Back to sign in

1REALTOUR

Privacy Policy

Last updated August 17, 2026

This policy explains what personal data the 1REALTOUR portal collects, why we collect it, who processes it on our behalf, and what you can ask us to do with it.

1. Scope

This policy covers the 1REALTOUR portal at portal.1realweb.net and its supporting APIs. It does not cover third-party websites you reach from links inside the portal. Using the portal is also subject to our Terms and Conditions.

2. Data we collect

  • Account data — name, work email address, avatar, role, department, and client or project assignments.
  • Authentication data — hashed credentials, session and refresh tokens, password reset and invitation tokens, and sign-in timestamps.
  • Work content — projects, tasks, tickets, comments, chat messages, time entries, attendance records, and uploaded files.
  • Inbound communications — email sent to our support addresses, which is turned into tickets, along with the sender address, subject, and body.
  • Technical data — IP address, browser and device information, pages and API routes requested, and error and performance traces.

3. Why we use it

We use this data to authenticate you and enforce role and department permissions, to operate project, ticket, and time-tracking features, to send transactional email such as invitations and password resets, to keep the service secure and diagnose faults, and to meet legal and contractual obligations. We do not sell personal data, and we do not use it for advertising.

4. Legal bases

Where the GDPR or a similar law applies, we rely on performance of a contract (providing the portal to you or to your employer), our legitimate interests (security, fault diagnosis, service improvement), your consent where we ask for it, and compliance with legal obligations.

5. Processors and sub-processors

We share data only with providers who process it on our instructions:

  • Hosting and application delivery — Vercel, and 1REALTOUR-operated servers.
  • Database, authentication, and file storage — Supabase, running on 1REALTOUR-operated infrastructure.
  • Error tracking and monitoring — Sentry and OneUptime, which receive error reports and telemetry that can include request URLs, user identifiers, and stack traces.
  • Email delivery and inbound mail — our 1REALTOUR-operated mail infrastructure.
  • AI-assisted features — OpenRouter and the model providers it routes to, which receive the content of the message or email being processed. We do not send credentials to these providers.

Some of these providers operate outside your country, including in the United States. Where required, transfers rely on standard contractual clauses or an equivalent safeguard.

6. Retention

Work content is retained for as long as the related client or project record is active, and afterwards as needed for contractual, accounting, or legal reasons. Session tokens expire automatically. Invitation and password reset tokens expire shortly after issue. Error and telemetry data is retained on a rolling window set by each monitoring tool. Backups are retained on a rotating schedule and are deleted as they age out.

7. Security

Access is protected by authenticated sessions, role-based permissions, and database row-level security. Traffic is encrypted in transit. Administrative access to production systems is limited to staff who need it. No system is perfectly secure; if a breach affects your personal data we will notify you and any regulator as required by law.

8. Your rights

Depending on where you live, you may have the right to access, correct, delete, restrict, or object to our processing of your personal data, to receive a portable copy, and to withdraw consent. Email support@1REALTOUR.com and we will respond within the period the applicable law requires. If you are a client user, some requests may need to be routed through the organization that gave you access, because they control that data.

9. Cookies and local storage

The portal stores authentication tokens and interface preferences in cookies and browser storage. These are required for the service to function; we do not use advertising or cross-site tracking cookies.

10. Children

The portal is a business tool and is not directed to anyone under 18. We do not knowingly collect personal data from children.

11. Changes and contact

We may update this policy. Material changes will be reflected in the "last updated" date above. Questions, requests, and complaints can be sent to support@1REALTOUR.com.