Privacy Policy

1. Who processes your data

The controller of the data processed on the Cavengo platform is ADRIANO CAVALCANTI SERVICOS LTDA, registered under 35.095.378/0001-09, with its registered office at R. São Ludgero, 79, Centro, Rio do Sul - SC, CEP 89160-061, Brasil.

The data protection officer (DPO) is ADRIANO CAVALCANTI SERVICOS LTDA, reachable at privacy@cavengo.com. That is the channel for exercising any right described in this document.

This policy is version 2026-09-25 and applies to cavengo.com and all of its services.

2. What data we collect

When you create an account, we collect your name, e-mail, WhatsApp number, date of birth and the language you use the platform in. The date of birth exists to check the minimum age of 18; the WhatsApp number is the account's contact channel and is not published.

If you enable a facet with a public page — agency, partner, influencer or guide — what you fill in there is public content by definition: display name, photo, description, city, country, languages, specialities and the contact details you choose to publish. The contact number on the public page is a separate field from the account's WhatsApp number, precisely so that one does not become the other without you asking.

As you use the platform, we also record technical data: IP address, browser identification, date and time of access, and the pages visited. These support security, auditing and visit counts.

If you review a trip, we keep the review, the rating and the photo you attached — which is published alongside the review.

If you subscribe to the newsletter, we keep the e-mail, the language and the date. If you unsubscribe, we keep the unsubscription date instead of deleting the row: it is the proof that your request was honoured.

If you enable a public page, we keep a record of the declaration you accepted: text version, date, language and IP address.

If you make a report, we keep the reason, what you wrote, the page reported and your account. Your identity is not shown to the reported party.

3. What we do NOT collect

We do not receive and do not store your password. It is transformed inside your browser, by a computation that depends on your e-mail, and only the result of that transformation reaches us. Not even someone with access to the database can read your password.

We do not collect sensitive data — racial origin, political opinion, religion, health, sex life, biometrics — and we do not ask for, receive or store identity documents — neither to create an account nor to enable a public page.

We do not buy contact lists and we do not run third-party behavioural advertising inside the platform.

4. Why we process each item, and on what legal basis

The GDPR (art. 6) and the Brazilian LGPD (art. 7 and 11) require a stated legal basis for each purpose. Ours are:

• Performance of a contract — creating and maintaining your account, authenticating access, displaying your public page, letting you negotiate and record agreements.
• Consent — sending news and offers by e-mail, and any cookie that is not strictly necessary. You can withdraw that consent at any time, without affecting what has already been sent.
• Legitimate interest — security, fraud and abuse prevention (including the anti-bot check at login and sign-up), aggregate audience measurement and service improvement, always within the limit of not overriding your rights.
• Legal obligation — keeping records required by law and responding to a valid order from a competent authority.

5. Who we share with

With other participants, to the extent of what you publish: your public page is visible to anyone, and what you send in an application or a negotiation is seen by the counterpart in that negotiation.

With providers that run the infrastructure on our behalf, with no autonomy over the purpose: Cloudflare, which hosts the application, the database, the files and the anti-bot check; and the transactional e-mail service we use for messages such as password resets.

With public authorities, where there is a valid legal request.

We do not sell, rent or hand over your personal data for third parties to use on their own account.

6. International transfers

The platform is international by design and runs on infrastructure spread across several countries. Your data may be processed outside the country you are in.

When that happens, the transfer relies on the instruments provided for by the GDPR (chapter V) and the LGPD (art. 33), including standard contractual clauses signed with the providers.

7. How long we keep it

While your account exists, we keep your registration data and what you published. After closure, we delete what we do not need to keep.

• Access sessions and verification tokens: deleted automatically every day, as soon as they expire.
• Visit and referral counts: twelve months, then deleted by an automatic routine.
• The history of pages you visited while signed in, shown only to you in your own panel: twelve months, then deleted by the same routine.
• Consent records: kept even after the account is closed, because they are the proof that consent existed and that it was withdrawn (GDPR art. 7(1), LGPD art. 8 §2).
• Audit records and data required by legal obligation: for the period the law sets.
• Reports, declarations by page holders and moderation decisions: kept as audit records, for the same period.

8. Your rights

The GDPR (art. 15 to 22) and the LGPD (art. 18) give you the right to:

• know whether we process data about you and obtain a copy of it;
• correct incomplete, inaccurate or outdated data;
• ask for deletion of what we process on the basis of your consent;
• ask for your data to be ported to another provider;
• withdraw consent at any time, including marketing consent;
• object to processing carried out on the basis of legitimate interest;
• know who we share your data with;
• lodge a complaint with the data protection authority in your country.

9. How to exercise them

Write to privacy@cavengo.com from your account's e-mail address. We answer within fifteen days; where a request is complex, we tell you within that period and explain the new one.

Some of it you can do yourself, without asking anyone: change your details and your password under My Account, and unsubscribe from the newsletter through the link at the bottom of every e-mail.

10. Children and young people

The platform is for people aged 18 and over, and we do not knowingly collect data from children or adolescents. If we identify an account belonging to someone under 18, it is closed and the data deleted.

If you are responsible for a minor and believe they created an account here, write to privacy@cavengo.com and we will resolve it immediately.

11. Security

All traffic is encrypted in transit. Passwords never reach the servers in readable form. Administrative access is restricted and logged, and every authorisation is checked on the server — not only on the screen.

No system is perfect. If a security incident occurs with a relevant risk to your rights, we notify you and the competent authority within the periods set by law (GDPR art. 33 and 34, LGPD art. 48).

12. Changes to this policy

This policy is versioned — the current one is 2026-09-25. A material change is published as a new version and communicated to account holders. The record of which version you accepted is kept.