Privacy Policy

This Policy explains what personal data we process when you use viajai.cl, app.viajai.cl or the ViajAI iOS app, what we use it for, and what you can require from us.

• 1. Who the controller is
• 2. What ViajAI does
• 3. What data we process
• 4. What we use it for
• 5. Cookies
• 6. Who we share it with
• 7. How long we keep it
• 8. Your rights
• 9. International transfers
• 10. Minors
• 11. Security
• 12. Changes
• 13. Contact
• 14. Regional supplements

1. Who the controller is

The data controller is Pedro Giovanni Kara Carmo, Chilean tax ID 21.733.782-8, domiciled at California 2468, Providencia, Chile, trading as “ViajAI”.

For any privacy matter or to exercise your rights: privacidad@viajai.cl. For general support: soporte@viajai.cl.

2. What ViajAI does

ViajAI generates travel itineraries with artificial intelligence and helps you coordinate the trip with your group: splitting expenses, storing documents, tracking entry requirements and receiving alerts while travelling. You need an account to use it. Your first trip is free; paid plans come after that.

3. What data we process

What we do NOT collect

• Precise location: the app never asks for location permission and never reads your GPS.
• Contacts or calendar: we do not access your address book or your calendar.
• Card details: the number, expiry date and security code go to the payment processor. We never see or store them.
• Advertising identifiers: we do not use the IDFA, we do not track you across other apps or sites, and we show no advertising.
• Biometric data: no face recognition, no fingerprints.

Account data

Identifier, email address, name, authentication method (password, Google or Apple), preferred language and currency, and your confirmation that you are over 18.

Trip data

Destination, dates, budget, group composition, interests, the free-text description you write, generated itineraries, your ratings and your chat history with the assistant.

Collaboration and expense data

Trip members, invitations, proposals, votes and the shared expense record. Balances between travellers are informational bookkeeping: ViajAI does not transfer money between people and is not a payment service.

Documents you upload

Files you store in your account or in a trip: passports, visas, national ID cards, vaccination certificates, insurance, tickets and bookings. They are held in private storage and reachable only through short-lived signed links we issue after checking that you are the owner.

Sensitive data

Some data the product needs is sensitive data and gets reinforced protection. We process it solely on your explicit consent, which you give by entering it, and you can withdraw that consent by deleting the data or your account:

• Nationality and declared passports: essential to work out whether you need a visa or entry permit.
• Identity and immigration documents: the ones you choose to upload.
• Health data: vaccination certificates (yellow fever, for example) and any medical or mobility needs you declare so the itinerary can adapt.
• Dietary restrictions: these can reveal religious beliefs or health conditions.

Do not put sensitive data in free-text fields or in the chat: those fields are sent to the AI provider (see §4).

Other people’s data

The product lets you store data about people who may have no ViajAI account: the email of someone you invite to a trip, the name of someone who shares an expense, and the holder of a document you upload on another person’s behalf. By entering it you confirm you are entitled to do so and undertake to inform that person. If someone writes asking us to delete their data, we will.

Payment data

When you buy a plan we store the transaction identifier, plan status, amount, currency and validity dates. Card details are handled directly by the payment processor.

Technical and operational data

IP address (for rate limiting and abuse prevention), browser, device, timestamps and errors. Our technical logs automatically replace any email address with a redaction marker; they keep your user identifier, not your identity.

A record of your consent

When you decide about optional cookies we store the decision, its date, the version of this Policy you decided on, and the browser or app you did it from. The law requires it: we must be able to demonstrate that you consented, not merely act as though you had. We do not store your IP address for this.

Optional analytics

Only if you accept it. These are technical, aggregated events from a closed list — no emails, no names, no free text — with address identifiers masked. Session recording applies to a sample, masks all text and form fields, and is switched off entirely on your profile, in documents and in money-related areas.

4. What we use it for

Artificial intelligence

Itineraries and assistant replies are generated with OpenAI through its API. We send it the trip parameters (destination, dates, budget, group composition and constraints) and the free text you write, verbatim, including chat messages.

We train no models on your data. OpenAI states that API data is not used to train its models by default unless the organization explicitly opts in to sharing. Abuse-monitoring logs may be kept for up to 30 days under its data controls. See OpenAI API data controls.

Which is why we insist: do not put sensitive data in free-text fields or in the chat. To ask about or exercise your rights over data we send to the provider, write to us at privacidad@viajai.cl and we will handle your request.

The output is probabilistic: it may contain errors, outdated prices, places that no longer exist or incorrect entry requirements. Always verify visas, documents, prices and availability against official sources before travelling or booking.

Third-party content (TikTok)

If you enable TikTok insights, we analyse public videos about the destination to suggest places. That content belongs to its authors and to the source platform; we use it only to enrich your itinerary inside the product. We do not republish full videos and we do not guarantee the accuracy of anything derived from social media. If you are the author of a video and want us to stop using it, write to us.

5. Cookies

We use strictly necessary cookies so the site works (session, security, payment), one functional cookie to remember your language and — only if you accept them — analytics and session-recording cookies. Nothing optional loads before you decide.

