Privacy Policy

1. Who we are

Gramado Explorer is a digital gastronomic guide for visitors and residents of Gramado and Canela (Rio Grande do Sul, Brazil), with restaurants, attractions, rankings and weather-aware recommendations.

The controller of the personal data processed on this site is Gramado Explorer. For any privacy-related matter, write to gramadoexplorer@gmail.com.

2. What data we collect

You can browse restaurants, attractions and rankings without an account. We collect data only in the situations below.

• Account data: email and password (stored encrypted) when you create an account. If you sign in with Google, we receive only your basic profile information, such as name, email address and photo. We do not access your Gmail, Drive, contacts, calendar or any other data in your Google account.
• Service usage data: restaurants you favorite, recommendation history and the preferences you provide (for example, cuisine types and price range).
• Approximate location: if you allow it, your browser shares your position so we can show the distance to a restaurant or attraction. This calculation happens on your device and the location is not stored on our servers.
• Technical and browsing data: IP address, device type, browser, language, pages visited, referral source and interaction events (for example, clicks on directions or WhatsApp contact). This data is collected through cookies and similar technologies.
• Messages and feedback: information you voluntarily send us by email or feedback forms.

3. How we use your data

• Create and maintain your account and let you sign in.
• Save your favorites, history and preferences, and personalize recommendations.
• Show restaurants and attractions near you and suited to the current weather.
• Measure site performance, understand how it is used and fix errors.
• Send transactional emails related to your account, such as sign-up confirmation.
• Prevent fraud and abuse and comply with legal obligations.

4. Legal bases

We process your data under the following LGPD legal bases: performance of the service you requested (art. 7, V), consent, when you allow location or non-essential cookies (art. 7, I), legitimate interest, for security, statistics and service improvement (art. 7, IX), and compliance with legal obligations (art. 7, II).

5. Who we share data with

We do not sell your personal data. We share data only with service providers that process it on our behalf, and only what is necessary for each function:

• Supabase: authentication, database and storage of your account information.
• Vercel and Cloudflare: hosting, site delivery, security and performance metrics.
• Google: Sign in with Google (when you choose it), Google Analytics and Google Tag Manager for usage statistics.
• Hotjar and Appzi: heatmaps, session recordings and feedback collection to improve the experience. Password fields are not recorded.
• Sentry: error and stability monitoring.
• SendGrid: delivery of transactional emails.
• Artificial intelligence providers: used to summarize public restaurant reviews. We do not send them users’ personal data.
• Public authorities, when required by law or court order.

6. Cookies and similar technologies

We use essential cookies to keep your session and remember your language, and analytics cookies to understand how the site is used. You can block or delete cookies in your browser settings, but some features, such as staying signed in, may stop working.

7. How long we keep data

We keep your account data while your account is active. Browsing and statistics data are kept for the periods defined by each analytics tool. When you delete your account, we erase or anonymize your personal data, except what we must keep to comply with legal obligations or defend our rights in legal proceedings.

8. Your rights

Under the LGPD, you may at any time, upon request:

• Confirm that we process your data and access it.
• Correct incomplete, inaccurate or outdated data.
• Request anonymization, blocking or deletion of unnecessary data or data processed unlawfully.
• Request data portability.
• Withdraw consent and request deletion of data processed based on it.
• Obtain information about who we share your data with.
• File a complaint with the Brazilian National Data Protection Authority (ANPD).

9. How to exercise your rights and delete your account

Send an email to gramadoexplorer@gmail.com from your registered address, stating what you want. To request deletion of your account and associated data, use "Delete my account" as the subject. We reply within 15 days.

10. Security

We adopt technical and organizational measures to protect your data, such as encrypted connections (HTTPS), encrypted password storage, access control and database security rules. No system is completely secure, but we work to reduce risks and, in case of a relevant incident, we will notify you and the ANPD as required by law.

11. International data transfers

Some of the service providers listed above may store or process data outside Brazil. In those cases, we seek providers that adopt adequate data protection safeguards, as required by the LGPD.

12. Children and teenagers

Gramado Explorer is not directed to anyone under 18 and we do not knowingly collect data from children or teenagers. If you believe a minor has sent us data, contact us so we can delete it.

13. Links to other sites

The site contains links to third-party services such as Google Maps, WhatsApp and restaurant websites. We do not control and are not responsible for the privacy practices of those sites. We recommend reading their policies.

14. Changes to this policy

We may update this policy to reflect changes in the service or in the law. The date of the last update appears at the top of this page. Relevant changes will be highlighted on the site.

15. Contact

Questions, requests or complaints about privacy: gramadoexplorer@gmail.com.