This Privacy Policy explains how Favela Experience collects, uses, and protects your personal data when you use our website (favelaexperience.tours) and book our tours. We process personal data in accordance with the Brazilian General Data Protection Law (LGPD, Lei 13.709/2018).

1. Who is responsible for your data

Data Controller: Favela Experience Turismo Local LTDA (CNPJ 26.248.405/0001-37).
Address: Av. Presidente João Goulart, 825, Vidigal, Rio de Janeiro – RJ, CEP 22452-000, Brazil.
Data Protection Officer (Encarregado): reachable at favelaexperiencetours@gmail.com.

2. Data we collect

We collect only what we need to deliver your booking and run our service:

Identity and contact: full name, email address, phone number
Booking details: tour selected, date, time, group size, and any notes you provide
Payment data: processed by Stripe. We never see or store your card number
Communications: contact-form submissions and chat messages (website and WhatsApp)
Technical data: IP address and basic device/browser information, for security and to operate the site

We do not collect your location, photos, identity documents, or banking details through this website, and we do not sell your data or share it with advertisers.

3. Why we use your data, and our legal basis

Under LGPD Art. 7, each use rests on a specific legal basis:

Confirm and deliver your booking: performance of a contract
Process your payment: performance of a contract
Send booking confirmations, reminders, and post-tour follow-ups: performance of a contract
Answer your messages and provide support: legitimate interest
Prevent fraud and abuse, and keep the service secure: legitimate interest
Keep accounting and tax records: legal obligation
Send our newsletter: your consent (which you may withdraw at any time)

We do not use your data for automated decisions that produce legal or similarly significant effects on you, and we do not sell your data or share it with advertisers.

4. Service providers we share data with

We share the minimum necessary data with the providers that run our service:

Stripe, Inc.: payment processing (USA)
Supabase, Inc.: database and file storage (USA)
Resend: sending transactional email (USA)
Meta Platforms (WhatsApp Cloud API): booking confirmations, reminders, and customer chat (USA)
Anthropic PBC: powers our chat assistant (website and WhatsApp). When you ask the assistant about a specific booking, your trip details (tour, date, time, group size, status) are sent to generate a reply. Your name, email, and phone are not sent (USA)
Sentry: error monitoring (USA)
PostHog: website analytics (page views and on-site interactions), used to understand and improve the site (USA)

International transfers:these providers store data on servers in the United States, so your data is transferred outside Brazil. These transfers are covered by standard contractual clauses and the providers' data-processing agreements, in line with LGPD Art. 33.

5. How long we keep your data

Booking and payment records: 5 years (Brazilian fiscal and tax obligations)
Chat and support messages: up to 2 years
Newsletter subscription: until you unsubscribe
Technical logs: kept only as long as needed for security

6. Your rights under the LGPD

Under Lei 13.709/2018 you may, at any time:

Confirm whether we process your data and access a copy of it
Correct incomplete, inaccurate, or outdated data
Request anonymisation, blocking, or deletion of unnecessary data
Request portability of your data in a structured format
Withdraw consent where consent is the legal basis
Be informed about the providers with whom we share data

To exercise any right, email favelaexperiencetours@gmail.com with the subject "LGPD Request". We respond within 15 days. If you believe your rights have not been respected, you may contact Brazil's National Data Protection Authority (ANPD).

7. Security and incidents

We use TLS encryption in transit, encryption at rest, and row-level access controls so each record is reachable only by authorised systems. Payments are handled by Stripe (PCI-DSS Level 1). We never store card numbers in plain text. If a security incident occurs that may bring relevant risk or harm to your personal data, we will notify the National Data Protection Authority (ANPD) and affected users as required by LGPD Art. 48.

8. Cookies and analytics

We use essential cookies needed for the site to function (for example, to keep your session and remember a referral link). We also use analytics (PostHog) to measure anonymous, aggregate usage so we can improve the website. Our analytics runs in cookieless mode: it does not store cookies or persistent identifiers on your device. We do not use advertising cookies, we do not sell your data, and we do not track you across other websites.

9. Minors

Our tours may be booked for minors only by an accompanying parent or legal guardian, who provides and consents to the minor's booking data. We do not knowingly collect personal data directly from anyone under 18 through this website. If you believe a minor has provided us data directly, contact us and we will delete it.

10. International visitors

Most of our guests travel from abroad. If you are in the European Union, United Kingdom, or another region with its own data-protection law, you keep the mandatory rights granted by the law of your country of residence, in addition to those above.

11. Mobile app

A Favela Experience mobile app is in development. It is not yet available, and this policy covers our website only. A separate privacy policy will apply to the app and will be published when the app launches.

12. Changes to this policy

We will post any material change here and update the date above at least 15 days before it takes effect. Continued use after that date constitutes acceptance.

13. Contact

Favela Experience: Data Privacy
Favela Experience Turismo Local LTDA · CNPJ 26.248.405/0001-37
Av. Presidente João Goulart, 825, Vidigal, Rio de Janeiro – RJ, CEP 22452-000
Email: favelaexperiencetours@gmail.com

Questions? Contact us.