The full detail — name, issuer, duration and how to switch each one off — is in the Cookie Policy. You can change your mind at any time through “Privacy preferences”, in the site footer and in your profile.

6. Who we share it with

We do not sell your personal data and we do not share it with anyone for advertising purposes. We share it only with providers that supply us a service and are contractually bound to process it solely on our instructions:

In addition, purchases in the iOS app are processed by Apple and purchases on the web by Mercado Pago: both are independent controllers of the payment data they collect, under their own policies.

You can ask us for the full list of providers by name at privacidad@viajai.cl. We will send it free of charge.

We also share data where a law, a court order or a competent authority requires it, and with whoever you choose: members you invite to a trip can see that trip’s information.

7. How long we keep it

When you delete your account the deletion is real and cascading: your trips, chats, expenses, documents and stored files are removed, and we ask our analytics and subscription providers to delete your profile. We keep only a minimal record that the account was deleted, to stop an old token from reviving it.

8. Your rights

Over your personal data you may exercise the rights of:

• Access: know what data we hold and obtain a copy.
• Rectification: correct anything wrong or incomplete.
• Erasure: have your data deleted.
• Objection: object to processing based on legitimate interest.
• Portability: receive your data in a structured, commonly used format.
• Restriction: ask us to suspend a processing activity while a complaint is resolved.
• Withdraw consent at any time, without affecting processing already carried out.

You can exercise most of these yourself inside the product: from your profile you can correct your data, download a file with everything we hold about you, change your privacy preferences and delete your account. Every email we send also carries a link to stop receiving them. For anything else, write to privacidad@viajai.cl. We respond within 30 calendar days. We may ask you to verify your identity before disclosing information.

If you are unhappy with our response, you can complain to the Chilean Personal Data Protection Agency, or to the supervisory authority of your country of residence.

9. International transfers

ViajAI operates from Chile, but your data is processed abroad:

• United States: database and documents in Supabase us-west-1; website hosting, transactional email, push notifications, optional analytics, error monitoring, iOS subscription management and AI processing. Their processors may operate in other countries.

To ask about the contractual and technical safeguards applicable to a particular transfer, write to privacidad@viajai.cl.

10. Minors

ViajAI is a service for people aged 18 and over. When you register you declare that you are 18. We do not knowingly collect minors’ data; if we find an account belonging to a minor, we delete it.

Travelling with children is a different matter: you can state how many minors are coming and their ages so the itinerary adapts. That data is treated as sensitive and you provide it as the responsible adult. If you would rather not, you can leave it blank.

If you believe a minor has given us data, write to privacidad@viajai.cl and we will delete it.

11. Security

We encrypt traffic in transit, isolate each user’s data with row-level access control, keep documents in private storage reachable only through short-lived signed links, protect forms with CAPTCHA and monitor errors in production. Our logs and our monitoring system automatically filter out credentials, cookies, emails and document content.

No system is infallible. If a breach occurs that poses a risk to your rights, we will notify you and the competent authority within 72 hours of becoming aware of it.

If you find a vulnerability, report it to seguridad@viajai.cl. We will not take action against anyone researching in good faith who discloses responsibly.

12. Changes

We will post any change on this page and update the date in the header. If a purpose that relies on your consent changes materially, we will ask you again before applying it. If the change is significant, we will also tell you by email or inside the product.

13. Contact

Privacy and rights requests: privacidad@viajai.cl (response within 30 calendar days).
Support: soporte@viajai.cl.
Security: seguridad@viajai.cl.
Postal address: California 2468, Providencia, Chile.

14. Regional supplements

European Economic Area and United Kingdom

If you live in the EEA or the UK, we process your data under the GDPR. The legal basis for each purpose is in the table in §4. On top of the rights in §8, you have the right to restriction of processing (Art. 18) and not to be subject to automated decisions with legal effects: ViajAI makes none. The transfers described in §9 rely on the European Commission’s Standard Contractual Clauses. You may complain to the supervisory authority of your member state.

Brazil

If you live in Brazil, we process your data under the LGPD. The legal bases mirror those in §4 (performance of contract, consent, legitimate interest and compliance with a legal obligation). You also have the right to information about the entities we share your data with and to request review of automated decisions. You may complain to the Autoridade Nacional de Proteção de Dados (ANPD).

California

In the past 12 months we have collected the following categories of personal information under the CCPA/CPRA: identifiers (name, email, account identifier, IP), commercial information (plan purchase history), network activity (product usage, if you accept analytics), approximate geolocation derived from IP, content you create (trips, messages, documents) and inferences about your travel preferences.

ViajAI does not sell or share personal information within the meaning of the CCPA/CPRA, and has not sold or shared it in the past 12 months. Nor do we use or disclose sensitive information for purposes beyond those the statute permits. You have the right to know, delete, correct and not to be discriminated against for exercising your rights. Exercise them at privacidad@viajai.cl, including through an authorised agent.