods, services, performances, venues, events, or other items you list on the Marketplace
- User-generated content: posts, comments, flyers, ratings, reviews, messages, and other content you create on the Service
- Communications: when you contact us via email or other channels
1.2 Information collected automatically
- Device and usage data: IP address, browser type, operating system, device identifiers, pages visited, time spent, referring URL, search terms used on the Service
- Cookies and similar technologies: see Section 7 for details
- Location data: approximate location based on IP address (not precise GPS unless you grant explicit permission)
1.3 Information from third parties
- OAuth providers (Google, Spotify, Facebook, Apple): when you sign up or log in using one of these providers, we receive basic profile information (name, email, profile picture) per the scopes you authorize
- Stripe and PayPal: payment confirmation, transaction records, custom fields collected at checkout (such as your role)
- Public sources: publicly available information about artists, venues, festivals, and businesses
2. How We Use Your Information
- Provide and operate the Service: account creation, authentication, transaction processing, listings, messaging, social features, ticket delivery
- Payment processing and payouts: facilitating payments through Stripe and PayPal, managing pending payouts, releasing funds to sellers
- Communications: transactional emails (account, payment, booking confirmations), marketing emails (with your consent and opt-out option), customer support responses
- Personalization: showing you relevant listings, opportunities, demand campaigns, and social content based on your role and activity
- Trust and safety: fraud prevention, account verification, dispute resolution, content moderation, enforcement of our Terms
- Legal compliance: tax reporting (1099-K issuance to qualifying sellers), responding to legal requests, complying with applicable laws
- Analytics and improvement: understanding how the Service is used, measuring performance, debugging, and improving features
- Pre-launch supporter fulfillment: tracking supporter purchases, issuing Founding Supporter and Believer status, delivering perks at platform launch
3. Legal Basis for Processing (GDPR users)
If you are in the European Economic Area (EEA), United Kingdom, or Switzerland, we process your personal data on the following legal bases:
- Performance of a contract: when processing is necessary to provide the Service you requested
- Legitimate interests: for fraud prevention, analytics, marketing of similar services, and security
- Consent: for non-essential cookies, marketing emails (where required), and certain optional data uses
- Legal obligation: when required to comply with applicable laws
You may withdraw consent at any time without affecting the lawfulness of prior processing.
4. How We Share Your Information
4.1 Service providers
- Stripe and PayPal (payment processing, identity verification, payouts)
- Supabase (database hosting, authentication, file storage)
- Vercel (web hosting and content delivery)
- Resend (transactional email delivery)
- OAuth providers (Google, Spotify, Facebook, Apple) for authentication
- Analytics providers (for usage analytics)
These providers have access to information only to perform tasks on our behalf and are obligated not to disclose or use it for other purposes.
4.2 Other users
- Your display name, profile picture, role, and public profile information
- Your listings, posts, and other content you publish on the Service
- Your verification status and Founding Supporter/Believer badge
- Aggregated transaction history (such as completed deals and ratings) when this information helps establish trust
You can control some visibility settings in your account preferences.
4.3 Marketplace counterparties
When you complete a transaction, we share necessary information with the counterparty (buyer or seller) to facilitate the transaction. This may include name, email, shipping address (for physical goods), and transaction details.
4.4 Legal and safety
We may share information when required by law, subpoena, court order, or to protect the rights, property, or safety of TourFlip, our users, or others.
4.5 Business transfers
If VastBrands LLC undergoes a merger, acquisition, or sale of assets, your information may be transferred as part of that transaction. We will notify you of any material changes.
4.6 With your consent
We share information for any other purpose with your consent.
5. Your Rights
5.1 General rights (all users)
- Access: request a copy of the personal information we hold about you
- Correction: request correction of inaccurate information
- Deletion: request deletion of your account and personal information
- Opt-out of marketing: unsubscribe from marketing emails by clicking the unsubscribe link in any email or by emailing mitch@tourflip.com
- Data portability: request a copy of your data in a portable format
5.2 GDPR users (EEA, UK, Switzerland)
- Restrict or object to certain processing
- Lodge a complaint with your local data protection authority
- Be informed about automated decision-making (we do not currently engage in fully automated decision-making with legal effect)
5.3 California users (CCPA / CPRA)
- Know what personal information we collect, use, and share
- Request deletion of personal information (subject to certain exceptions)
- Opt out of the "sale" or "sharing" of personal information (we do not sell personal information in the traditional sense, but cookie-based analytics may qualify as "sharing" under CPRA)
- Non-discrimination for exercising your rights
To exercise California rights, email mitch@tourflip.com with subject line "California Privacy Rights Request."
5.4 How to exercise your rights
Email mitch@tourflip.com with your request. We will respond within 30 days, or longer if permitted by applicable law. We may need to verify your identity before fulfilling your request.
6. Data Retention
- Active accounts: retained while your account is open
- Closed accounts: retained for 90 days after account closure, then deleted or anonymized except where retention is required by law
- Transaction records: retained for at least 7 years for tax and accounting purposes
- Marketing data: retained until you opt out
- Logs and analytics: retained for up to 24 months in aggregated or anonymized form
7. Cookies and Tracking Technologies
7.1 Types of cookies we use
- Essential cookies: required for the Service to function (authentication, session management, security)
- Functional cookies: remember your preferences and settings
- Analytics cookies: help us understand how the Service is used
- Authentication cookies: managed by OAuth providers when you log in through them
7.2 Managing cookies
Most browsers allow you to refuse or delete cookies. Disabling essential cookies may impact your ability to use the Service. See our Cookie Notice for details.
8. Security
- HTTPS encryption for all data in transit
- Secure authentication including OAuth and password hashing
- Database access controls including row-level security on Supabase
- Stripe's PCI-compliant payment processing (we never see or store card numbers)
- Regular security review
No system is 100% secure. We cannot guarantee absolute security. If we become aware of a security incident affecting your data, we will notify you in accordance with applicable law.
9. International Data Transfers
TourFlip is operated from the United States. If you access the Service from outside the United States, your information will be transferred to and processed in the United States. By using the Service, you consent to this transfer.
For users in the EEA, UK, and Switzerland, we rely on Standard Contractual Clauses or equivalent legal mechanisms to transfer data outside your region in compliance with applicable law.
10. Children's Privacy
The Service is not directed to children under 13. We do not knowingly collect personal information from children under 13. If you are a parent or guardian and believe your child has provided personal information to us, contact us at mitch@tourflip.com and we will delete it.
For users between 13 and 17, parental consent is required, and parents may exercise the rights described in Section 5 on behalf of their child.
11. Changes to This Privacy Policy
We may update this Privacy Policy from time to time. The "Last Updated" date at the top reflects the most recent revision. Material changes will be communicated by posting the updated Policy on the Service and, where required, by email notice. Your continued use of the Service after changes take effect constitutes acceptance of the updated Policy.
12. Contact Us
VAST BRANDS LLC
1309 Coffeen Ave Ste 1200
Sheridan, WY 82801
United States
Email: mitch@tourflip.com
Website: tourflip.com
For privacy-specific inquiries, please use the subject line "Privacy Request" so we can route your message appropriately.
This Privacy Policy is effective as of the date listed at the top of this document. By using TourFlip, you acknowledge that you have read and understood this Privacy Policy.