Privacy Policy

This is an English translation provided for convenience. The Portuguese version is the official one and prevails in case of any discrepancy.

This Policy explains how Hospedago collects, uses, stores and protects personal data, in compliance with Brazilian Law No. 13,709/2018, the General Data Protection Law (LGPD). It applies to the customers who subscribe to the system and to the guests whose data is recorded in it.

Hospedago is run by Junior da Silva Pereira, CPF (Brazilian tax ID) 145.850.076-44, who is responsible for the processing described here. Contact: contato@hospedago.com.br.

1. Roles in data processing

The LGPD distinguishes the party that decides on the processing from the party that only carries it out. At Hospedago:

• Customer account data (name of the account holder, e-mail, payment data): we act as the controller, since we define the purposes.
• Guest data entered by the property (name, CPF tax ID, contact details, stay dates): we act as the processor. The property decides what to collect and why, and is the controller of that data.

This means that requests from guests about their own data should first be addressed to the property where they stayed. We provide technical assistance whenever the property asks.

2. Data we collect

2.1 Registration and billing data

• Name of the account holder and name of the property
• Contact e-mail and phone number
• Name, WhatsApp number and property name, when you request contact through the form on the site. We use this data only to reply to your request
• Record of consent and acceptance of the terms (date and time)
• Payment transaction information provided by the payment processor

We do not store credit card data. That data is handled directly by the payment processor, which follows the PCI-DSS security standard.

2.2 Guest data entered by the property

• Name, CPF (Brazilian tax ID), address, e-mail and phone number
• Check-in and check-out dates, accommodation and accompanying guests
• Stay amounts and payment status
• Electronic signature and its supporting evidence metadata

When the property uses the government guest registration form (FNRH), we also process, on its behalf: date of birth, nationality, country of residence, gender, document (CPF or passport), purpose of the trip, means of transport and, if the guest chooses to provide them, race or ethnicity and disability. Race or ethnicity and disability are sensitive data; the form comes with the "Prefer not to say" option already selected.

2.3 Technical data and cookies

• IP address and browser identification
• Date and time of access and relevant actions (audit log)
• Strictly necessary cookies to keep the authenticated session
• A first-party cookie that keeps your choice in the cookie notice for 6 months
• Measurement cookies from Google Analytics and from the Meta pixel (Facebook and Instagram), only on the public pages of the website and only after your consent. Visitors who arrive through a link we sent on WhatsApp do not load the Meta pixel
• When you arrive through a Google, Facebook or Instagram ad, a first-party cookie keeps the identifier of that click for up to 90 days (no name, email or other personal data), so we know whether the ad brought a sign-up. If you decline cookies, it is deleted
• When you arrive through a link we sent in a WhatsApp conversation, a first-party cookie keeps the code of that link for up to 90 days (no name, phone number or other personal data in the cookie), so we know whether the conversation brought a sign-up. The code links the visit to that conversation. If you decline cookies, it is deleted
• When a visit starts from a Google, Facebook or Instagram ad, or from a link we sent on WhatsApp, we record on our own server, without cookies, the path of that visit on the public pages: pages opened, how far each page was scrolled, sections seen, buttons clicked and whether the sign-up was started or submitted. This record does not keep what is typed, the IP address or the browser, is linked only to the click identifier or the link code and is deleted after 90 days. If you decline cookies, nothing is recorded and anything already recorded for that visit is deleted
• On every visit to the home page and the FNRH page, we count on our own server, without cookies, where the visit came from (for example an ad, a search or direct access), the screen size, how far the page was scrolled, how long it stayed open and whether the visit opened the sign-up, tapped a WhatsApp button or sent a contact form. This count does not keep what is typed, the IP address or the browser, does not tell who the person is and is deleted after 90 days. If the visit ends in a sign-up, the account keeps only where the visit came from (for example Instagram, a Google search or direct access), so we know what brings customers. If you decline cookies, nothing is counted, the account does not keep this origin and anything already counted for that visit is deleted
• When you create an account or request contact through the form on the site, our server notifies Meta (Conversions API) so it knows the ad worked. If you accepted cookies, the type of notice (sign-up or contact request), the page, the IP address, the browser identification, the ad click identifier, the Meta cookies and a scrambled account number are sent. If you made no choice in the cookie notice and the visit started from a Facebook or Instagram ad, only the sign-up notice is sent, with that click identifier, the page, the IP address, the browser identification and the scrambled account number. If you declined cookies, nothing is sent. We never send name, e-mail, phone number or guest data

