Skip to content

Privacy Policy

Last updated: September 28, 2026

Privacy Policy — QViagem (Private Beta)

Private beta privacy notice. QViagem is an experimental, invite-only service operated by an individual in Brazil. This notice is written in plain language and was not reviewed by a licensed lawyer.

Release: 2026-09-28 Effective date: 2026-09-28

This Privacy Policy explains how QViagem processes personal data when you use the Service. It covers the essentials of the Brazilian General Data Protection Law (LGPD).

1. Who we are and how to contact us

The controller of your personal data is Marcelo, an individual, operating QViagem in Brazil. QViagem is not a company.

Privacy questions and requests: contato@meuacessorapido.com.br. We receive messages at this address during the private beta. We do not publish a street address while the Service remains a private, non-commercial beta.

2. What we collect

  • Account data: email address, authentication identifiers, and profile settings you provide (such as display name, language, and currency).
  • Trip content: trips, destinations, activities, transport and accommodation entries you create, and AI prompts and outputs.
  • Usage and credits: AI credit consumption, feature usage, and cycle data.
  • Technical data: IP address and user agent for security, session tracking, rate limiting, and audit logs.
  • Private beta invitations: a hashed invitation token, the email an invitation is claimed with, and an 18+ confirmation. We never store the raw invitation token.

We do not collect device precise geolocation or infer your jurisdiction from your IP address. Travel locations in an itinerary may include place names, addresses, and map coordinates for the places you plan to visit.

3. Why we process it and legal bases

  • Provide and operate the Service, including AI trip planning — performance of a contract.
  • Authenticate users, secure accounts, prevent abuse, and keep audit logs — legitimate interests and legal obligations.
  • Operate the invite-only private beta — legitimate interests (limiting the beta to invited people).
  • Communicate service and legal notices — contract, legal obligations, and legitimate interests.

We do not currently process personal data for marketing, advertising, sale, sharing, or non-essential analytics.

4. AI processing

AI planning features send your prompts and the instructions needed to generate a response to our AI provider, Google Gemini. We may also make a separate request to count input tokens. Do not submit sensitive personal data, payment credentials, government identifiers, health information, precise private locations, or another person's confidential information to an AI prompt.

AI output is generated automatically and may be inaccurate. We record usage measurements such as model, feature, token counts, credits charged, and limited response metadata; the current usage ledger does not store the prompt or the generated output.

5. Recipients and international transfers

We use the following providers, which may process data outside your country:

  • Supabase — database and authentication.
  • Vercel — application hosting and delivery.
  • Google (Gemini) — AI generation.
  • Cloudflare Email Routing — forwarding messages sent to our contact address.
  • Google (Gmail) — storing and reading those forwarded messages.

Where personal data is transferred internationally, we rely on safeguards permitted by applicable law.

Paid payment providers (Asaas and Stripe) are not active during this beta, and payments are not processed.

6. Retention

We keep personal data only as long as necessary for the purposes above, plus any statutory retention periods. As a starting point for this private beta, we keep:

  • pseudonymous legal acceptance evidence for up to 6 years;
  • security audit logs for up to 365 days;
  • stale login sessions for up to 90 days;
  • abandoned signup intents for up to 7 days (plus a 24-hour technical grace);
  • terminal private-beta invitation records for up to 30 days;
  • unconfirmed account-deletion requests for up to 30 days.

Pseudonymous legal evidence may survive account deletion because it no longer directly identifies you.

7. Your rights

Subject to applicable law (including the LGPD), you may request confirmation, access, correction, deletion, portability, restriction, objection, information about sharing and international transfers, and withdrawal of consent where processing is based on consent. To exercise your rights, email contato@meuacessorapido.com.br. You can also export or delete your account yourself in Settings. You may complain to the competent data protection authority (in Brazil, the ANPD).

8. Cookies and similar technologies

We use strictly necessary cookies and browser storage for authentication, security, and preferences you request (such as language and theme), and a short-lived HttpOnly cookie to complete invite-only signup. We also use tab-scoped session storage for AI prompts and unsaved trip drafts, cleared on explicit sign-out. We do not use non-essential analytics, advertising, or third-party tracking technologies. Because there is no sale, sharing, or behavioral advertising, a Global Privacy Control signal has no processing to limit in this release.

9. Security

We apply technical and organizational measures to protect personal data, including access controls, rate limiting, and audit logging.

10. Children

The Service is for adults only. You must be at least 18 years old to create an account, and we do not knowingly process data of children or adolescents.

11. Changes

We may update this Policy. Material changes will be notified and, where required, acknowledged through the Service.

12. Contact

Privacy questions and requests: contato@meuacessorapido.com.br.