Privacy Policy

1. Who we are

HeyMochila is operated by [COMPANY NAME], [TAX ID], registered at [ADDRESS]. For any privacy matter, write to [PRIVACY EMAIL].

2. What data we process

Guides and operators who use HeyMochila: name, email, phone, billing details and the tour information they set up (times, meeting points, answers).

Guests who message a guide on WhatsApp: WhatsApp profile name and number, message content, language and booking details (date, number of people).

Visitors to this website: minimal technical data (IP address, browser) in server logs, for security. This website does not use advertising or tracking cookies.

3. Our role

For guides' and website visitors' data, we are the data controller.

For guests' data, the controller is the guide or operator using HeyMochila. We process that data on their behalf and on their instructions, as a processor, under a data processing agreement.

4. Why we use the data

To provide the service: answering messages, managing bookings, sending reminders and notices on the guide's behalf (performance of contract).

To keep the service secure, fix errors and improve it, especially during alpha and beta (legitimate interest).

To meet legal obligations such as invoicing and accounting.

5. Artificial intelligence

Messages are processed by artificial intelligence models to generate replies and translations. The assistant only answers with information the guide has set up and hands the conversation to the guide when it doesn't know the answer.

We do not use guests' messages to train third-party models. [CONFIRM WITH AI PROVIDERS]

6. Who we share it with

We use providers that process data on our behalf: Meta Platforms (WhatsApp Business Platform), [HOSTING PROVIDER], [AI PROVIDER] and [EMAIL PROVIDER]. We do not sell personal data.

If a provider processes data outside the European Economic Area, we use appropriate safeguards such as the European Commission's standard contractual clauses.

7. How long we keep it

Guide account data: while the account is active and afterwards for the periods required by law.

Guest messages: [X MONTHS] after the tour date. After that they are deleted or anonymised.

8. Your rights

You can request access, rectification, erasure, restriction, objection and portability of your data by writing to [PRIVACY EMAIL]. We reply within one month.

If you are a guest, you can contact the guide you spoke with or us, and we'll help route your request.

You also have the right to complain to a data protection authority: AEPD (Spain), CNPD (Portugal) or ANPD (Brazil).

9. Security

Data is encrypted in transit and access is restricted to people who need it to provide the service.

10. Changes

If this policy changes in a meaningful way, we'll notify guides by email or WhatsApp before the change takes effect.