Vagare Privacy Policy
Effective date: September 29, 2026
This is a translation of the original Portuguese version. If the versions differ, the Portuguese version prevails, unless the law of your country requires the version in your language to prevail.
This Policy explains what personal data Vagare collects, what it uses it for, who it shares it with and how you can exercise your rights. It applies to users in every country where Vagare is available and follows the Brazilian General Data Protection Law (Law No. 13,709/2018, "LGPD"), the European Union General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), the United Kingdom's version of that regulation ("UK GDPR") and the data protection laws of the other countries where the app is offered. Section 10 explains what changes depending on the country where you live.
1. Who is responsible for your data
The data controller is MRK Consultoria em Tecnologia da Informação Ltda., registered under CNPJ 43.498.662/0001-46, located at Rua Vinte e Oito de Julho, 77, apt. 84, Edifício Dolce, Fundação, São Caetano do Sul/SP, Brazil, postal code 09520-610. For the GDPR and the UK GDPR, MRK is the "controller".
Data protection officer: Marcos Antonio Santos de Oliveira, by email at marcos.a.santos.oliveira@gmail.com. He is also the person in charge of the protection of personal information under Quebec law and the grievance officer under Indian law.
2. What data we collect
| Category | Data | How we obtain it |
|---|---|---|
| Account | Name, email and password (stored encrypted) | You provide it when signing up |
| Itineraries | Destinations, dates, travel preferences, activities, notes and titles | You provide it or the assistant generates it at your request |
| Conversations with the assistant | Messages you write and the generated replies | Use of the assistant |
| Photos and audio sent to the assistant | Attached images and voice recordings | You send them in the chat |
| Activity photos | Images you add to an itinerary activity | You add them in the itinerary |
| Sharing | People you share an itinerary with and each person's access level | Use of sharing |
| Subscription | Account identifier, plan, purchase, renewal and expiration dates | App store and RevenueCat |
| App usage | Usage events (screens viewed, features used, sign-up and login errors), account identifier, name and email | Collected automatically during use |
| Survey answers | Reason for cancelling the subscription and any text you write in the open field | You answer when cancelling |
| Resource consumption | Number of itineraries, adjustments, messages, transcriptions and images used | Collected automatically during use |
Vagare does not collect your location from the device's GPS, your contacts or your payment details. Subscription payments are processed entirely by Apple; we never have access to your card.
We do not ask for sensitive data, such as information about health, religion, racial or ethnic origin, political opinions or sex life. Avoid including it in the chat. If you do, it will be used only to answer your request and is subject to the same deletion periods as in section 7.
3. What we use the data for
| Purpose | Data used | Legal basis under the LGPD | Legal basis under the GDPR and the UK GDPR |
|---|---|---|---|
| Create and maintain your account | Account | Performance of a contract (art. 7, V) | Performance of a contract (art. 6(1)(b)) |
| Generate, adjust and store itineraries | Itineraries, conversations, photos and audio sent to the assistant | Performance of a contract (art. 7, V) | Performance of a contract (art. 6(1)(b)) |
| Send your data to artificial intelligence | Conversations, preferences, photos and audio sent to the assistant | Consent (art. 7, I), requested before first use | Consent (art. 6(1)(a)), requested before first use |
| Share itineraries with people you invite | Itineraries and sharing | Performance of a contract (art. 7, V) | Performance of a contract (art. 6(1)(b)) |
| Manage usage limits and the subscription | Resource consumption and subscription | Performance of a contract (art. 7, V) | Performance of a contract (art. 6(1)(b)) |
| Understand how the app is used and fix problems | App usage and survey answers | Legitimate interest (art. 7, IX) | Legitimate interest (art. 6(1)(f)) |
| Send account emails, such as password resets | Account | Performance of a contract (art. 7, V) | Performance of a contract (art. 6(1)(b)) |
| Comply with legal obligations and respond to authorities | Data required in each case | Legal obligation (art. 7, II) | Legal obligation (art. 6(1)(c)) |
Our legitimate interest is to improve the app and fix failures. You can object to this use at any time (section 9).
- We do not sell your data and we do not use it for advertising.
- We do not share your data for targeted advertising based on your behavior in other apps and websites.
