Privacy policy

1. Data controller

Diogo Sousa, NIF 253833566, Caminho Municipal Ti Clara, Edifício Plaza 3, Bloco B 2W, 9125-170 Caniço, Madeira, email ilhago.admin@gmail.com, WhatsApp +351925436122.

2. Visitors

Your chosen language, saved experiences and sent requests stay only on your phone (the browser's local storage). You can delete them by clearing the site's data.

When you send a request, we store the experience, day, time, number of adults and children and the app language, with no name or contact details, so the provider can see the requests they received. These records are deleted after 24 months.

Your conversation with the provider happens on WhatsApp, outside IlhaGo: the provider sees your number, and that data is governed by WhatsApp's and the provider's own policies.

If you write to us (by WhatsApp or email), we use your contact details and message only to reply, and delete them once the matter is closed.

3. Providers

We store your sign-in email, business name, WhatsApp number, RNAAT registration, insurance details, the experiences and photos you publish, and sign-in records. Your business name, WhatsApp number, RNAAT registration number and approved experiences are public in the app.

Legal basis: performing the listing agreement (GDPR Article 6(1)(b)) and our legitimate interest in keeping the app secure (Article 6(1)(f)). Data is kept while your account exists and deleted when you delete it.

4. Who helps us (processors)

Supabase: database, sign-in and photos, hosted in the European Union (Paris); logs technical request data such as IP addresses, for security.

Netlify: hosting of the app; logs technical access data such as IP addresses.

Anthropic (Claude): help translating experience texts (only the listing text, never visitor data).

Google (Gmail): sending sign-in emails to providers.

OpenStreetMap: map images; your IP address is sent when you open the map.

Where one of these services processes data outside the European Union, it does so under standard contractual clauses approved by the European Commission or the EU-US Data Privacy Framework.

5. Cookies

We use no advertising or analytics cookies. We only use the browser's local storage where the app needs it to work (language, saved items, requests and, for providers, staying signed in).

6. Your rights

You can ask for access to, correction, deletion, restriction or portability of your data, and object to its processing, by contacting us as above. Providers can delete their account directly in the partner area.

You can also complain to Portugal's data protection authority, the CNPD (www.cnpd.pt).