← Back to Wayven

Privacy Policy

Last updated: October 14, 2026

Introduction

This Privacy Policy describes how Wayven collects, uses, stores, and protects your personal information. We take privacy very seriously and are committed to being transparent about our data practices.

By using our platform, you agree to the practices described in this policy. We recommend reading this document carefully to fully understand how your information is handled.

1. Information We Collect

At Wayven, we only collect information necessary to provide our travel planning services. This includes registration data, travel information, and documents you choose to share with us.

1.1 Information You Provide

• Registration Data: Name, email, password (encrypted), optional profile photo. Social authentication via Google Sign-In or Apple Sign-In (we only receive name and email from the provider)
• Travel Information: Destinations, dates, preferences, budget, checklists
• Documents: Tickets, vouchers, hotel confirmations you choose to upload (including via the system's Share Extension)
• Preferences: Notification settings, language, preferred currency
• Subscription Data: If you subscribe to the Pro Plan, we collect: subscription identifier, entitlement status (active/expired), purchase and renewal dates, and transaction tokens processed by Apple App Store or Google Play Store via RevenueCat. We do not have access to your credit card number or banking details — those are processed exclusively by Apple or Google.

1.2 Information Automatically Collected by the App

• Usage Data: Most used features, screens viewed, session duration, interaction patterns within the app
• Device Information: Smartphone/tablet model, iOS/Android version, unique device identifier (IDFA on iOS, Advertising ID on Android), system language, timezone, mobile carrier
• Performance Data: Screen loading times, crashes, errors, memory and battery usage
• Session Identifiers: Authentication tokens, unique app installation identifiers

1.3 Mobile App Permissions

The Wayven app may request the following permissions on your mobile device. You have full control and can deny or revoke these permissions in your smartphone settings, although this may limit some functionality:

• 📷 Camera (Optional): To scan travel documents, capture destination photos, or add profile picture. Granted only when you choose to use these features.
• 🖼️ Gallery/Photos (Optional): To upload travel photos, saved documents, or profile picture. We only access photos you explicitly select.
• 📁 Storage (Required): To save offline data, cache travel information, and enable internet-free access. Essential for offline mode.
• 🔔 Push Notifications (Optional): To send task reminders, travel alerts, and important updates. You can disable anytime in app settings.
• 🌐 Internet/Data (Required): To sync information to the cloud, access third-party APIs, and process with AI.
• 📍 Location (Never Collected): Wayven DOES NOT request access to your GPS location. We do not track where you are in real-time.

Important: Denying optional permissions does not prevent basic app usage. Permissions are requested only when necessary for specific functionality, following Apple and Google privacy guidelines.

2. How We Use Your Information

We use your information exclusively to enhance your travel planning experience, generate personalized suggestions, and analyze travel documents to automate the organization process.

2.1 Primary Purposes

• Provide Service: Process your travel information and generate personalized plans
• AI and Automation: Use artificial intelligence to read the documents you ask the app to read (OpenAI) and to generate suggestions (Google Gemini, with OpenAI as a backup). Your personal data is not used to train third-party AI models
• Communication: Send important notifications about your trips and service updates
• Support: Answer questions and resolve technical issues
• Analytics and Improvement (legitimate interest): we record how the app is used (for example: created a trip, saved a document) to fix defects and decide what to improve. These records do not include your name, email, IP address, or the content of your trips and documents. You can turn this collection off at any time in Profile › Privacy › Data collection for analytics. When it's off, the app stops sending usage data. Notification opens are still recorded when collection is off, because that record is what limits how many notifications we send.
• Monetization (Free Plan): Display advertisements through Google AdMob (banners and rewarded videos). Pro Plan users do not see ads and their data is not shared with advertising networks
• Measuring Wayven's ads: when we advertise Wayven on Instagram and Facebook, the app tells Meta three things: that it was installed, that it was opened, and that an account was created. This tells us whether the ad brought someone in, and lets Meta show the ad to people more likely to use the app. It does not include your name, your email, or anything about your trip. On iPhone, the advertising identifier (IDFA) is only included if you allow tracking when the system asks; on Android, only with data collection on. If you turn off data collection in Profile → Privacy, the app stops sending these signals.

2.2 Use of Anonymized Data

We may use aggregated and anonymized data for internal product analysis, statistical reports, and travel trend research. This data does not allow individual identification and is not sold to third parties.

2.3 Crash Reports

When the app crashes or hits an error, it sends a technical report to Firebase Crashlytics (Google) with the device model, the operating system and app versions, and the point in the code where the failure happened. These reports are still sent when usage collection is turned off, because they are needed to keep the app working and secure (legitimate interest, LGPD art. 7, IX). They do not include the content of your trips or documents.

