Last updated: October 24, 2026
Mighty Tour (“Mighty Tour”, “we”, “us”) is tour-management software operated by Marc Gratch Consulting, Fort Worth, Texas, USA. This policy explains what personal data we collect through this website (mightytour.app), the Mighty Tour application at api.mightytour.app, hosted artist pages, the public API and the Mighty Tour WordPress plugin (together, the “Service”), why we collect it, who we share it with, and the choices you have.
1. Who we are and how to reach us
Marc Gratch Consulting is responsible for the personal data described here. For questions about this policy or to exercise your rights, write to us through our contact page and mention “privacy” in your message. Where your team uses the Service to store information about other people (for example crew members or promoters), your team decides what is stored and why; we process that information on your team’s behalf.
2. Information we collect
Account information. Your name, email address and password (stored only as a one-way hash), two-factor authentication settings if you turn them on, the teams you belong to, your role on each team and the preferences you choose.
Content your team adds. Artists, tours, venues, show dates, schedules, day sheets, guest lists, contacts, crew profiles, travel, settlements and other financial records, merch, contracts, documents and anything else your team enters or uploads.
Sensitive personal information. To advance a tour, crew profiles can hold dates of birth, passport and visa details, driver’s licence, national ID and health card numbers, emergency contacts, allergies, dietary needs and medical notes. Your team decides whether to enter any of this. These fields, and documents uploaded to the Service, are encrypted at rest with a key protected by AWS Key Management Service, are shown only to team members whose role allows it, and are used only to run your tours.
People who are not users. Your team may store details about promoters, venue staff, crew and guests. When a promoter opens an advance link we record when it was opened, the IP address and the browser used, so your team can see who has viewed the advance.
Billing information. Payments are handled by Stripe. We store your plan, subscription status, Stripe customer identifier and the brand and last four digits of the card on file. Full card numbers are entered directly with Stripe and never reach our servers.
Connected services. If your team connects a calendar, a merch store (Shopify, Square or WooCommerce) or DocuSign, we receive the information needed for that connection, such as sales and order records for your merch, or the names and email addresses of people asked to sign a contract. If you turn on browser notifications we store the notification address your browser gives us.
Technical information. Our servers log IP addresses, browser details, the pages requested and timestamps to keep the Service working and secure. Logs are kept for a short period and then deleted. We do not use analytics or advertising trackers.
Website visitors. If you write to us through the contact form we keep your name, email address and message so we can reply. The website and the application load fonts from Adobe Fonts, and the website also loads fonts from Bunny Fonts; those providers receive your IP address when your browser requests the fonts.
3. Google and Microsoft calendars
If you connect a Google Calendar or a Microsoft 365 calendar from Settings → Calendar, Mighty Tour adds your upcoming show dates to that calendar as events and updates those events when the show changes. We request only the permissions this needs: for Google, calendar.events plus your basic profile (name and email address) so we can show which account is connected; for Microsoft, Calendars.ReadWrite plus your basic profile.
We create and update only the events Mighty Tour adds, and we keep their identifiers so we can update them. We do not read, list, copy or analyse any other events in your calendar. Access tokens are stored encrypted and are deleted when you disconnect the calendar or delete your account. Events already added stay in your calendar until you remove them.
Mighty Tour’s use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. We use Google user data only to provide the calendar feature you turned on. We do not sell it, do not use it for advertising, do not use it to train artificial-intelligence or machine-learning models, and do not let people read it unless you ask us to, it is needed for security, or the law requires it.
4. How we use information
- To provide, maintain and secure the Service, and to help you when you contact us.
- To send transactional email through Amazon SES: password resets, email verification, team invitations and the day sheets your team chooses to send. We do not send marketing email.
- To send browser notifications you have turned on.
- To bill paid plans and to prevent fraud and abuse.
- To meet our legal obligations.
We do not sell personal information, and we do not share it for advertising.
5. Information you choose to publish
Tour dates and artist profiles that your team marks as public appear on hosted artist pages, in the public API and calendar feeds, and on websites that use the Mighty Tour WordPress plugin. Anyone can see that information, and search engines may index it. Your team can unpublish it at any time.
6. Service providers
We share personal information only with the providers that help us run the Service, only for that purpose, and under contracts that protect it:
- Amazon Web Services: hosting, encryption keys and email delivery (United States).
- Cloudflare: DNS, encryption in transit and protection against attacks.
- Laravel Forge: management of our servers.
- Stripe: payments and subscriptions.
- Mapbox: maps, venue address lookup and travel routes.
- Google and Microsoft: calendar sync, only when you connect a calendar.
- DocuSign: electronic signatures, only when your team sends a contract.
- Shopify, Square and WooCommerce: merch sales import, only when your team connects a store.
- Your browser’s push service (for example Apple, Google or Mozilla): notifications, only when you turn them on.
- Adobe Fonts and Bunny Fonts: web fonts.
We may also disclose information if the law requires it, to protect the rights and safety of our users or the public, or as part of a sale or reorganisation of the business, in which case this policy will continue to apply.
7. Where information is stored
The Service is hosted in the United States. If you use it from elsewhere, your information is transferred to and processed in the United States.
8. Retention and deletion
We keep account information and team content for as long as the account is active. You can delete your own profile from Settings; it is removed immediately. Account owners can export their team’s data and delete the team account from Settings. Deleting an account cancels any paid subscription straight away, and the account and its data stop being accessible immediately. Thirty days later the account, its content and its uploaded files are permanently erased; payment records held by Stripe are kept as tax law requires. Copies may remain in backups for a limited time before they are overwritten.
9. Security
All traffic to the Service is encrypted. Passwords are hashed, two-factor authentication is available to every user, sensitive fields and documents are encrypted at rest, each team’s data is kept separate from every other team’s, and access to production systems is limited to the people who operate the Service. No system is perfectly secure; if we learn of a breach that affects your information we will tell you without undue delay.
10. Your rights
Depending on where you live, you may have the right to access, correct, export or delete your personal information, to restrict or object to certain processing, and to withdraw consent you have given. You can do most of this yourself in the application. For anything else, contact us through the contact page; we will respond within 30 days. You may also complain to your local data-protection authority. We do not sell personal information or share it for cross-context behavioural advertising, and we will not treat you differently for exercising your rights.
11. Cookies
The application uses only cookies it needs to work: one that keeps you signed in, one that protects forms against cross-site request forgery, and, if you tick “Remember me”, one that keeps you signed in between visits. This website sets no advertising or tracking cookies. Cloudflare may set a cookie to protect the Service against automated abuse.
12. Children
The Service is for working professionals and is not directed at children under 16. We do not knowingly collect their personal information. If you believe a child has given us personal information, contact us and we will delete it.
13. Changes to this policy
If we change this policy we will post the new version here and update the date at the top. If a change is significant, we will also tell account owners in the application or by email before it takes effect.