- We do not use your data to train artificial intelligence models.
- We do not make solely automated decisions that produce legal or similarly significant effects on you.
4. Artificial intelligence
The Vagare assistant uses OpenAI, an artificial intelligence company based in the United States. When you use the assistant, we send OpenAI your messages, the trip's destinations, dates and preferences, the photos you attach and the audio you record.
- The assistant is an artificial intelligence and presents itself as such. You are not talking to a person.
- We ask for your permission before the first time we send anything. You can decline and keep using the app without the artificial intelligence features.
- OpenAI does not use data received through its API platform to train its models.
- OpenAI keeps this data for up to 30 days for abuse monitoring and to continue conversations.
- Vagare does not keep the photos and audio sent to the assistant after processing them.
- Itineraries and replies generated by artificial intelligence may contain errors. Check opening hours, prices and important information before you travel.
You can withdraw this permission at any time under Account → AI assistant.
5. Who we share data with
We share data only with the providers the app needs to work. They act as processors: they process the data only to provide the service to Vagare, according to our instructions and under a contract with data protection obligations compatible with this Policy. Apple acts as an independent controller of the purchase data.
| Provider | Role | Data received | Location |
|---|---|---|---|
| Amazon Web Services | Hosting, database, file storage, login and account emails | All app data | United States |
| OpenAI | Assistant's artificial intelligence | Conversations, preferences, photos and audio sent to the assistant | United States |
| PostHog | App usage analytics | Usage events, account identifier, name, email and in-app survey answers | United States |
| RevenueCat | Subscription management | Account identifier and subscription history | United States |
| Apple | App distribution and subscription billing | Purchase data, under Apple's policy | As defined by Apple |
| Google (Places) | Place information and photos | Names and addresses of the places in the itinerary | United States |
| Unsplash | Illustrative destination images | Destination names | United States |
| OpenRouteService | Route calculation between activities | Coordinates of the places in the itinerary | Germany |
We also share data:
- with the people you invite to view or edit an itinerary. They see the itinerary's content and your name;
- with apps you choose to open, such as Google Maps, Waze or WhatsApp. From that point on, those apps' privacy policies apply;
- with authorities, when required by law or court order;
- with a potential buyer or successor, if Vagare is sold or merged. That company will be bound by this Policy, and we will notify you beforehand.
Activity photos are reachable at a public address that is hard to guess. Anyone who receives that address can see the image.
6. International transfers
MRK is based in Brazil, and our providers store and process data mainly in the United States. Your data may therefore be processed outside your country, in places with different data protection laws, and be subject to access requests from the authorities of those countries.
We protect these transfers as follows:
- Brazil: under art. 33 of the LGPD, including data protection contractual clauses adopted by the providers;
- European Union, European Economic Area and Switzerland: with the standard contractual clauses approved by the European Commission or, when the provider is certified, with the EU-U.S. Data Privacy Framework and its Swiss extension;
- United Kingdom: with the UK addendum to the standard contractual clauses or with the UK extension to the Data Privacy Framework;
- other countries: with contracts that require providers to maintain a level of protection compatible with this Policy.
You can request a copy of these safeguards at the email address in section 14.
7. How long we keep data
| Data | Retention |
|---|---|
| Account, itineraries, activity photos and shares | While the account exists |
| Unsaved itinerary drafts | Deleted automatically after 7 days |
| Conversations with the assistant | Deleted automatically after 7 days |
| Photos and audio sent to the assistant | Not kept by Vagare; kept by OpenAI for up to 30 days |
| Sharing invitations | Expire after 30 days |
| Usage events | Deleted automatically after 30 days |
| Subscription records and data required by law | For the applicable legal period |
8. How to delete your account and your data
You can delete your account at any time under Account → Delete account. Deletion is immediate and erases your login, your itineraries, activity photos, sharing invitations, usage records and your RevenueCat profile, except for data we must keep by law.
Conversations with the assistant are deleted automatically within 7 days, as described in section 7.
If you shared itineraries, the people who received them lose access, because the itinerary no longer exists.
Deleting your account does not cancel your subscription. To stop being charged, cancel under Settings → your name → Subscriptions on your iPhone before deleting. After deletion we can no longer identify your subscription to help you.
