Privacy Policy
Last updated: September 25, 2026
The short version: we collect only what we need to send you the guide, run your membership and book your tickets. We don't sell your data. You can ask us to see, correct or delete it anytime at [email protected].
1. Who is responsible for your data
The controller is 49.771.932 GABRIEL XAVIER PARAIZO (CNPJ 49.771.932/0001-27), Rua Fernando Monteiro Lindenberg, 200, Praia da Costa, Vila Velha, ES, 29101-100, Brazil, operating the travelhackbr brand. Contact: [email protected].
2. What we collect and why
| Data | When | Why | Legal basis (GDPR) |
|---|---|---|---|
| Name and email | You ask for the free guide | Send the guide and follow-up emails about miles, deals and VIP Access | Consent. You can unsubscribe from any email |
| Name, email, phone, Telegram username (optional), billing country | You buy VIP Access | Run your membership, give you channel access, contact you about it | Contract |
| Payment details | Checkout | Process the payment. Handled by Stripe, and we never see your full card number | Contract |
| Messages you send us | Telegram, email, WhatsApp | Answer you and quote trips | Contract / legitimate interest |
| Passenger details (full name as in passport, date of birth, document number, nationality, contact) | You ask us to book a ticket | Issue the ticket with the airline or loyalty program | Contract |
| Purchase and invoice records | Every payment | Accounting and tax obligations | Legal obligation |
| Technical data (IP address, browser) | You visit the site | Deliver the site securely and prevent abuse | Legitimate interest |
We don't make automated decisions about you and we don't sell or rent your personal data.
3. Who we share it with
Only with the services we need to run travelhackbr, each bound by its own privacy and security terms:
- Stripe: payments and billing.
- Resend: sending emails.
- Telegram: the VIP channel and members chat. Other members can see your Telegram name in the chat.
- Cloudflare: site delivery and security.
- Hostinger: the server where the site and our records are hosted.
- Google Fonts: loads the fonts on our pages, which shares your IP address with Google.
- Airlines and loyalty programs: passenger details, only when you ask us to book a ticket.
- Our accountant and authorities: when the law requires it.
4. International transfers
Our team and systems are outside the European Union, and some of our providers are in the United States. When your data leaves the EU/UK, we rely on the safeguards our providers offer, such as the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework.
5. How long we keep it
- Guide subscribers: until you unsubscribe or ask us to delete your data.
- Members: while your membership is active, then up to 2 years to handle questions and guarantee requests.
- Passenger and booking records: as long as needed for the trip and any changes, and after that only what accounting and tax laws require us to keep (usually 5 years).
6. Cookies
Our pages currently use only what's strictly necessary to work. We don't use advertising or analytics cookies today. If we add them, we'll ask for your consent first (where the law requires it) and update this policy.
7. Your rights
Wherever you live, you can ask us to:
- see the data we have about you and get a copy,
- correct it,
- delete it (except what we must keep by law),
- stop or limit how we use it, or object to it,
- withdraw your consent to emails, anytime, with the unsubscribe link.
Email [email protected] and we'll reply within 30 days.
8. Security
We use encrypted connections (HTTPS), restricted server access and trusted providers. No system is 100% secure, but if a breach affects you, we'll tell you as the law requires.
9. Children
VIP Access is for adults. We don't knowingly collect data from anyone under 18, except passenger details a parent or guardian gives us to book a child's ticket.
10. Changes
If we change this policy in a meaningful way, we'll update the date above and let members know.