Privacy Policy

The short version: we never sell your personal data, and you can delete your account and everything tied to it at any time.

Who handles your data

Fincares Ltda, CNPJ 52.139.993/0001-80, based at Rua Caçador, 48, São José, Santa Catarina, Brazil, is responsible for processing the personal data collected by Galmund. You can reach our data protection contact at support@galmund.com.

This policy applies to users in Brazil under the LGPD, in the European Union under the GDPR, and in California under the CCPA/CPRA.

What data we collect

We collect what's needed for sign-up and login, like your email, password, and Google sign-in details. Your profile may include a username, display name, avatar, home city and country, and your preferred currency and distance unit.

When you upload photos and videos, we collect the location coordinates for each memory, the original files and thumbnails, and metadata like GPS, date, and device model, when present in the file.

We also keep your trip data (destinations, schedule, stays, flights, estimated budget), the email addresses of people you invite to collaborate on an itinerary, the questions you ask our trip-planning AI assistant and the history of those conversations, reviews you write about places you've visited, information about how you found Galmund (so we can understand which channels work), and technical data like your IP address, device and browser type, and usage and error logs.

How we collect your data

Most of it comes directly from you: when you create your account, fill out your profile, upload photos and videos, plan trips, or contact us. We also automatically collect some technical data as you browse, and we receive information from Google when you use Google sign-in or import media from Google Drive. GPS coordinates and dates can also be embedded in the photo and video files you upload.

Why we use your data

We use your data to provide the service (setting up your account, organizing your memories and trips), to improve Galmund based on how people use it, to prevent fraud and keep things secure, and to meet legal obligations when required.

Galmund doesn't sell or share personal data with third parties for advertising purposes.

Who we share your data with

We work with a few service providers to run Galmund, and each one only gets what it needs for its job:

• Supabase, for database hosting, authentication, and media storage.
• Google, for sign-in, optional Google Drive import, the Gemini AI that identifies locations in photos and answers questions in the trip-planning assistant, and hotel, restaurant, and attraction search via Google Places.
• OpenStreetMap, Wikipedia, OpenRouteService, Geoapify, AviationStack, and currency exchange providers, for location, attraction, route, flight, and rate lookups, each receiving only the minimum needed for that lookup.

We may also disclose data when required by law, court order, or a competent authority, or to protect our rights and safety, or those of our users or others. Outside of those cases, we never sell your personal data.

International transfers

Some of the providers above process data outside Brazil, including in the United States. For users in the European Union, we rely on GDPR-recognized safeguards, like standard contractual clauses. For users in Brazil, we follow the LGPD's rules for this kind of transfer.

Cookies

We use essential cookies to keep you signed in, and a bit of local browser storage to understand where our users come from. Full details are in our Cookie Notice.

How long we keep your data

We keep your account data as long as your account is active. When you request deletion, everything tied to it (memories, trips, reviews, favorites) is permanently erased within a few minutes.

Photos and videos sent to our location-detection AI are only processed at the moment of analysis, and we don't use that content to train our own or third-party models. Conversations with the trip-planning AI assistant are kept so you can pick up where you left off on another day, and are deleted along with the rest of your data when you delete your account. Unaccepted trip invitations expire after 7 days.

If you don't sign in for a long period, we may email you to ask if you'd like to keep your account. Without a response, the account and its data may be permanently deleted.

Security

We protect your data with per-user access controls in our database, per-account file isolation in media storage, and encrypted connections across most of our integrations. No system is perfectly secure; if we identify a significant incident, we'll notify affected authorities and people as required by law.

Your rights

In Brazil, you can confirm whether we're processing your data, access it, correct it, request anonymization, blocking, or deletion, request portability, find out who we share your information with, withdraw consent, and object to processing done on another legal basis.

In the European Union, you have the right to access, rectify, erase, restrict processing, port your data, object to processing (including for direct marketing), and not be subject to automated decisions with legal effects on you. You can also file a complaint with your country's data protection authority.

In California, you can find out what data we collect and why, request deletion, correct inaccurate information, and limit the use of sensitive data. Since we don't sell or share data for advertising, there's no need to opt out of a sale, but you're welcome to confirm that with us anytime.

To exercise any of these rights, write to support@galmund.com.

Minors

Galmund is meant for adults 18 and older, and we don't knowingly collect sign-up data from minors. Photos uploaded by adult users may show minor family members as part of the travel content; in that case, the person uploading is responsible for having the appropriate permission. If you believe an account belongs to someone under 18, write to support@galmund.com.

Changes to this policy

We may update this policy from time to time. Significant changes will be announced with reasonable notice.

Get in touch

Fincares Ltda, CNPJ 52.139.993/0001-80, Rua Caçador, 48, São José, Santa Catarina, Brazil. Email: support@galmund.com.