Privacy Policy
Last updated: November 4, 2026
This policy explains in plain language what data Place in Place collects, what it uses it for, who it shares it with and how you control it. It follows the Brazilian General Data Protection Law (Law 13,709/2018).
1. Who is responsible
Place in Place is operated by SO Tecnologia, CNPJ 54.288.943/0001-90, which decides how your personal data is handled (the "controller" in the law's terms). To talk about privacy, use the contact on the Contact page (WhatsApp). It is also the channel to exercise your rights.
2. Data we collect
- Account: email, password (stored only in encrypted form, never as plain text) and, if you choose to give them, name and phone. - Sign in with Google: if you sign in with Google, we receive your email, your name and a Google account identifier. We never receive your Google password. - What you do in the app: places you save, itineraries you create (the text of your request, the options chosen and the result) and reviews (rating and comment). - Security data: the date, IP address and browser of each sign-in, to protect your account and let you see and end your sessions. - Location: only if you tap "Use my location". We use it on the spot to show distances and nearby places, and we do not store it. - Anonymous statistics: without identifying you, we count visits to place pages, taps on "Directions", app installs and visits that come from a partner QR code.
3. What we use the data for
- Keep your account, your sign-in and your preferences (providing the service you asked for). - Save places, build and keep itineraries and publish reviews (providing the service). - Protect the account and the service against fraud and abuse, and understand usage in aggregate (legitimate interest). - Measure usage with third-party tools, only if you accept cookies (consent). - Comply with legal obligations, when there are any.
4. Who we share it with
We do not sell your data. We use providers that handle data on our behalf: - Vercel (website hosting) and Railway (application server). - Supabase (database and image storage). - Google: for sign in with Google and to generate itineraries with artificial intelligence (Gemini). In that case we send the text of your request, the time available, whether you have a car and the list of candidate places. We do not send your name, your email or your exact location. - An email delivery service, to send the password reset link. - Google Analytics and Microsoft Clarity, only if you accept cookies and they are active. These providers may process data outside Brazil. In those cases we apply the safeguards the law requires.
5. Shareable itineraries and links
Each itinerary you save has a secret link. Anyone who receives that link can read the itinerary (your request and the stops), without seeing your name or email. Share the link only with people you choose.
6. Cookies and storage on your device
- Essential: your sign-in is kept in the browser (items starting with "place.auth"), along with your language (NEXT_LOCALE cookie, for 1 year) and your cookie choice. - Partners: if you arrive through a partner QR code and accept cookies, we store the partner code (place_partner cookie, for 30 days, and local storage) to attribute app installs to the partner. It does not identify you. If you decline, none of this is stored (the visit is counted anonymously, with no identifier). - Third-party analytics (Google Analytics and Microsoft Clarity): they load only after you accept in the cookie notice. You can decline and keep using the app. You can delete this data at any time in your browser settings.
7. How long we keep it
- Account data is kept while the account exists. When you delete the account, we delete the account, saved places, itineraries, reviews, sessions and sign-in links. - Sign-in sessions expire after up to 7 days without use, and password reset links after 1 hour. - Anonymous statistics may be kept, because they do not identify you. - Providers may keep technical records for the period set by their own policies.
8. Your rights
At any time you can: confirm that we process your data, access it, correct it, ask for deletion, receive a copy, know who we share it with and withdraw consent. In the app, under My account, you can edit your name and phone, download a copy of your data (a JSON file) and delete your account. For any other request, contact us through the Contact page. You may also complain to the Brazilian data protection authority (ANPD).
9. How we protect data
We use a secure connection (HTTPS), store passwords encrypted, limit access to the database and control sign-in attempts. No system is completely secure: if an incident that may put you at risk happens, we will tell you and the authority, as the law requires.
10. Children and teenagers
Place in Place is not aimed at children. If you are responsible for a minor who created an account, contact us and the account will be deleted.
11. Changes to this policy
We may update this policy. The date at the top shows the latest version. If the change is important, we will tell you in the app.