Privacy Policy
What we do with your data when you read this site, send us an inquiry or travel with us. Written to be read, not to be survived.
Last updated:
Who is responsible
The controller for the data described here is 56.930.161 Robin Jonas Himmrich, trading as AuthenticBrazilTravel, CNPJ 56.930.161/0001-39, Servidão Amantino Cameu, 92, Rio Tavares, 88048-413 Florianópolis, SC, Brazil.
Person responsible for content and for data requests: Robin Himmrich. Email info@authenticbraziltravel.com.
The short version
You can read this entire website without giving us anything. We set no tracking cookies unless you accept them, our fonts are hosted on our own server rather than loaded from a third party, and we embed no maps, videos or social widgets.
The moment you actually give us data is when you send an inquiry. We use it to plan your trip and to answer you, and we pass on to a hotel or a guide only what they need to look after you.
We do not sell your data. With your permission, we use limited measurement to understand site use and whether an OpenAI ad led to an inquiry.
The inquiry form
When you send an inquiry, we receive what you typed: your name, your email address, and optionally your phone number, your travel window, the number of travellers, the length of the trip, your accommodation preference, the destinations or journeys you are interested in, and your message. If you used the My Journey planner, the list you assembled is sent with it.
We process this in order to answer you and to prepare a quotation, that is, to take steps at your request before entering into a contract, and on the basis of your consent given by sending the form. The legal basis is Lei 13.709/2018 (LGPD), art. 7.
The form is delivered by email to our own inbox through Resend, an email delivery provider. It is not stored in a separate database on this website.
Providing a name and an email address is necessary, because otherwise we cannot reply. Everything else is optional and only helps us give you a more useful answer.
Email, WhatsApp and phone
If you write to us by email or contact us on WhatsApp, we process the content of that conversation for the same purpose, namely to answer you and to organise your trip.
WhatsApp is operated by Meta Platforms Ireland Ltd. If you contact us there, your message and your phone number are processed on their infrastructure under their own terms and privacy policy, over which we have no control. If you would rather not use it, write to us by email instead.
If you book a trip
To make your trip happen, we pass on to each supplier only what that supplier needs. A hotel gets your name and your dates. A guide gets your name, the meeting point and, where you have told us, a dietary requirement or a mobility need. An airline gets what its booking requires.
Where you have given us health information, an allergy or a dietary requirement, we treat it as sensitive and share it only with the supplier who needs it in order to look after you safely, and only for that purpose.
The legal basis here is the performance of your contract with us, and your consent for any sensitive data.
Hosting and server logs
This website is hosted on Cloudflare. Like every web server, Cloudflare processes the technical data needed to deliver a page to you and to defend the site against attacks: your IP address, the time of the request, the page requested, the referring page and your browser identification.
We do not use these logs to identify visitors and we do not combine them with any other data. The basis is our legitimate interest in operating and securing the site.
Analytics and ad measurement, only if you say yes
We would like to know which pages people find useful. For that we use Google Analytics 4, provided by Google Ireland Ltd. We also use the OpenAI Ads Measurement Pixel, provided by OpenAI, L.L.C., to record page views and whether an ad click leads to a successfully submitted inquiry.
Nothing loads until you accept. Before you make a choice, no measurement script is requested and no measurement identifier is set. If you decline, none is loaded. The OpenAI pixel may store the ad click reference oppref in a first-party cookie so a later inquiry can be attributed to that click. We do not explicitly send the contents of your inquiry form to either measurement provider. If automatic advanced matching is enabled in Ads Manager, the pixel may recognise supported contact details in the form, normalise and hash them in your browser, and send only the resulting SHA-256 hashes rather than the raw details.
You can change your mind at any time using "Cookie settings" in the footer. Declining costs you nothing and changes nothing about how the site works for you.
Details of what Google and OpenAI do with data are in their privacy policies at policies.google.com/privacy and openai.com/policies/privacy-policy.
Cookies and local storage
We use no cross-site tracking. The following entries may be stored in your browser:
ybg-consent records whether you accepted or declined analytics, so that we do not ask you again on every page. Without it the banner would reappear constantly.
ybg-journey holds the trips and destinations you added to the My Journey planner, so your selection survives a page reload. It stays in your browser until you clear it or send it with an inquiry.
Google Analytics sets its own identifiers after you accept. The OpenAI pixel may set __oppref after an eligible ad click, also only after you accept. Clearing your browser storage removes these entries.
Where your data goes
We are based in Brazil, so data you send us is processed in Brazil. Our providers operate internationally, which means your data may be processed outside your own country:
Cloudflare, hosting and delivery of this website. Resend, delivery of the inquiry email. Calendly LLC, scheduling, only if you book a call, and only the name, email address and answers you type on their page. Google Ireland Ltd., analytics, only with your consent. OpenAI, L.L.C., ad conversion measurement, only with your consent. Google Workspace, our business email. Suppliers in Brazil, only what is needed to deliver your trip.
We use these providers because they are needed to run the service you asked for. We do not pass your data to anyone else, and we do not sell it.
How long we keep it
An inquiry that does not lead to a booking is deleted after 24 months, unless you ask us earlier.
If you book, we keep the booking documents for 5 years after the end of your trip, because Brazilian tax and commercial law requires us to be able to produce them.
Your consent record stays in your own browser until you clear it or change your choice.
Your rights
Under the Brazilian General Data Protection Law (LGPD, Lei 13.709/2018, art. 18) you may ask us at any time to confirm whether we process your data, to give you access to it, to correct anything incomplete or wrong, to anonymise, block or delete data that is unnecessary or processed unlawfully, to give you your data in a portable form, to tell you who we shared it with, and to withdraw a consent you gave.
Withdrawing consent does not affect what was lawful before you withdrew it.
Write to info@authenticbraziltravel.com. We will answer within 30 days, and we will not ask you to justify the request.
If you believe we handled your data wrongly, you may complain to the Brazilian data protection authority, the Autoridade Nacional de Proteção de Dados (ANPD), at gov.br/anpd.
Security
This site is served over HTTPS only. The inquiry form is validated and length limited on the server before anything is sent on. Access to our email inbox is protected by two factor authentication.
No system is perfect. If a breach ever affected your data in a way that could cause you harm, we would tell you and the ANPD.
Children
This website is meant for adults planning travel. We do not knowingly collect data from children. Where a child travels as part of a family booking, we process only the name, age and any dietary or medical detail that a supplier needs, provided by the adult who books.
Changes to this policy
If we change what we do with data, we change this page and update the date at the top. There is no version archive, so if a change matters to you, keep a copy.