3. Data Protection

We implement rigorous security measures to protect your personal information. All data is encrypted and stored on secure servers with restricted access.

3.1 Technical Security Measures

• Encrypted Connection: all communication between the app and our servers uses HTTPS (TLS)
• Encryption at Rest: your data is hosted with providers that store it encrypted (Supabase and Google Cloud)
• Access Restricted by Account: access rules in the database (RLS) and on the server ensure each account can only read and change its own data and that of the trips it is part of

3.2 Transparency About Limitations

While Wayven strives to keep your data secure, please note that:

• No method of transmission over the internet is 100% secure
• You are responsible for keeping your sign-in credentials safe
• In the event of a data breach, we will notify affected users and the ANPD as required by LGPD (Art. 48), including the measures taken and guidance to mitigate harm
• Wayven is responsible for security incidents resulting from failures in its technical and organizational measures, as provided by applicable law

4. Information Sharing

We do not sell, rent, or share your personal information with third parties for commercial purposes. We only share data when necessary to provide our services or when required by law.

4.1 When We Share

• Service Providers: Supabase (hosting); OpenAI (artificial intelligence to read the travel documents you ask the app to read and, when Google Gemini is unavailable, to generate travel suggestions. Data sent: the content of those documents, which may include your name, as on a passport or voucher, and trip information. OpenAI does not use data sent through its API to train its models); Google Gemini (artificial intelligence to generate travel suggestions, write notification text, and quote travel insurance. Data sent: trip information, such as destinations and dates; Gemini does not receive your documents. On the paid API plan, which Wayven uses, Google does not use the data sent to improve or train its products). We do not send your email or your password to either. Google Firebase (analytics, push notifications, crash reporting) — all under confidentiality agreements
• Advertising Partners (Free Plan only): Google AdMob for displaying ads. Pro Plan users do not have data shared with advertising partners
• Meta Platforms (Facebook SDK): measuring Wayven's ads on Instagram and Facebook. Data sent: install, app open and account created, with the device model, the OS version and, if you allow tracking (iPhone) or keep data collection on (Android), the advertising identifier. We don't send your name, email or trip data. Nothing is sent with data collection off.
• Payment Processors: RevenueCat (subscription management and entitlement validation), Apple App Store and Google Play Store (payment processing for Pro subscriptions). Wayven does not have access to credit card data
• Travel APIs: Viator, Google Places, Unsplash for enriching destination content
• Legal Obligations: When required by law, court order, or government authorities
• Rights Protection: To protect our rights, property, or safety
• With Your Consent: Any other sharing requires your explicit authorization

5. Mobile Advertising and Monetization

Wayven operates a freemium model with two plans:

• Free Plan: Displays ads via Google AdMob (banners and rewarded videos). Rewarded videos are optional — you choose to watch them to temporarily unlock AI features
• Pro Plan (paid subscription): Ad-free. No advertising data is collected or shared with ad networks. Advertising identifiers (IDFA/GAID) are not used

5.1 How Ads Work on the Free Plan

• Google AdMob: Advertising network that displays ads within the app
• Advertising Identifiers: IDFA (iOS) and Google Advertising ID (Android) to personalize ads
• Data used for ads: Google AdMob receives the device's advertising identifier (when you allow it) and technical device data, under Google's policy. Wayven does not send AdMob your name, email, or the content of your trips.
• Ad Types: Banners and rewarded videos (optional for accessing AI features)

5.2 Personalized Ads Control

Free Plan users can limit or disable personalized ads:

• iPhone, "Ask App Not to Track": if you decline the iOS tracking request, ads are no longer personalized. This choice only applies to advertising: the usage collection in section 2.1 is controlled by the switch in Profile › Privacy.
• European Economic Area, United Kingdom, and Switzerland: before showing ads, the app asks for your consent through Google's form (UMP). You can review this choice at any time in Profile › Privacy › Ad preferences.
• iOS: Settings → Privacy → Tracking → Disable "Allow Apps to Request to Track"
• iOS (ads): Settings → Privacy → Apple Advertising → Disable "Personalized Ads"
• Android: Settings → Google → Ads → Disable "Opt out of Ads Personalization"
• Android (reset): Reset advertising ID to clear history
• Pro Subscription: Remove all ads completely by subscribing to the Pro Plan within the app

Note: For Free Plan users, disabling personalized ads does not remove ads from the app, only makes them less relevant. For a completely ad-free experience, consider the Pro Plan.

For more information:

• Google Advertising Policies
• How AdMob uses your data
• App Store Privacy

5.3 Local Storage and Cache

The app stores data locally on your device to work offline:

• Local Database: Travel information, checklists, preferences (using SQLite/Hive)
• Image Cache: Destination photos, downloaded documents
• Session Tokens: To keep you authenticated without repeatedly logging in

This data is securely stored in the app's sandbox and is not accessible by other apps.

