Privacy policy

Last updated: 16 October 2026

1. Data controller

A. Mano Travel Consulting (Andreia Mano), a travel intermediary with no office open to the public; contact: contact@andreiamano.com. The site is built and hosted by André Soares on behalf of A. Mano Travel Consulting, and only accesses the data to keep the site running. This policy applies under the General Data Protection Regulation (GDPR, EU 2016/679) and the Swiss Federal Act on Data Protection (FADP/nLPD).

2. What data we process and why

• Account (email and username): so you can sign in with a magic link. Legal basis: performance of the contract/terms of use.
• Photos and itineraries that you publish: to show them on the site. We always remove all metadata (EXIF, GPS, camera model) and never publish the original photo. Coordinates are rounded (to about 100 m) and you can hide any pin before publishing. If you upload a GPX route, we keep only the coordinates (rounded the same way), not the file, and remove the points in your private zone. Your private zone (centre and radius) is stored in your account; the "Use my location" button reads your position only in the browser, when you click it, and it only reaches the server if you save the zone.
• Agent contact details: only shown to signed-in visitors. When you open the About page or click the email, phone or WhatsApp, we keep your account, the date and time, and your approximate country and city (worked out from your IP on our own server, without storing the IP or sending it to third parties), for 12 months. Legal basis: legitimate interest in knowing who asked for the contact details and preventing abuse.
• Last account IP and blocks: we keep the IP address of your last sign-in to your account for 30 days, so we can block abuse (spam, fake accounts). If an email or IP is blocked, we keep that email or IP, the reason and the duration for as long as the block lasts. Legal basis: legitimate interest in protecting the site and its users.
• Quote requests (name, email, phone, dates, message): to reply to you and prepare the proposal. Legal basis: pre-contractual steps taken at your request, and your consent.
• Public profile and passport (public name, username, itineraries, countries and medals calculated from your public photos): only shown if you have published itineraries. You can change your name in "My account". Legal basis: performance of the terms of use.
• Reviews, likes, votes and contest entries: to show and count them. Legal basis: performance of the terms of use.
• "Itinerary of the month" newsletter (email): only after you confirm your subscription through the link we send you. Every email contains a link to unsubscribe. Legal basis: consent.
• Quiz: we only store the profile you got (with no personal data), for statistics. If you ask for the itinerary by email, the address is used only for that email and is not stored (unless you also choose the newsletter).
• "Where was this?" game: your answers are kept in the session until the end of the game; if you have an account, we store your best score and your result in each weekly game (points and time), and your username appears on the weekly leaderboard, visible to everyone. Without an account, your best score is kept only in your browser.
• Reports (account required): who reported, the reason (and the text you write for "Other reason") and the reported content, for moderation. Legal basis: legitimate interest.
• Technical logs (IP address, temporarily): security and abuse prevention. Legal basis: legitimate interest.
• Visit counts: each itinerary counts one visit per IP address per day, so the ranking is not inflated by reloading. The IP is kept only in the server's memory and forgotten at the end of the day (or when the server restarts); we only store the number of visits. Legal basis: legitimate interest.
• Images made from photos: stamps, share postcards and the itinerary PDF are generated on our server from the published photos and the details you already show (place, date, rounded coordinates). The administrator may also create a painted version (watercolour or poster) of a photo for its stamp, also on our server. These images are deleted when you delete the photo, the itinerary or your account.

3. Cookies

We only use one essential session cookie (sid), created when you sign in, fill in a form or play "Where was this?", to keep your session and protect the forms. In the browser's local storage, which is never sent to the server, we keep the light or dark theme you chose (tema), the game's best score without an account (jogo-melhor) and, only during the visit, that the title plane has already flown (aviao-titulo). We do not use advertising or analytics cookies, which is why we do not show a cookie banner.

4. Sharing and external services

Maps are loaded from OpenStreetMap and, in the satellite views, from Esri (ArcGIS), which receive your IP address when displaying the map. For postcards and the PDF, it is our server that requests the satellite image from Esri, without any of your data. The approximate country and city (see "Agent contact details") come from a DB-IP database stored on our server. The share buttons (WhatsApp, Facebook, X, email) are plain links: nothing is loaded from those networks until you click one. Routes are calculated by OpenRouteService using only the rounded coordinates, with no personal data. In the editor, place name suggestions come from Nominatim (OpenStreetMap) and Photon (komoot): our server requests them on your behalf, so they only receive the typed text and the photo's rounded position (~100 m), without your IP address. Emails are sent through Brevo (Sendinblue SAS, France), which receives the address, subject and text of each email only to deliver it. We do not sell data.

5. Retention

Quote requests are kept for up to 24 months after the last contact. Your account and content are kept until you ask for them to be deleted. A newsletter subscription that is not confirmed within 48 hours lapses; when you unsubscribe, we stop sending you emails and the address is marked as unsubscribed so that it is not used again.

6. Your rights

You can request access, rectification, erasure, restriction and portability, object to the processing, and withdraw your consent at any time: you can download your data and delete your account yourself under "My account"; for anything else, write to contact@andreiamano.com. You also have the right to lodge a complaint with the supervisory authority (in Portugal, the CNPD; in Switzerland, the FDPIC).

7. International transfers

The data is hosted in Switzerland (Zurich). If any provider is located outside the EEA or Switzerland, we apply appropriate safeguards (standard contractual clauses).