tripey

Privacy Policy

Last updated: September 15, 2026

This is a translation of the Portuguese version, which prevails in case of any difference.

Also in: Português · Español · Français · Deutsch

This policy explains which personal data Tripey processes when you use the website, the questionnaire, the itinerary and your account: what it is used for, who it is shared with, how long it is kept and how you exercise your rights. It follows Brazil's General Data Protection Law (Law 13,709/2018, the LGPD) and, for people in the European Union, the General Data Protection Regulation (GDPR).

1. Who is responsible

The controller of the personal data processed in the service is 53.475.728 Rodrigo Moreira Ancora da Luz, a Brazilian individual microentrepreneur (MEI) registered under CNPJ no. 53.475.728/0001-36, with a business address at Rua Primeiro de Março, 101, Centro, Rio de Janeiro (RJ), 20010-000, Brazil, who runs Tripey ("Tripey", "we"). For any privacy matter, including contacting the person in charge of data protection, write to hello@tripey.com.br.

2. What data we process

When you answer the questionnaire

First name, last name and email;
Your answers about the trip: destination, dates, length, who you travel with (solo, couple, friends or family, and whether there are children or people over 60, without anyone's name or age), pace, interests, approximate budget, what you want to include or avoid and your arrival and departure details (times, airports or stations);
E-ticket, if you attach one: the file is read once to extract dates, times, airports and flight numbers. It isn't stored anywhere, and your name, booking code, ticket number, loyalty program and seat are never extracted;
Location, if you allow it: the location where the questionnaire was filled in, stored with reduced precision (about 100 meters) and converted into city, state and country. Without permission, we only use the approximate region of the connection (city and country), without storing the IP address.

In your account

Email, name and sign-in method (Google or a code sent by email);
Signing in with Google: name, email and profile photo. We have no access to your password, contacts, emails or files.

When you use the itinerary

Stops marked as done, stops and notes you add, edits, adjustments requested from the artificial intelligence and how many times the itinerary was opened.

In payments

Product purchased, amount, payment method, fee and any refund, as reported by Mercado Pago. We don't receive or store your card details: payment happens in Mercado Pago's environment.

In the referral program

The code you create, who signed up or bought through your link (your screen only shows their first name and a partially hidden email) and the free itineraries earned.

Technical data

Device type (phone or computer), the page the visit came from and the link's campaign parameters, the country of the connection and how far you got in the questionnaire;
The IP address is used only to limit abuse, such as repeated attempts, and is deleted within 2 days. The website visit count uses neither cookies nor IP addresses. Cloudflare Web Analytics, a tool from the company that hosts the website, measures visits and page speed in aggregate, with no cookies and without identifying visitors.

In the website's help assistant

The messages you write and the assistant's replies, the language, the type of device, the country of the connection and the page where the conversation started. The assistant does not ask for or need personal data: do not write ID documents, card numbers or passwords. To generate a reply, messages are sent to the artificial intelligence provider, without your name or e-mail.

3. What we use it for and on what legal basis

Purpose	Legal basis (LGPD)
Building and delivering your itinerary, including sending the necessary answers to the artificial intelligence provider	Performance of a contract (art. 7, V)
Creating and maintaining your account and access to it	Performance of a contract
Processing payments and complying with tax and consumer protection obligations	Performance of a contract and legal obligation (art. 7, II)
Sending service emails: itinerary link, sign-in code and the reminder the day before the trip	Performance of a contract
Recording the precise location where the questionnaire was filled in	Consent (art. 7, I), which you can withdraw in your device's permissions
Security, fraud prevention and usage limits	Legitimate interest (art. 7, IX)
Measuring use of the website, questionnaire and itinerary to improve the product	Legitimate interest
Referral program and free itineraries	Performance of a contract
Answering questions in the website's assistant and improving its answers	Legitimate interest

We don't sell your data and don't use it for third-party advertising. The artificial intelligence builds the itinerary from your answers, and you can edit everything; no automated decision is used to assess you, set prices or deny access to the service.

