Privacy Policy

The short version: we never sell your personal data, and you can delete your account and everything tied to it at any time.

Who handles your data

Fincares Ltda, CNPJ 52.139.993/0001-80, based at Rua Caçador, 48, São José, Santa Catarina, Brazil, is responsible for processing the personal data collected by Galmund. You can reach our data protection contact at support@galmund.com.

This policy applies to users in Brazil under the LGPD, in the European Union under the GDPR, and in California under the CCPA/CPRA.

What data we collect

We collect what's needed for sign-up and login, like your email, password, and Google sign-in details. Your profile may include a username, display name, avatar, home city and country, and your preferred currency and distance unit.

When you upload photos and videos, we collect the location coordinates for each memory, the original files and thumbnails, and metadata like GPS, date, and device model, when present in the file.

We also keep your trip data (destinations, schedule, stays, flights, estimated budget), the email addresses of people you invite to collaborate on an itinerary, the questions you ask our trip-planning AI assistant and the history of those conversations, reviews you write about places you've visited, information about how you found Galmund (so we can understand which channels work), and technical data like your IP address, device and browser type, and usage and error logs.

We also collect your approximate current location and its history (resolved from your trips, a manual setting in your profile, or in the future, your browser's location with your consent, never from continuous GPS tracking of your device), along with who you connect with or block, and the likes, comments, and reports you make in the Community Feed.

How we collect your data

Most of it comes directly from you: when you create your account, fill out your profile, upload photos and videos, plan trips, or contact us. We also automatically collect some technical data as you browse, and we receive information from Google when you use Google sign-in or import media from Google Drive. GPS coordinates and dates can also be embedded in the photo and video files you upload.

Why we use your data

We use your data to provide the service (setting up your account, organizing your memories and trips, showing your approximate location and the countries you've visited to the people you connect with in Community mode), to improve Galmund based on how people use it, to prevent fraud and keep things secure, and to meet legal obligations when required.

Galmund never sells your personal data. We share only cryptographically hashed identifiers with Meta (Facebook) to measure how well our own ads are performing, never so other companies can advertise to you using this data. See the details under "Who we share your data with" and in our Cookie Notice.

Who we share your data with

We work with a few service providers to run Galmund, and each one only gets what it needs for its job:

• Supabase, for database hosting, authentication, and media storage.
• Google, for sign-in, optional Google Drive import, the Gemini AI that identifies locations in photos and answers questions in the trip-planning assistant, and hotel, restaurant, and attraction search via Google Places.
• Meta (Facebook), to measure how well our own ads are performing: it only receives a hash of your email, your IP address, browser information, and the ad click identifier, only when you sign up or subscribe to a paid plan, never your name or your account's content.
• OpenStreetMap, Wikipedia, OpenRouteService, Geoapify, AviationStack, and currency exchange providers, for location, attraction, route, flight, and rate lookups, each receiving only the minimum needed for that lookup.

We may also disclose data when required by law, court order, or a competent authority, or to protect our rights and safety, or those of our users or others. Before responding to any request from a public authority, we review its legitimacy (confirming it has a valid legal basis and falls within the scope allowed), and when we do respond, we disclose only the minimum amount of information needed to address what was requested. Outside of those cases, we never sell your personal data.

Instagram connection

Importing photos and videos from Instagram is an optional connection, available only for Instagram professional accounts (Creator or Business); personal accounts are rejected before we record any data. We use Meta's official API ("Instagram API with Instagram Login", instagram_business_basic permission).

When you connect, we read your username, account ID and type, and your profile picture (shown only on the connection screen, never stored), along with your feed posts, Reels, each photo in a carousel, and active stories from the last 24 hours, a limit set by the API itself, with the caption, publish date, and link for each item. We don't read messages, followers, likes, comments, highlights, or post location, since the API doesn't provide it.