Inside the dashboard and on links sent to guests (contract and reservation) we use only cookies that are essential for the service to work. On the public pages of the website (home page, FNRH page, sign-up, login and legal pages) we use Google Analytics, with IP anonymization, to measure visits and sign-ups, including the results of our ads, and, with your consent, the Meta pixel, which measures the results of our ads on Facebook and Instagram and helps Meta show them to people more likely to be interested. We do not sell data and we do not show advertising inside the platform.

On your first visit, a notice asks whether you accept measurement cookies. Without your consent, Google Analytics does not store cookies in your browser and only receives signals without an identifier, used to estimate the total number of visits, and the Meta pixel is not loaded at all. If you decline, we also do not notify Meta of your sign-up. You can change your choice at any time through the "Cookies" link in the website footer.

3. Data received from booking platforms

When a property connects Hospedago to a booking platform, such as Booking.com or Airbnb, we start receiving data about its reservations. This only happens with the property's own authorization and follows these rules:

• What we receive: only what is needed to display and manage the reservations: dates, accommodation, reservation status and, when the platform provides it, the guest name and contact details.
• How we use it: exclusively to operate the account of the property that authorized the connection (calendar, contracts, finances and notifications). This data stays isolated in that account.
• What we never do: sell this data, use it for advertising, build guest profiles, pass it on to third parties other than the providers listed in this Policy, or use it to train artificial intelligence.
• Contract assistant: when the owner uses the assistant to draft a contract, we send an artificial intelligence provider (OpenAI) only the description the owner writes about the rules of their own lodging. Guest name, document, contact, address and dates are never sent, and text sent through the API is not used to train the models.
• Revocation: the property can disconnect the platform at any time. From then on, we stop receiving its data.
• Deletion: imported data is deleted when the property requests deletion or closes its account, within 30 days, unless retention is required by law.

4. Purposes and legal bases

• Providing the contracted service. Legal basis: performance of a contract (art. 7, V).
• Authenticating access and keeping the service secure. Legal basis: legitimate interest (art. 7, IX).
• Keeping an audit log of actions in the system. Legal basis: legitimate interest and compliance with a legal obligation.
• Issuing invoices and tax documents. Legal basis: legal obligation (art. 7, II).
• Sending operational notices (new reservation, signed contract, subscription expiration). Legal basis: performance of a contract.
• Proving authorship of signed contracts. Legal basis: regular exercise of rights (art. 7, VI).
• Importing reservations from platforms connected by the property. Legal basis: performance of a contract, on the instructions of the property, which is the controller of that data.
• Sending the guest registration form to the FNRH of the Ministry of Tourism, when the property uses this feature. Legal basis: compliance with a legal obligation of the property, which is the controller of that data (Law 11,771/2008; art. 7, II, and art. 11, II, a, for sensitive data).
• Measuring visits and ad results on the public pages. Legal basis: consent (art. 7, I) for measurement and advertising cookies and for the result notice sent to Meta for those who accepted cookies; legitimate interest (art. 7, IX) for cookieless counting, for recording the navigation of visitors who arrive through an ad and for the sign-up notice sent to Meta when the visit started from one of its ads and you made no choice in the cookie notice, described in section 2.3. You can object to this notice by declining cookies in the notice or through the data protection officer's e-mail.