4. Who we share it with

Only with processors that provide the service on our behalf, each receiving the minimum necessary and following our instructions and their own data protection commitments:

Artificial intelligence provider: receives the questionnaire answers to build the itinerary, without last name or email. Under the contracted terms, this data is not used to train models;
Payment processor (Mercado Pago): processes the payment in its own environment;
Email delivery service: delivers the service messages;
Cloud infrastructure: hosts the website and the database;
Maps, places, photos and documents services: receive place and destination names to show maps, ratings, photos and the itinerary's PDF, without your name or email. When you allow location, the maps service receives the approximate coordinate to convert it into a city;
Google: when you choose to sign in with your Google account;
Public authorities: when required by law or a court order.

A list of the processors by name can be requested at any time at the email in section 1.

5. International transfer

Some processors (cloud, artificial intelligence, email, maps and sign-in) store or process data outside Brazil, mainly in the United States and the European Union. These transfers take place to deliver the service you signed up for, with contractual data protection safeguards compatible with the LGPD (art. 33).

6. How long we keep it

Data	Period
Account, itineraries, edits, progress and referrals	For as long as the account exists
Purchased itineraries	For as long as the service exists, so the link keeps opening before, during and after the trip, or until you ask for deletion
Questionnaire submissions from people who didn't buy or create an account (name, email, answers and location)	12 months after the last submission
Orders started and never paid	12 months
Payment records (amount, method, fee and refund)	5 years, due to tax and consumer protection obligations
Usage records (questionnaire screens, itinerary events, website visits and email deliveries)	13 months
Account access session	Up to 90 days, or until you sign out
IP address used to limit abuse	Up to 2 days
Sign-in code sent by email	1 day (it is valid for 10 minutes)
E-ticket file	Not stored
Conversations with the website's help assistant	13 months
Trips built from scratch without signing in	90 days without use (when you sign in, they move to your account)

Once these periods end, the data is deleted automatically. A record may be kept longer when the law requires it or for defense in judicial, administrative or arbitration proceedings.

7. Cookies and data stored on your device

We only use what the service needs to work, with no advertising cookies and no third-party tracking:

Session cookie: keeps you signed in to your account for up to 90 days;
No-account trip cookie: links to this browser the trips you build from scratch before signing in, for up to 400 days; when you sign in, they move to your account and the cookie is deleted;
Google sign-in cookie: lasts 10 minutes and protects the return from sign-in against forgery;
Browser local storage: the questionnaire draft (so you can pick up where you left off), the itinerary's progress and edits (so it works offline), display preferences and, for up to 30 days, the referral code from the link you opened.

You can clear cookies and site data in your browser settings. This ends the session and deletes what was saved on the device, such as the questionnaire draft.

8. Your rights

Under the LGPD (art. 18), you can, at any time and free of charge: confirm whether we process your data; access it; correct incomplete, inaccurate or outdated data; request the anonymization, blocking or deletion of unnecessary or excessive data or data processed in breach of the law; request portability; request the deletion of data processed with your consent; find out who we share it with; be informed that you may refuse consent and what that changes; withdraw your consent; and object to processing based on legitimate interest.

How to exercise them: in My account you can correct your name and delete your account. For other requests, write to hello@tripey.com.br. We reply within 15 days and, to protect you, we may ask for confirmation that the request came from the owner of the email.

When you delete your account: the account, trips built from scratch, referrals and unused free itineraries are removed. Purchased itineraries are no longer linked to you and keep opening only through their link; to also delete a purchased itinerary, write to the email above. Payment records are kept for the period in section 6.

If you're not satisfied with our answer, you can file a complaint with Brazil's National Data Protection Authority (ANPD) at gov.br/anpd or, in the European Union, with the data protection authority of your country.

9. Security

We use an encrypted connection (HTTPS), store only a cryptographic summary (hash) of session and sign-in codes, restrict access to the internal dashboard and limit repeated attempts. No system is completely immune: if a security incident occurs that could pose a relevant risk or harm to you, we will notify you and the ANPD, as required by law.

10. Children and teenagers

The service is intended for people over 18. The information that the trip includes children is used only to adapt the itinerary and doesn't identify any child.

11. Data received from Google

When you sign in with Google, we use your name, email and profile photo only to create and identify your account and to show your name in the app. This data isn't sold, isn't used for advertising and is only shared with the processors in section 4 as needed to provide the service. Our use complies with the Google API Services User Data Policy, including the Limited Use requirements.

12. Changes to this policy and contact

When this policy changes materially, we will let you know on the website and, if you have an account, by email before the change takes effect. The date of the last update is at the top of this page.

Questions or requests about privacy: hello@tripey.com.br.