Privacy Policy — Aventura
Last updated: September 24, 2026 Version: 2026-09-24
This Policy explains how Aventura processes personal data. It is written primarily under Brazil’s General Data Protection Law — LGPD (Law 13,709/2018). Mandatory rights under the law where you live continue to apply.
1. Controller and privacy contact
Aventura is the name of the service. The data controller is the individual responsible for operating it and deciding the purposes and means of the processing described in this Policy.
Privacy and data-rights contact: support@aventura.app
This channel receives data-subject requests and communications about data protection.
2. Data we process
2.1. Account and consent
Name, email address, account identifier, the version and time of your acceptance of the legal documents and, when you sign in with Google, the identifier supplied by Google. When you register with a password, authentication is managed by Supabase; we do not receive your password in readable form.
2.2. Planning data and Itineraries
Origin city, destinations, dates, budget and currency, number of travellers, number and age ranges of children, interests, pace, transport, accommodation, free-text notes, editing requests, and the generated Itinerary.
Do not enter sensitive personal data, identity-document numbers, unauthorised third-party data, confidential information, or trade secrets. Content entered in free-text fields may be sent to the artificial-intelligence provider to fulfil your request.
2.3. Subscription and payment
Plan, status, currency, billing period, Stripe identifiers, Subscription dates, and billing events. Stripe processes complete card details; Aventura does not store them.
2.4. Technical, usage, and security data
IP address and country inferred from it, an application-generated device identifier, browser and device information, date and time, pages and features accessed, generation and editing counters, request, failure, and security logs, and signals used to prevent fraud or abuse.
2.5. Browser storage
We use local and session storage to maintain authentication, record the accepted document versions, temporarily preserve an in-progress generation, remember language and currency preferences, and maintain caches required for the service. A strictly functional cookie may remember the state of interface components.
We do not currently use advertising cookies or our own behavioural-advertising or audience-analytics tools. External services loaded by a page may receive technical data necessary to deliver their features, as described in Section 5.
2.6. Data received from third parties
We may receive basic authentication information from Google and Subscription or payment information from Stripe. Map, venue, route, image, flight, and exchange-rate providers return results related to searches made by the Platform.
3. Purposes and legal bases
| Purpose | Main data | LGPD legal basis |
|---|---|---|
| Create, authenticate, and maintain the account | Account, consent, and security | Contract or pre-contractual steps (Art. 7(V)) |
| Generate, edit, save, and display Itineraries | Planning data, Itinerary, and account | Performance of contract (Art. 7(V)) |
| Process Subscriptions and billing | Account, Subscription, and payment | Contract and legal obligation (Art. 7(II) and (V)) |
| Enforce limits and prevent fraud or abuse | Technical data, device, and counters | Legitimate interest (Art. 7(IX)) and protection of the service |
| Set language, currency, and regional content | IP address, inferred country, and preferences | Legitimate interest (Art. 7(IX)) |
| Provide support and respond to rights requests | Account, contact, and request context | Contract, legal obligation, and legal claims (Art. 7(II), (V), and (VI)) |
| Maintain security, diagnose failures, and defend rights | Logs and case-specific data | Legitimate interest and legal claims (Art. 7(VI) and (IX)) |
| Improve performance and quality | Technical metrics and aggregated or anonymised data | Legitimate interest; effectively anonymised data is not personal data |
When relying on legitimate interest, we consider necessity, impact, and the data subject’s reasonable expectations. You may object through the channel in Section 1.
We do not send marketing communications without a valid legal basis and a simple opt-out method.
4. Artificial intelligence and automated decisions
4.1. Itinerary generation and editing are automated. They produce travel suggestions and do not, by themselves, create legal or similarly significant effects concerning you.
4.2. We also use automated rules to enforce limits, control quotas, and identify possible abuse. These rules may temporarily restrict an action or account.
4.3. You may request information and contest an automated restriction through support@aventura.app. Where applicable, you may also request the review provided by LGPD Article 20, subject to trade-secret protections.
