Effective Date: February 2026
Version 2.0
Vivências ("we", "us", "our") operates a rural tourism marketplace platform in Portugal. This privacy policy explains how we collect, use, store, and protect your personal data in accordance with the General Data Protection Regulation (GDPR), the Digital Services Act (DSA), and Portuguese data protection law (Lei n.o 58/2019).
We collect the following categories of personal data: email address (for account creation and communication), password hash (for authentication -- we never store your password in plain text), profile information (name, phone number), business details for partners (business name, tax ID, legal representative), booking and transaction records, consent records (your cookie and terms preferences), and usage data if you have consented to analytics cookies.
We use your data for: account management and authentication, providing our marketplace services, communicating about your bookings and account, processing payments and refunds, facilitating messaging between guests and partners, content moderation and trust & safety, legal compliance (including tax obligations and GDPR record-keeping), and improving our platform (only with your analytics consent).
When you use our messaging features, we process: message content and metadata (timestamps, read receipts), typing indicators (processed in real-time, not stored), WebSocket connection data (connection state, session tokens), and conversation history. Messages are stored to enable asynchronous communication and are accessible to conversation participants and platform administrators for moderation purposes. Message data is retained while your account is active and deleted upon account deletion.
When you submit or receive reviews, we process: review text content and ratings, reviewer identity (protected by our double-blind review system until both parties have submitted), guest reputation scores (calculated from aggregated review data), and review helpfulness votes. Reviews use a blind submission mechanism where neither party can see the other's review until both have submitted or the review window expires. Published reviews are visible publicly (guest reviews of listings) or to the reviewed party only (partner reviews of guests). Upon account deletion, review text is anonymized but the rating data is retained for aggregate accuracy.
We use AI technology (powered by Anthropic Claude) to assist with content moderation of reviews, messages, listing descriptions, and uploaded images. AI moderation analyzes content for policy violations, spam, and safety concerns. Content flagged by AI is reviewed by human moderators before any action is taken -- no automated decision-making occurs without human oversight. Content sent for AI analysis is processed by Anthropic under their data processing agreement. AI moderation logs are retained for 90 days for audit purposes. You have the right to appeal any moderation decision through our appeals process.
If you file or are involved in a dispute, we process: dispute details and category, evidence submitted by both parties (text descriptions, uploaded files, conversation history), mediation chat messages between parties and administrators, resolution outcomes and any refund records. Dispute data is retained for 2 years after resolution for legal compliance and audit purposes. Evidence files are stored securely and access is restricted to dispute participants and administrators.
When you report content on our platform (as required by the Digital Services Act), we process: the report submission details, reporter identity (if provided -- anonymous reporting is supported), the reported content reference, and processing status. Reports are reviewed by our moderation team. Report data is retained for 6 months after resolution.
Under the Digital Services Act (DSA), we are required to collect and verify the identity of traders (partners) on our platform. This includes: legal business name, registration number, registered address, contact details, VAT identification number, and identity of the legal representative. This information is collected during partner onboarding and displayed to consumers as required by the DSA. Partner identity data is retained for the duration of the business relationship and for 6 months after account closure.
We process your data under the following legal bases: consent (cookie preferences, marketing communications), contract performance (providing our marketplace services, processing bookings and payments), legitimate interest (platform security, fraud prevention, content moderation), and legal obligation (tax records, GDPR compliance, DSA transparency requirements, consumer protection regulations).
Account data is retained while your account is active. Consent records are retained for audit purposes as required by GDPR. Financial records are retained as required by Portuguese tax law (minimum 10 years). Upon account deletion, personal data is anonymized or deleted within 30 days, except where legal obligations require longer retention.
Specific retention periods for platform features: messages are deleted with account deletion, review text is anonymized (ratings retained for aggregate accuracy), AI moderation logs are retained for 90 days, dispute records are retained for 2 years post-resolution, content reports are retained for 6 months post-resolution, and partner KYBC data is retained for 6 months after account closure.
Under GDPR, you have the right to: access your personal data (Art. 15), rectify inaccurate data (Art. 16), erase your data -- right to be forgotten (Art. 17), restrict processing in certain circumstances (Art. 18), data portability (Art. 20), object to processing based on legitimate interest (Art. 21), and not be subject to automated decision-making (Art. 22). You may also withdraw consent at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact our Data Protection Officer at dpo@vivencias.pt. We will respond within 30 days as required by GDPR. If you are unsatisfied with our response, you have the right to lodge a complaint with the CNPD (Comissao Nacional de Protecao de Dados) at www.cnpd.pt.
We share data with the following processors: Stripe (payment processing -- EU data center), Resend (transactional emails), Hetzner Object Storage (file storage for images -- EU data center), MapTiler (map tile services), Anthropic (AI content moderation -- under data processing agreement), and Coolify/Hetzner (infrastructure hosting -- EU data center). We do not sell your personal data to any third party. All processors are bound by data processing agreements ensuring GDPR compliance.
We use essential cookies (required for site operation), analytics cookies (with your consent), and marketing cookies (with your consent). You can manage your cookie preferences at any time using the cookie settings available on our site.
As a consumer, you have the right to seek assistance from the following authorities and organizations:
DECO -- Associacao Portuguesa para a Defesa do Consumidor (Portuguese Consumer Protection Association)
deco.proteste.ptPortal da Queixa (Consumer Complaints Portal)
portaldaqueixa.comCNPD -- Comissao Nacional de Protecao de Dados (National Data Protection Commission)
www.cnpd.ptEuropean Consumer Centre Portugal (Centro Europeu do Consumidor)
cec.consumidor.ptWe use the Google Ads API to manage and optimize advertising campaigns that promote our rural tourism properties and experiences. Through the Google Ads API, we process the following data: campaign performance metrics (impressions, clicks, conversions, costs), keyword performance data for search advertising optimization, conversion tracking data including hashed email addresses and click identifiers (gclid) for Enhanced Conversions, and aggregated audience data for remarketing campaigns. This data is used to measure and optimize the effectiveness of our advertising campaigns, generate AI-powered ad copy for our listings, and provide performance analytics to platform administrators. Data shared with Google includes hashed user emails (for Enhanced Conversions with consent) and click identifiers for attribution. Campaign data is synced daily and retained for analytics purposes. Conversion data is retained per Google Ads data retention policies. The legal basis for this processing is legitimate interest (advertising optimization) and consent (marketing cookies via Consent Mode V2). Users can opt out of personalized advertising via Google Ad Settings at adssettings.google.com. Our use of the Google Ads API is subject to Google's Terms of Service and the Google API Services User Data Policy, including the Limited Use requirements. For more information about Google's data practices, see Google's Privacy Policy at policies.google.com/privacy.
For any data protection inquiries, please contact our Data Protection Officer at: dpo@vivencias.pt. For general inquiries: support@vivenciasturismorural.com.
We may update this privacy policy from time to time. We will notify you of any material changes via email or a prominent notice on our platform. The version number and effective date at the top of this page indicate when the policy was last updated.