Security and your data
What the AI sees, where your tour data lives, and who can get to it.
Advance holds your routing, your contacts, and your money. Here is what happens to it, in plain language. The Privacy Policy is the formal version.
What the AI sees
When you forward an advance or upload a document, Advance sends that content to Anthropic to pull out the schedule, contacts, and deal terms. Two things are true about that:
- Anthropic does not use it to train their models. That is our API agreement with them, not a preference setting.
- We send only what the parsing needs.
What comes back is not a show yet. It lands as an unreviewed advance for you to check, and it becomes a show when you say so. Nothing is published to your crew in the meantime.
If you would rather the AI never see a particular thread, don’t forward it. Every field the parser fills you can also type yourself.
What we never do
We do not sell your information. We do not use your content to train AI models, ours or anyone else’s. There is no advertising on Advance, so there is nobody to sell it to.
Where it lives
Your data sits in a Postgres database run by Supabase on AWS, encrypted in transit and at rest.
Row-level security isolates each team’s data at the database layer, which means the wall between one band’s data and another’s is enforced by the database itself, not by application code that could forget. Our serverless functions run with scoped access controls.
Who can see it
- Admins see everything on the team, including the deal and the settlement.
- Artists see the tour and edit the band’s own corners of it: the set list and the song catalogue behind it, the guest list, food recs. They never see deal, settlement, or revenue surfaces at all. Those fields are withheld on the server, not hidden in the interface.
- Guests never log in. A guest link is a long random token that opens one show, or one tour, and nothing else. Deal and financial fields are stripped before the page is ever sent to their browser. You can revoke any link.
That last one matters for the way this job actually works. Your opener needs the load-in time. Your opener does not need your guarantee. So the guarantee never leaves our server on that request.
Who else touches it
Running the app means a handful of companies handle parts of it:
| Who | What they do |
|---|---|
| Supabase (on AWS) | Database, sign-in, files |
| Vercel | Hosting |
| Resend | Sending your day sheets and invites, and receiving the advances you forward |
| Anthropic | Parsing advances |
| Google Maps Platform | Venue lookup, addresses, time zones |
| Slack | Only for teams that connect a workspace |
The Privacy Policy lists exactly what each one processes.
Getting your data out, or deleting it
Your shows are yours. Export a day sheet as a PDF any time, subscribe to your dates as a calendar feed, and ask us for a full export whenever you want one.
You can delete your account and its data from inside the app: Settings → General → Delete account. It takes the teams you own with it. If you would rather we did it, email hello@advancetouring.com.
Still have a question
Ask a real one and get a real answer: hello@advancetouring.com.