9. Your rights
Whatever your country, you may request at any time:
- confirmation that we process your data, access to it and a copy of it;
- correction of incomplete, inaccurate or outdated data;
- deletion of your data;
- portability of your data, in a structured and commonly used format;
- restriction of processing, or blocking and anonymization of data that is unnecessary or processed in breach of the law;
- objection to processing based on legitimate interest;
- withdrawal of consent, without affecting what was done before it;
- information about who we share your data with.
Send your request to marcos.a.santos.oliveira@gmail.com. It is free of charge. We reply within 15 days and may ask for information to confirm that the request is yours. You may also make the request through an authorized representative. Exercising your rights does not change the price or the quality of the service you receive.
If we deny your request, we will explain why, and you can ask for the decision to be reviewed by replying to the same email. You can also file a complaint with the data protection authority of your country (section 10).
10. What changes depending on the country where you live
Brazil
You have the rights under art. 18 of the LGPD and can file a complaint with the Autoridade Nacional de Proteção de Dados (ANPD).
European Union, European Economic Area, Switzerland and United Kingdom
- The legal bases for each use are in section 3, and the rights under arts. 15 to 22 of the GDPR are in section 9.
- When a use is based on your consent, you can withdraw it at any time, as easily as you gave it.
- You can file a complaint with the data protection authority of the country where you live or work, or where the alleged infringement took place. In Spain, the Agencia Española de Protección de Datos (AEPD); in Portugal, the Comissão Nacional de Proteção de Dados (CNPD); in Ireland, the Data Protection Commission (DPC); in the United Kingdom, the Information Commissioner's Office (ICO).
United States
- The categories of data we collect are in section 2, the purposes in section 3 and the recipients in section 5.
- We do not sell personal data, we do not share it for cross-context behavioral advertising and we do not use sensitive data to infer characteristics about you.
- The rights in section 9 include the rights to know, access, correct and delete your data, and also apply to residents of California and of the other states with privacy laws.
- Vagare does not track you across third-party apps and websites. For this reason, "Do Not Track" and Global Privacy Control signals do not change how the app works.
Canada
- You have the rights of access, correction and withdrawal of consent provided for in the Personal Information Protection and Electronic Documents Act (PIPEDA) and, in Quebec, in Law 25.
- Before transferring data outside Quebec, we assess whether it will be adequately protected.
- You can file a complaint with the Office of the Privacy Commissioner of Canada or, in Quebec, with the Commission d'accès à l'information du Québec.
- This Policy and the Terms of Use are available in French.
Australia and New Zealand
- Your data is sent to the overseas providers listed in section 5, mainly in the United States.
- You can file a complaint with the Office of the Australian Information Commissioner (OAIC) or with the Office of the Privacy Commissioner of New Zealand.
India
- The grievance officer is the data protection officer named in section 1.
- After contacting him, if the matter is not resolved, you can escalate it to the Data Protection Board of India.
Latin America and other countries
You have the rights provided for in the data protection law of your country, such as Ley 25.326 in Argentina, Ley 1581 de 2012 in Colombia, Ley 19.628 in Chile, Ley 29733 in Peru, Ley 18.331 in Uruguay and the federal personal data protection law of Mexico. You can exercise them at the email address in section 9 and file a complaint with the data protection authority of your country.
In Argentina: the Agencia de Acceso a la Información Pública (AAIP), as the supervisory authority of Ley 25.326, has the power to receive complaints and claims from anyone whose rights are affected by non-compliance with the rules on the protection of personal data.
11. Security
We use encrypted connections, passwords stored encrypted and access control to our systems. No system is completely immune to failures; if a security incident with relevant risk occurs, we will notify you and the competent authorities within the periods required by applicable law.
12. Minimum age
Vagare is not intended for anyone under 18, in any country. We do not knowingly collect data from minors. If we learn that an account belongs to a minor, it will be deleted.
13. Changes to this Policy
We may update this Policy. Relevant changes will be announced in the app before they take effect, and the date at the top of this page shows the current version.
14. Contact
Privacy questions and requests about your data: marcos.a.santos.oliveira@gmail.com.