5. Sharing

We do not sell personal data. Data is shared only with providers necessary for the operation, always limited to the minimum required:

• Infrastructure and database: Hostinger (application server) and Neon (database), both in São Paulo, Brazil.
• Payment processor: Mercado Pago, to create charges and confirm transactions.
• E-mail: Resend, to send transactional messages and to receive messages sent to our e-mail addresses.
• Abuse protection: Upstash, to rate-limit access attempts.
• Contract assistant: OpenAI, only when the owner asks for help drafting a contract, and only with the text they write about the rules of their own lodging.
• Booking platforms: those connected by the property, such as Booking.com and Airbnb, to sync calendars and reservations.
• Federal government: the guest registration form goes to the FNRH of the Ministry of Tourism, operated by SERPRO, when the property uses this feature.
• Audience measurement: Google Analytics, only on the public pages of the website, with cookies only after your consent and never with guest data.
• Advertising: Meta Platforms (Facebook and Instagram), with the pixel on the public pages only after your consent and with the sign-up or contact request notice described in section 2.3, never with name, e-mail, phone number or guest data.
• Backup copy: Google (Gmail), where the daily copy of the database is kept. It is encrypted before it leaves the server, and only the person responsible for Hospedago holds the key that opens it; Google cannot read its content.
• Public authorities: only upon a legal or court order.

The database and the application server are located in Brazil. Some auxiliary providers may process data outside the country; in those cases, the international transfer follows article 33 of the LGPD, with contractual clauses and appropriate safeguards.

6. Security

We adopt technical and organizational measures appropriate to the risk, including:

• Traffic encrypted in transit via HTTPS/TLS, with HSTS enabled
• Passwords stored only as hashes, using a slow key-derivation algorithm
• Logical isolation of each property's data, preventing cross-access
• Signed-token authentication, with revocable sessions that expire on their own
• Optional two-factor login, with a 6-digit code sent to the account email
• Rate limiting of access attempts to contain automated attacks
• Audit log of relevant actions
• Automatic daily backups with controlled retention, with an encrypted copy kept outside the server
• Continuous availability monitoring
• Hospedago administration panel with no access to guest data or to the properties' revenue
• Government integration keys stored encrypted and never displayed again

No system is completely immune. In the event of a security incident posing relevant risk, we will notify the data subjects and the Brazilian National Data Protection Authority (ANPD) within the legal deadlines. If the incident involves data received from a booking platform, we will also notify that platform without undue delay.

Found a possible security issue? Let us know at contato@hospedago.com.br. We treat every report as a priority.

7. Retention

• Account data: while the subscription is active.
• After termination: deletion within 30 days, unless retention is required by law.
• Tax documents: for the period required by tax legislation.
• Signed contracts and their metadata: for the applicable limitation period, to allow proof.
• Access logs: for at least 6 months, as required by the Brazilian Internet Civil Framework (Marco Civil da Internet).
• Guest registration form (FNRH): personal data is deleted from Hospedago 30 days after the guest checks out; the official record stays with the government.

8. Data subject rights

Under article 18 of the LGPD, you may request:

• Confirmation that we process your data and access to it
• Correction of incomplete, inaccurate or outdated data
• Anonymization, blocking or deletion of unnecessary or excessive data
• Portability to another provider, upon express request
• Deletion of data processed based on consent
• Information about whom we share your data with
• Withdrawal of consent, when consent is the legal basis

Requests can be sent to contato@hospedago.com.br and are answered within 15 (fifteen) days. We may ask for proof of identity before fulfilling a request, to protect the data against improper requests.

9. Data subjects in the European Union (GDPR)

If you are in the European Economic Area, we also uphold the rights set out in the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679):

• Access to, rectification and erasure of your data
• Restriction of and objection to processing
• Data portability in a structured, commonly used format
• Not to be subject to decisions based solely on automated processing (Hospedago does not make such decisions)
• Lodging a complaint with the data protection authority of your country

Requests use the same channel and response time as the previous section. When a request concerns reservation data, the property is the controller and we help it respond.

10. Data of children and adolescents

The Platform is not intended for people under 18. When data of minors is recorded as accompanying guests in a stay, the property is responsible for obtaining the specific consent of at least one parent or legal guardian, under article 14 of the LGPD.

In the government guest registration form (FNRH), minors are reported linked to the booking holder, because the law requires every guest to be registered.

11. Data Protection Officer

Communications about data protection should be sent to our Data Protection Officer (encarregado) at contato@hospedago.com.br.

12. Changes to this Policy

This Policy may be updated. Relevant changes will be communicated by e-mail or by a notice in the dashboard at least 30 (thirty) days in advance. The update date at the top of this page indicates the version in force.