6. Your Rights

You have the right to access, correct, or delete your personal information at any time. Contact us through the platform to exercise these rights.

6.1 Rights Guaranteed by LGPD (Brazilian Data Protection Law)

• Access: Request a copy of all data we have about you
• Correction: Update incomplete or incorrect information
• Deletion: Request deletion of your data (right to be forgotten)
• Portability: Receive your data in a structured, readable format
• Consent Withdrawal: Withdraw consent for data processing
• Opposition: Object to data processing in certain circumstances
• Information: Know who has access to your data

6.2 How to Exercise Your Rights

To exercise any of these rights, contact us at support@wayven.io. We will respond to your request within 15 business days, as required by LGPD.

7. Data Retention

We keep your information only as long as necessary to provide our services or as required by law. You can request deletion of your data at any time.

7.1 Retention Periods

• Active Account: While your account is active and you use our services
• Purchases: processed and kept by Apple and Google, under their own policies
• Technical Access and Security Records: kept by our infrastructure providers (Supabase, Google) for the periods they set
• Usage Data and Notification Metrics: 13 months from when they are recorded on our servers, then deleted automatically. The copy sent to Firebase Analytics (Google) follows the retention period configured in Firebase

7.2 Data Deletion

When you request account deletion, your account is scheduled to be deleted 30 days after you confirm the request. Until then you can still use the app and cancel the request in Profile or at support@wayven.io. After that period, your account and personal data, including uploaded documents, are permanently deleted. Database backups are kept by our infrastructure provider (Supabase) for the period it sets. Deletion is irreversible.

8. International Data Transfer

Your data may be stored and processed on servers located outside Brazil. We ensure all international providers follow adequate data protection standards equivalent to LGPD.

We use standard contractual clauses and other legal safeguards to protect your data in international transfers.

9. Children's Privacy

Our service is not directed to individuals under 18 years old. We do not intentionally collect information from children or adolescents. If you are a parent or guardian and discover that your child has provided information, contact us so we can delete the data.

10. Changes to This Policy

This policy may be updated periodically. We will notify you of significant changes through the platform or by email.

We recommend reviewing this policy regularly to stay informed about how we protect your information. The date of the last update is indicated at the top of this page.

11. Contact and Data Protection Officer

If you have questions about this privacy policy, contact us at support@wayven.io.

Data controller: Denis Costa, who runs Wayven
Contact: support@wayven.io

For specific questions about privacy and data protection, you can contact our Data Protection Officer (DPO) at the same email address.

12. Advertising and Monetization

On the Free Plan, Wayven uses Google AdMob to display advertisements. Google may use device identifiers and inferred interests to show relevant ads.

Pro Plan users do not see any ads, and no advertising data is collected or shared for them.

You can opt out of personalized advertising by visiting Google Ads Settings. Additionally, you can opt out of third-party vendor use of cookies for personalized advertising by visiting www.aboutads.info.

13. LGPD Compliance

Wayven is designed to align with the Brazilian General Data Protection Law (LGPD - Law No. 13.709/2018) and all applicable Brazilian privacy regulations.

We have implemented technical and organizational measures aligned with LGPD, including:

• Adequate legal basis for all data processing
• Explicit consent when necessary
• Transparency about data use
• Information security
• Respect for data subjects' rights
• Record of data processing activities
• Notification of security incidents to ANPD when applicable

Legitimate interest (LGPD art. 7, IX): security, fraud prevention, crash reports, and usage analytics to improve the app. Usage analytics can be turned off in Profile › Privacy. We keep a record of the legitimate interest assessment for this collection, available on request at support@wayven.io.

13.1 AI and Automated Decisions

Wayven uses AI models to read travel documents (OpenAI), generate personalized suggestions and notification text (Google Gemini, with OpenAI as a backup), and quote travel insurance (Google Gemini). Under LGPD Article 20:

• You have the right to request review of automated decisions that affect your interests
• AI results are suggestions and do not replace human decisions
• Only OpenAI receives the content of the documents you ask the app to read (which may include your name); OpenAI and Google Gemini receive trip information. We do not send your email or your password
• OpenAI and Google (on the paid API plan, which we use) do not use the data Wayven sends to train their models

14. Dispute Resolution

In case of privacy questions or complaints, contact us first. We will do our best to resolve the issue internally. If we cannot resolve it satisfactorily, you can file a complaint with the Brazilian National Data Protection Authority (ANPD) at www.gov.br/anpd.

Consumers in Brazil have the right to bring actions in their local jurisdiction, as provided by Article 101, I, of the Consumer Protection Code.