We store the access token to your Instagram account (valid for 60 days, automatically renewed while the connection exists, kept only on our server and never sent to the browser), the account's ID and username, and the list of items you've hidden on the import screen. For posts you choose to import, we store a copy of the file and thumbnail in our storage, the caption, the date, the suggested place, and the original post's ID, so we don't offer it to you again.

We use this data only to build memories that you choose to review and publish. The caption and image may be sent to Google's AI (Gemini) to suggest the location, under the same rule as the rest of this policy: nothing is used to train our own or third-party models. Galmund only reads your Instagram account. It doesn't post, comment, or change anything on it.

Once connected, new posts and stories are automatically detected once a day and whenever you open the app, entering a queue of suggested memories; nothing is published without an action from you. Detection is paused after 30 days without accessing Galmund, and resumes when you come back.

You can disconnect at any time from Galmund: this immediately deletes the token and the connection, and cancels imports in progress. Memories already published and items already in the queue remain, since they've become content in your Galmund account. Removing Galmund under "Apps and Websites" in your Instagram settings has the same effect: Meta notifies us and we delete the connection automatically. If Meta processes a data deletion request on your behalf, we also delete the connection, and you'll get a confirmation code and can track the request at galmund.com/instagram/exclusao-de-dados. Memories imported from Instagram are deleted like any other memory, one at a time or along with your account, which also deletes the connection, the import history, and the list of hidden items.

In this integration, Meta is the source of the data, and Google (Gemini) processes the location suggestion; no data is sold.

International transfers

Some of the providers above process data outside Brazil, including in the United States. For users in the European Union, we rely on GDPR-recognized safeguards, like standard contractual clauses. For users in Brazil, we follow the LGPD's rules for this kind of transfer.

Cookies

We use essential cookies to keep you signed in, and a bit of local browser storage to understand where our users come from. Full details are in our Cookie Notice.

How long we keep your data

We keep your account data as long as your account is active. When you request deletion, everything tied to it (memories, trips, reviews, favorites) is permanently erased within a few minutes.

Photos and videos sent to our location-detection AI are only processed at the moment of analysis, and we don't use that content to train our own or third-party models. Conversations with the trip-planning AI assistant are kept so you can pick up where you left off on another day, and are deleted along with the rest of your data when you delete your account. The same goes for your approximate location, its history, your connections, and the likes/comments you make in the Feed: they're kept while your account exists and are deleted with it. Unaccepted trip invitations expire after 7 days.

If you don't sign in for a long period, we may email you to ask if you'd like to keep your account. Without a response, the account and its data may be permanently deleted.

Security

We protect your data with per-user access controls in our database, per-account file isolation in media storage, and encrypted connections across most of our integrations. No system is perfectly secure; if we identify a significant incident, we'll notify affected authorities and people as required by law.

Your rights

In Brazil, you can confirm whether we're processing your data, access it, correct it, request anonymization, blocking, or deletion, request portability, find out who we share your information with, withdraw consent, and object to processing done on another legal basis.

In the European Union, you have the right to access, rectify, erase, restrict processing, port your data, object to processing (including for direct marketing), and not be subject to automated decisions with legal effects on you. You can also file a complaint with your country's data protection authority.

In California, you can find out what data we collect and why, request deletion, correct inaccurate information, and limit the use of sensitive data. We never sell your personal data. The hashed identifiers we share with Meta to measure our ads (see "Who we share your data with") may qualify as "sharing" under the CCPA/CPRA; to ask us to stop sharing your data this way, write to support@galmund.com.

To exercise any of these rights, write to support@galmund.com.

Minors

Galmund is meant for adults 18 and older, and we don't knowingly collect sign-up data from minors. Photos uploaded by adult users may show minor family members as part of the travel content; in that case, the person uploading is responsible for having the appropriate permission. If you believe an account belongs to someone under 18, write to support@galmund.com.

Changes to this policy

We may update this policy from time to time. Significant changes will be announced with reasonable notice.

Get in touch

Fincares Ltda, CNPJ 52.139.993/0001-80, Rua Caçador, 48, São José, Santa Catarina, Brazil. Email: support@galmund.com.