Privacy Policy

Effective as of October 25, 2026.

This policy explains which personal data Valise processes, for what purpose, with whom it is shared, how long it is kept and how each person can exercise their rights, under Brazil's General Data Protection Law (Law No. 13,709/2018, LGPD).

1. Who we are

Valise is a product of AUGUSTO SEABRA CONSULTORIA EM TECNOLOGIA DA INFORMACAO LTDA (trade name Seabra Tech), registered under CNPJ No. 66.198.562/0001-08, headquartered in São Paulo/SP, Brazil.

For travel agencies, Valise prepares an app with the itinerary, documents and information for each of their clients' trips.

2. Roles of the agency and of Valise

Travelers' data reaches Valise through the agency that sold the trip. That is why the roles change depending on the data:

The agency is responsible for informing travelers that their data is sent to Valise and for obtaining consent when it is required, as in the case of health information (section 4).

3. What data we process

About travelers

• Name, email and each person's role in the trip (traveler or family member following from home).
• Itinerary: flights, trains, stays, addresses, times, seats, contacts and booking notes.
• Documents sent by the agency, such as vouchers, tickets, insurance policies and travel documents.
• Booking amounts and the trip budget.
• A profile for the assistant, when the agency provides it: how the person prefers to be called, age range, interests, restrictions and notes.
• What the traveler records in the app: expenses, packing list items and to-dos.
• The messages exchanged with the assistant, during the conversation.

About agencies

• Agency name, email and the details of whoever talks to Valise.

About site visitors

The site does not use cookies or any tracking or audience analytics tools. If you contact us by WhatsApp or email, we process your name, phone or email and the content of the message in order to reply.

4. Health data and minors

Dietary restrictions and health notes may be sensitive personal data. They only go into the app if the agency sends them, with the data subject's specific consent, and they are used only so the assistant can take them into account when answering.

When a traveler is a child or adolescent, the agency must obtain the consent of one of the parents or the legal guardian before sending their data.

5. What we use the data for

• Building the trip's app and keeping it up to date.
• Sending travelers the first-access and password-recovery emails.
• Answering questions asked to the assistant and recording the expenses reported to it.
• Syncing the packing list, to-dos and expenses across the phones of people traveling together.
• Keeping security and audit records of the operations performed on each trip.
• Responding to business inquiries from agencies.

Valise does not sell personal data, does not use it for advertising and does not use it for any purpose other than those listed here.

6. Legal bases

For travelers' data, the legal basis is defined by the agency, as controller. In general, it is the performance of the travel contract (art. 7, V, of the LGPD) and, for health data, the data subject's specific consent (art. 11, I).

For business contacts, Valise relies on the steps preliminary to a contract (art. 7, V) and on the legitimate interest in replying to whoever contacted it (art. 7, IX).

7. How we protect the data

• The itinerary, documents and budget are encrypted with AES-256-GCM, both on the trip link and on the phone. Each person opens the app with their own password, which is never sent to or stored by Valise.
• Valise keeps a copy of each trip's keys, protected by a key of its own server. That copy is what allows updating the app and recovering access by email. The server also reads the itinerary when the assistant needs to answer.
• The documents and other files sent by the agency are kept encrypted in our storage.
• Expenses, packing list, to-dos, names and emails are kept in our database without that extra encryption, with access restricted to Valise's server.
• Without the password, the trip link shows only the sign-in screen, with no name, destination, dates or document names.
• Whoever follows from home has their own password, which opens only the itinerary, without the documents, the amounts or the assistant.
• All communication between the app, the site and our servers uses an encrypted connection (HTTPS).

8. Who we share data with

To work, Valise uses the providers below. Each one receives only what its function requires.

These providers process data outside Brazil, mainly in the United States. Anthropic, Cloudflare, Render, Neon and Resend have a data processing agreement that applies to the use of their services, with standard protection clauses on the European model. The Google Drive folder is kept in a regular Google account, under Google's terms of service, and holds the documents only while the app is being built (item 9). These transfers are necessary to provide the service contracted by the agency (art. 33, IX, of the LGPD).

Under Anthropic's commercial terms, data sent to the assistant is not used to train AI models, and Anthropic deletes it within 30 days, unless it needs to keep it longer due to a legal requirement or to investigate misuse of the service.

Valise may also share data when required by law or by a court order.

9. How long we keep data

• Trip data: online access ends 30 days after the return date, or on another date agreed with the agency. A daily routine removes the data of finished trips from the server: people, emails, expenses, packing list, to-dos, files and keys.
• Document upload folder: available only until the app is published, or until the deadline agreed with the agency, whichever comes first. Then Valise deletes the folder and the files, and the documents exist only encrypted, inside the app.
• Audit record: a minimal record of each finished trip remains, with the trip dates, the agency and the operations performed, with when and by whom. On removal, the trip's identifier and name and the people's codes are replaced by a code without names. This record is deleted 5 years after removal, a period that allows responding to questions from the agency or the travelers about the service.
• Backups: the database keeps copies for recovery in case of failure. Removed data stops existing in them within 6 hours.
• Business contacts: for the length of the conversation and, if there is a contract, while it lasts and for the periods required by law.

10. What stays on the phone

To work without internet, the app keeps on the phone an encrypted copy of the trip, the latest assistant messages, expenses not yet synced and the theme and language preferences. If the traveler checks "Remember on this device", the phone also keeps the key that opens the trip without asking for the password again; the lock button deletes that key.

The app already installed keeps opening without internet after online access ends. To remove that copy, just delete the app or the site data in the browser settings.

11. Your rights

Under the LGPD, you can request confirmation that we process your data, access to it, correction of incomplete or wrong data, deletion, portability, information about whom it was shared with and withdrawal of consent, when consent is the basis for the processing.

If you are a traveler, the request can be made to the agency that sold the trip, which is the controller of your data, or directly to Valise at the email below. In that case, we notify the agency and help fulfill the request.

You can also file a complaint with Brazil's National Data Protection Authority (ANPD).

12. Data protection officer and contact

13. Security incidents

If an incident occurs that may bring relevant risk or harm to data subjects, Valise notifies the agency responsible for the trip without delay, so that notices to the ANPD and to data subjects are made within the legal deadlines.

14. Changes to this policy

This policy may be updated when the service changes. The date at the top shows the version in force, and relevant changes are communicated to partner agencies.