Privacy policy

This policy explains what Tucanoo collects, why, who else processes it and what your rights are. The controller of your data is TUCANOO VENTURES DESENVOLVIMENTO DE SOFTWARE CUSTOMIZAVEL LTDA, which provides Tucanoo: a Brazilian company, CNPJ (Brazilian company registration number) 69.619.489/0001-80, registered office at Rua Visconde de Pirajá, 414, sala 718, Ipanema, Rio de Janeiro, RJ, CEP 22410-002, Brazil. Contact for anything about your data: hello@tucanoo.app.

What we collect

• Account: email, name and photo (the one you upload or the one from your Google account; if you sign in with Apple you can hide your email, and then we get an Apple address that forwards to you), language, country and reference currency.
• Trips: destinations, dates, who travels with you, the itinerary and every change made to it, your "Want to go" list. Anyone with a trip's invite link joins it and sees the itinerary, the chat, the group's documents and the travelers' emails; the link is valid for 30 days, and whoever created the trip can create a new one at any time (the old one stops working).
• Chat: the text of what you ask the AI, kept to improve the answers. It is never sent to analytics tools.
• What you type: at some moments we keep the text you write in the app (the trip sentence, searches, questions, links and notes) for training and internal improvements, and to retrace your steps when something goes wrong. It stays with us, is never sent to analytics tools and is deleted after 180 days.
• Connected assistants (Claude, Grok, ChatGPT): when you connect an assistant to your account, we keep its name, when it was connected and when it was last used. What it sends (the trip sentence, requests, stop names) is handled like what you type. Which tool it used and whether it worked go to usage analytics, with the same account code (never what it sent). What it reads from your trips is also covered by the rules of the assistant's company, under your account there. You can disconnect anytime under You > Connected assistants; access ends right away. If someone gets the connection code wrong, we keep only a hashed summary of the internet address, for one day, to block guessing. For each request from the assistant we keep only its type (the tool used, whether it worked) and the same hashed summary of the address, deleted after 7 days, to stop abuse; the record is deleted after 180 days.
• Vault: files you upload (tickets, bookings, itineraries), kept for up to 30 days after the trip ends and then deleted. Personal documents stay until you remove them and are never read.
• Stop photos: the photos you add to the itinerary, resized on your device before upload. The location and time stored in the photo are read only to find the right stop; the stored photo does not carry them, and the location is never shown to anyone. Before it goes in, the thumbnail is checked by the AI (Anthropic) to block inappropriate content.
• Invites (referrals): when you invite someone by email, we keep the address you typed to send one invite and, at most, one reminder; it is deleted after 90 days, and the person who gets it can ask not to get any more. Whoever joins through your link, your email invite or an invite to one of your trips is linked to your account, and you see their first name, whether they joined and whether they bought Pro (nothing else). When someone buys, we keep the identifier the payment provider gives the card (never the number), only to check whether a friend's purchase was made with the referrer's card.
• People who sell itineraries in the store: full name or company name, CPF or CNPJ and Pix key, used only to pay out sales and meet tax obligations. They stay with us and never go to analytics tools.
• Travel preferences: where you leave from, when your day starts, how much you walk, dietary needs, mobility and notes, used only to build itineraries (interests picked in older versions stay stored, unused).
• App usage: screens visited, buttons tapped and anonymous session recordings, to understand what works. Analytics tools only get a code that identifies the account, never your email or name, and the Vault, document and profile screens are hidden in recordings. During the trip, only with your permission, the location of your device to know which stop you are at.
• Payments: what you bought and when. Card and Pix details are handled by the payment provider and never reach us.

Why we use it, and on what legal basis

• To build and adjust your itineraries, run the trip companion, let the people you invite edit with you and process your purchases: performance of the contract you asked for.
• To notify you about your trip by app notification or email (you can turn this off in your profile): performance of the contract and your consent.
• Usage analytics, session recordings and location during the trip: your consent, which you can withdraw at any time.
• Security, fraud prevention and improving the product: our legitimate interest in running a safe and useful service.
• Keeping payment records: legal obligation.

The AI builds suggestions from real places; it does not make decisions about you that have legal or similarly significant effects.

Who processes it for us

Processors that run the service: Supabase (database and sign in), Vercel (hosting), Anthropic (the AI that builds itineraries and reads chat requests and uploaded files; under its commercial terms it does not use this data to train its models), Google (sign in, maps and place data), Apple (sign in, when you continue with Apple), PostHog and Microsoft Clarity (app usage), Travelpayouts (site verification and counting clicks on flight links; the script loads on every page, so it receives your IP and browser, but no cookie or account data), Resend (email), Stripe (payments) and, when you buy something, the booking partner. We do not sell your data.

Cookies and ads

On the app's introduction pages (the ones our ads open), we keep for 90 days which page and which campaign brought you, to learn what works. Those pages also load the Meta, Google, TikTok and Reddit pixels, which count whether an ad brought someone and let us show the app's ads to past visitors. In Brazil, the European Union, the United Kingdom and Switzerland they only load with your permission, given in the notice on your first visit; elsewhere they load by default and we honor your browser's Global Privacy Control signal. These pixels never run inside the app and never receive what you type. To change your mind, use the Cookies link at the bottom of those pages or clear cookies in your browser.

International transfers

Tucanoo is operated from Brazil and its providers store and process data in other countries, mainly the United States. Where the GDPR applies, these transfers rely on the safeguards offered by those providers, such as the European Commission's standard contractual clauses.

How long we keep it

While your account exists. Vault files: 30 days after the trip. What you type: 180 days. Email of people you invited: 90 days. Payment records: as long as tax law requires. Payout details of people who sell itineraries: while the account exists; the record of each payout made stays as long as tax law requires. When you delete your account, your email, name, photo, preferences, personal documents, what you type, your "Want to go" list, your Take me there answers, your device location and the photos you added to stops are deleted, and connected assistants lose access; chat requests stay without their text; changes you made to a shared itinerary stay without your name, because they are part of the other travelers' trip.

Your rights

You can access, correct, download and delete your data, object to or restrict some uses, and withdraw consent at any time. In your profile you can edit your name and photo, download a file with everything we have about you and delete your account. For anything else, write to hello@tucanoo.app and we will answer within 30 days. You can also complain to your data protection authority: in the EU or UK, the authority of your country; in Brazil, the ANPD.

Children

Tucanoo is not meant for people under 16, and we do not knowingly collect their data.

Security

Data travels encrypted, access to the database is limited to our servers, and personal documents are only visible to you. No system is perfect: if a breach affects you, we will tell you and the authorities as the law requires.

Changes

We will tell you about important changes to this policy in the app or by email.