Privacy Policy

• Identification & contact data: name, email, phone/WhatsApp number, preferred language.
• Booking data: destinations, travel dates, service requests, special requirements.
• Documents you upload: passport, residence and financial proof, photos and other visa or travel documents.
• Payment data: invoice details and payment status. Card and PIX data are processed directly by our payment provider (Mercado Pago); we do not store full card numbers.
• Communications: messages exchanged through the portal and WhatsApp.
• Technical data: IP address, device and browser information, and cookie identifiers (see our Cookie Policy).

We process personal data to: provide and manage travel services and your account; prepare visa and relocation documentation; issue invoices and process payments; communicate with you (including AI-assisted WhatsApp replies); comply with legal obligations; and, with your consent, measure and advertise our services.

Legal bases under the LGPD (Art. 7/11) and GDPR (Art. 6): performance of a contract, your consent, our legitimate interests, and compliance with legal or regulatory obligations.

We share data only as needed to deliver our services, with: Supabase (hosting, database and document storage); Mercado Pago (payments); Z-API and Meta WhatsApp (messaging); Resend (transactional email); Anthropic (AI assistant); and travel suppliers such as airlines, hotels, cruise lines, insurers and consulates/embassies to fulfil your bookings and visa requests.

We never sell your personal data.

With your consent, we use measurement and advertising tools from Meta Platforms (Facebook/Instagram Pixel and Conversions API), Google (Google Analytics, Google Ads and remarketing) and TikTok (TikTok Pixel). These tools may set cookies and receive hashed identifiers (such as a hashed email or device ID) to measure campaigns and show you relevant ads, including custom and lookalike audiences.

These platforms act as independent or joint controllers for their own processing. You can manage or withdraw consent at any time via our cookie banner and through each platform's ad settings. See our Cookie Policy for the full list.

Some providers process data outside Brazil (for example in the United States or the EU). We rely on adequacy decisions, Standard Contractual Clauses and equivalent safeguards permitted by the LGPD (Art. 33) and GDPR (Chapter V).

Under the LGPD you may request: confirmation and access; correction; anonymization, blocking or deletion of unnecessary data; portability; information about sharing; and withdrawal of consent. GDPR adds restriction and objection rights; CCPA/CPRA residents may request to know, delete, correct and opt out of "sharing" for targeted advertising.

To exercise any right, contact us at omar@ootravel.com.br. You also have the right to lodge a complaint with Brazil's data authority (ANPD) or your local supervisory authority.

We keep personal data only as long as necessary for the purposes above and to meet legal, tax and regulatory obligations, then delete or anonymize it. We apply technical and organizational safeguards including encryption in transit, access controls and per-client storage isolation (Row Level Security).

Our services are intended for adults (18+). We do not knowingly collect data from children without parental consent; minors travelling are handled through the responsible adult's account.

Data controller: 63.588.045 OMAR OUKHIRA (OO Travel), CNPJ 63.588.045/0001-49, São Paulo, Brasil. Privacy contact / DPO: omar@ootravel.com.br.

We may update this policy; the "last updated" date below reflects the current version.