5. Who we share data with
We share only the data required for each function. A provider’s role may vary between processor and independent controller depending on the service it supplies.
| Provider or category | Function | Data that may be transmitted |
|---|---|---|
| Supabase | Authentication, database, and storage of accounts and Itineraries | Account, consent, Subscription, and Itineraries |
| Sign-in, fonts, Cloud Run server, venue search, photos, and routes | Sign-in data when selected; technical data; venue, city, and route names | |
| Cloudflare | Site delivery and protection, Turnstile, and R2 image storage | Technical data, security signals, and images |
| Stripe | Checkout, billing, and Subscription portal | Account, billing, and payment data |
| DeepSeek | Artificial-intelligence generation and editing | Planning data, editing requests, and free-text notes |
| Geoapify, HERE, and OpenStreetMap/Nominatim | Maps, geocoding, venue and route search and verification | Searched place, city, route, and request metadata |
| Apify, Bright Data, Brave Search, and Google | Searching for and obtaining venue images | Search terms and venue and city names |
| Frankfurter and ExchangeRate-API | Currency exchange rates | Requested currencies and request metadata |
| unpkg | Delivery of map-library files | Request metadata |
| RapidAPI and travel-data providers | Flight and other travel searches, when available | Origin, destination, dates, and search parameters |
We may also disclose data where necessary to comply with a valid legal requirement, protect rights and security, or assess a transfer of the service, always subject to applicable law.
We do not sell personal data or provide it to data brokers or behavioural-advertising networks.
Partner links
Booking links may contain a destination, dates, number of travellers, and an affiliate identifier. When you open the link, the Partner also receives ordinary browsing data and processes that information under its own privacy policy. Partners may include flight, accommodation, activity, and car-rental platforms.
6. International transfers
Several providers process data outside Brazil. In particular, planning data sent to DeepSeek may be processed in the People’s Republic of China. Other providers may process data in the United States, Europe, or globally distributed infrastructure.
We limit transmitted data to what each function requires and do not send your password or complete card details to the artificial-intelligence provider. Transfers must rely on a mechanism permitted by LGPD Article 33 as applicable, including necessity to perform the service you requested (Art. 33(IX) together with Art. 7(V)) or applicable contractual safeguards.
7. Your rights
Under the LGPD, you may request:
- confirmation of processing and access to your data;
- correction of incomplete, inaccurate, or outdated data;
- anonymisation, blocking, or deletion of unnecessary, excessive, or unlawfully processed data;
- portability, subject to applicable regulation and trade-secret protections;
- information about sharing and the consequences of withholding data;
- deletion of consent-based data and withdrawal of consent;
- objection to unlawful processing or, where applicable, processing based on legitimate interest;
- review of automated decisions in the cases provided by law.
Send requests to support@aventura.app. Confirmation and simplified access will be provided immediately where possible; a complete access statement will be provided within 15 days under LGPD Article 19. Other requests will be handled free of charge within the applicable legal period. We may request reasonable information to verify your identity.
If our response is unsatisfactory, you may petition Brazil’s National Data Protection Authority — ANPD — or contact a competent consumer-protection body.
8. Retention and deletion
| Category | Retention criterion |
|---|---|
| Account and profile | While the account is active; after that, until deletion is completed, subject to legal retention duties |
| Saved Itineraries | Until you delete the Itinerary or close the account |
| Temporary generation data | As long as necessary to complete, recover, or diagnose the generation |
| Acceptance records | As long as needed to demonstrate the accepted version and exercise legal rights |
| Subscription, billing, and related records | For periods required by tax, accounting, fraud-prevention, and legal-claims obligations |
| Application, error, and security logs | Ordinarily up to 6 months; longer where needed for security, legal obligations, or legal claims |
| Browser data | Until removed by the application, sign-out, applicable expiry, or your browser settings |
Providers may retain copies for the period necessary to supply their service, protect security, or comply with their own legal obligations. Where immediate deletion is not possible, use will be restricted to the grounds that justify retention.
9. Security
We use technical and organisational measures proportionate to risk, including encryption in transit, access controls, server-side token validation, credential separation, database access policies, and security logging.
No system is completely secure. Where an incident may cause relevant risk or harm, we will notify the ANPD and affected data subjects within the applicable period — currently, as a general rule, 3 business days after becoming aware — with the information required by regulation.
10. Children and adolescents
Account creation and purchase are intended for people aged 18 or over. Planning may include the number and age ranges of children solely to tailor suggestions, without needing to identify them. Do not enter a minor’s name, identity document, photograph, or other identifying data in free-text fields.
11. Changes to this Policy
We may update this Policy to reflect changes in the product, providers, or law. We will give notice of material changes by email or through the Platform where necessary. The current date and version appear at the top.
12. Contact
To exercise your rights, submit a complaint, or ask a privacy question, email support@aventura.app.