Privacy policy

Who is responsible for the data

Bombinhas Guia is a digital guide to the Bombinhas peninsula in Santa Catarina, Brazil. The party responsible for the personal data handled here (the controller, in the language of the LGPD) is Bombinhas Guia.

For anything about privacy, write to contato@bombinhasguia.com.br.

What happens if you only browse the guide

You do not need an account, and you do not have to give a name, e-mail or phone number to see the map, places, events and sea conditions.

• We count how many times a place or event was opened and how many times someone tapped WhatsApp, directions, call or Instagram. It is just a number per day, with no IP, no identifier and no way to link the count to you.
• We do not use tracking cookies, Google Analytics, ad pixels or similar tools.
• Your browser keeps, on your own device (localStorage), the places you saved, the light or dark theme and the code of a coupon you picked up. None of it goes to our server, with one exception: when you pick up a coupon, the coupon's random token is sent and stored only as a hash. If you clear your browser data, it all disappears.
• If you pick up a coupon, our server stores a code, a hash of a random token made by your browser, the time the coupon was issued and whether it was redeemed. That does not identify you: there is no name, e-mail, phone number or IP next to it.
• A language preference cookie (NEXT_LOCALE) keeps only the language you chose (pt, es or en), for up to 1 year, and does not identify you.
• To work without internet, the browser keeps copies of public pages, the map and the places list in the device's cache storage (Cache Storage). Panel and sign-in pages are never kept, and the Sign out button deletes the page copies. Clearing the site data removes the rest.
• Like any internet server, ours may record the IP address and technical details of each request in log files. They are used only for security and to find faults, and are deleted periodically. The IP is also used, in memory only, to limit abuse: excessive login, counter and coupon attempts.

Location

The guide only asks for your location when you tap "Use my location". It is used to show what is nearby and the distance to each place, and it is worked out on your device. We do not receive, store or log your position. If you deny the permission, everything keeps working, without the distances.

Third-party services that appear in the guide

• Map: the map drawing, the tile files and the fonts are on our own server. Your browser does not contact any third-party map server. The map data comes from OpenStreetMap, hence the credit "© OpenStreetMap contributors".
• Sea, wind and sun: our server (not your browser) calls Open-Meteo. None of your data goes there.
• Google Maps, Waze, WhatsApp and Instagram: they only open when you tap "Directions", WhatsApp or Instagram. From there, each one's own privacy rules apply.

Data of people who list a business

To use the merchant panel we handle this data:

• Your e-mail, used to send the access link. There is no password. The link is valid for 15 minutes and works once. The e-mail never appears on the site.
• The business details you write: name, category, address, neighborhood, phone, WhatsApp, Instagram, website, opening hours, description, tips, prices, events and coupons. The business phone, WhatsApp and other contacts are public on the place page, because you are the one who put them there.
• The photos and event flyers you upload.
• The history of changes and requests made in the panel (for example, a request to manage a place or to remove a place), so the team can check them and undo mistakes.
• A session cookie called "sessao", which keeps you signed in for up to 30 days. It is needed for the panel to work, tracks nothing and is deleted when you tap Sign out.

Who the data goes to

We do not sell personal data. For the service to work, a few providers receive the minimum they need:

• E-mail sending service: receives your e-mail to deliver the access link.
• Automatic translation service (xAI Grok): receives the texts the merchant writes (place descriptions and tips, event titles and descriptions, coupon titles and details) to translate them into Spanish and English. We send only the text, without e-mail or name. The provider may be outside Brazil.
• Server hosting, where the database and the photos are kept.
• Authorities, when the law or a court order requires it.

Why we may handle this data

For merchants, the basis is performance of a contract or of the steps before it (you ask to appear in the guide) and, in some respects, compliance with a legal obligation. For security and abuse prevention, legitimate interest. For location, your consent, given by tapping the button, which you can withdraw at any time. The daily counts do not identify anyone.

How long we keep it

• Daily counts: as long as the place or event exists in the guide.
• Merchant account and data: as long as the account is active. If you ask for deletion, we delete or anonymize within 30 days, except what the law requires us to keep. Backups may take a little longer to be replaced.
• Access links: 15 minutes. Session: up to 30 days.
• Server access logs: for a short period, only for security and diagnosis.

Your rights

The LGPD (art. 18) gives you, where applicable, the right to confirm that we handle your data, access it, correct it, ask for anonymization, blocking or deletion of what is unnecessary, ask for portability, know who we share it with, withdraw consent and object to a processing. To exercise any of them, write to contato@bombinhasguia.com.br. We reply within 15 days.

If you think something was not resolved, you can complain to Brazil's National Data Protection Authority (ANPD).

Children and teenagers

Anyone can read the guide, and since we do not ask readers for data, we do not collect information about minors. Merchant sign-up is for people over 18 or those who legally represent the business.

Security

The site uses HTTPS, access links are stored only as a hash, the panel requires sign-in and the admin area is limited to the team. No system is completely secure. If an incident that may cause relevant risk happens, we tell those affected and the ANPD, as the law requires.

Changes to this policy

When this text changes in a relevant way, the update date above changes and merchants must accept the new version before using the panel again.