Privacy policy

Data controller

The data controller is EX AEQUO LTDA (CNPJ 58.762.910/0001-91), whose registered office is at Praia do Guajiru, s/n, Praia da Barra, Itarema — CE, CEP 62.590-000, Brazil.

For any question about your data, there is a single address: cabana@amigosevento.com.

Applicable law

Two sets of rules apply here, and they apply together.

Brazil's data protection law (LGPD, Law No. 13.709/2018) applies because the processing takes place in Brazil. The European regulation (GDPR, Regulation (EU) 2016/679) also applies, under its Article 3(2), because this site offers its services to people located in the European Union.

Where the two differ, whichever rule protects you more is the one applied.

Data collected

The booking request form collects only what is needed to reply to you:

• your name
• your email address
• the language you filled the form in, so that we can reply in that language
• your preferred arrival and departure dates
• the number of rooms you want
• the free-text message you choose to add, if any

What is not collected

No phone number, no postal address, no identity document. No payment details: this site offers no online payment. No data classed as sensitive under the GDPR or the LGPD, and no profiling or automated decision-making.

To prevent automated submissions, the IP address behind a submission is immediately turned into an irreversible cryptographic fingerprint. That fingerprint cannot be traced back to the original address, is used only to count submissions, and is erased after 24 hours. The IP address itself is never stored.

Why this data is collected

It is used solely to handle your booking request: checking availability, replying to you, and arranging your stay if the booking is confirmed.

The legal basis is the performance of pre-contractual steps taken at your request (Article 6(1)(b) GDPR; Article 7, V LGPD). You are therefore not asked for consent: your request is itself what justifies the processing, and you can end it at any time.

Your data is never used for marketing. It is not sold, rented or exchanged.

Who has access to your data

Your data is accessible to the people who manage bookings for the Cabana, and to the technical providers who keep the site running. Those providers act on instructions, solely on the Cabana's behalf, and cannot use your data for their own purposes:

• Vercel Inc. — site hosting (United States)
• Supabase Inc. — booking request database (Brazil)
• Resend Inc. — email delivery (Ireland)
• OVH SAS — domain mailboxes (France)
• Vercel Inc. — audience measurement (United States)

Transfers outside the European Union

The Cabana is in Brazil and the company operating it is established there: answering your request necessarily means your data is read in Brazil. The database itself is hosted in Brazil, and the site is hosted from the United States.

Neither country is covered by an adequacy decision of the European Commission. Brazil does, however, have legislation comparable to the GDPR (the LGPD) and an independent supervisory authority, the ANPD. Transfers are further covered by the standard contractual clauses adopted by the European Commission, included in the data processing agreements signed with the providers listed above.

How long your data is kept

• a request that leads to nothing is deleted after 12 months
• a confirmed booking is kept for 3 years after the end of the stay, so that a complaint or an accounting obligation can still be answered
• the technical anti-spam fingerprints are erased after 24 hours

After those periods the data is deleted. You are of course free to ask for erasure sooner.

Your rights

At any time, you have the right to:

• access your data and obtain a copy of it
• have it corrected if it is inaccurate or incomplete
• ask for it to be erased
• ask for its processing to be restricted, or object to it
• ask for it to be ported to you in a machine-readable format
• obtain confirmation that processing exists and learn which parties your data has been shared with (specific rights under the LGPD)

How to exercise them

Simply write to cabana@amigosevento.com. Your request will be answered within one month. No identity document will be requested if your message comes from the email address used for the booking.

If the answer does not satisfy you, you may lodge a complaint with a supervisory authority: the data protection authority of your country of residence if you live in the European Union (in France, the CNIL — cnil.fr), or the ANPD in Brazil (gov.br/anpd).

Cookies and audience measurement

This site sets no advertising cookies and uses no third-party trackers. That is why it shows no consent banner: there is nothing to consent to.

A single cookie is set, to remember the language you chose. It is strictly necessary for the site to work and cannot identify you.

The location map is not embedded in the page: it is a plain link to Google Maps, which therefore sets nothing unless you click it. Fonts are served from this site, with no call to a third-party server.

Traffic is measured with Vercel Web Analytics, which works without cookies and without a persistent identifier: the resulting statistics are aggregated and cannot recognise you from one visit to the next.

Security

Traffic to and from this site is encrypted (HTTPS). Access to the database is restricted and logged, and the technical logs contain no personal data. No payment data is processed, since no payment is made online.

Changes to this policy

This policy may change. The date it was last updated appears at the top of the page: August 2, 2026.