Your rights, our responsibilities, and the rules of travel
Last Updated: October 7, 2026
Welcome to Kiri Travel ("we," "our," or "us"). We are committed to protecting your privacy and ensuring you have a positive experience on our website and while using our app. This policy explains our data practices and your rights regarding your personal information.
The controller of your personal data is Icaro Sabino Torres, who publishes the Kiri Travel app. For any question about your data, write to contact@kiritravel.eu.
We collect information you provide directly, including:
When you use our services, we automatically collect:
We process your personal data based on the following legal grounds:
Contract (Art. 6(1)(b)): Processing necessary to provide our services — including account creation, trip planning, itinerary management, and customer support.
Consent (Art. 6(1)(a)): Where you have given explicit consent — including marketing emails, newsletters, optional location sharing, and non-essential cookies (analytics and preference cookies).
Legitimate Interest (Art. 6(1)(f)): Processing necessary for our legitimate interests — including service improvement, fraud prevention, security, and recording technical errors so we can fix them.
Legal Obligation (Art. 6(1)(c)): Processing required to comply with applicable laws — including tax obligations, legal requests from authorities, and data breach notifications.
You may withdraw your consent at any time where consent is the legal basis for processing. Withdrawal does not affect the lawfulness of processing carried out before the withdrawal.
We use your information to:
We may share your information with:
We never sell your personal information to third parties.
We use the following service providers to run the website and the app. Most process data on our behalf; some, such as Google, also act under their own privacy policies, linked below:
Google Analytics (GA4) — Website analytics and usage statistics (policies.google.com/privacy)
Hotjar — Heatmaps and session recordings for UX improvement (hotjar.com/privacy)
Mapbox — Maps and location services (mapbox.com/privacy)
Resend — Transactional and marketing email delivery (resend.com/privacy)
Supabase (AWS EU) — Database hosting, authentication, and backend services (supabase.com/privacy)
Google AdMob — Ads shown in the app (policies.google.com/technologies/ads)
Sentry — Reports of technical errors on the website (Runs on our own server)
YouTube (Google) — Videos on the website, in privacy-enhanced mode (policies.google.com/privacy)
ipapi.co — Approximate country from the IP address (ipapi.co/privacy)
Cloudflare Turnstile — Checking that the website's forms are sent by a person; it loads only when you start filling in a form, and Cloudflare receives your IP address and technical data about your browser (cloudflare.com/turnstile-privacy-policy)
Ads in the app: the app shows ads served by Google AdMob. To show and measure them, Google may use your device's advertising identifier, your IP address and your interactions with the ads, under its own policy. You can reset or limit the use of the advertising identifier in your device settings. The website shows no ads of its own.
Videos: videos on the website play from YouTube in privacy-enhanced mode (youtube-nocookie.com). The video on the home page loads only when you choose to play it; a video embedded in another page loads with that page. When a video loads, Google receives your IP address and technical data about your browser, under its own privacy policy.
This list is updated when we add or change service providers.
Under the GDPR and applicable data protection laws, you have the right to:
Access — Request a copy of the personal data we hold about you.
Rectification — Correct any inaccurate or incomplete personal information.
Erasure — Request deletion of your account and personal data.
Restriction — Request restriction of processing in certain circumstances.
Object — Object to processing based on legitimate interests.
Data Portability (Art. 20) — Request your personal data in a structured, commonly used, machine-readable format (JSON). To exercise this right, contact us at contact@kiritravel.eu and we will provide your data export within 30 days.
Withdraw Consent — Where processing is based on consent, you may withdraw it at any time.
Lodge a Complaint — You have the right to lodge a complaint with your local data protection authority (in Portugal: CNPD — Comissão Nacional de Proteção de Dados ).
To exercise any of these rights, contact us at contact@kiritravel.eu . We will respond within 30 days.
We implement appropriate technical and organizational measures to protect your personal information, including encryption in transit (TLS/SSL), secure authentication, and access controls. However, no internet transmission is completely secure, so we cannot guarantee absolute security.
Our main data processing takes place in the European Union. Some providers listed in Section 6 may process data outside the EU/EEA. In such cases, the transfer relies on the safeguards provided for in GDPR Chapter V, such as an adequacy decision or the Standard Contractual Clauses approved by the European Commission, as offered by each provider.
We retain your personal data only as long as necessary for the purposes described in this policy. When you delete your account, we delete your personal data or make it anonymous, except where the law requires us to keep it. Data that has been made anonymous can no longer be linked to you and may be kept.
We use cookies and similar tracking technologies to enhance your experience. Below are the specific tools and cookie types we use:
Essential cookies: Required for basic functionality such as session management and security. These cannot be disabled.
Statistics (off until you turn them on): with your consent, Google Analytics 4 (GA4) measures how the website is used, such as the pages visited and the length of visits, using cookies; we also record the page visited, the referring page, the browser and operating system, and the approximate country, which ipapi.co works out from your IP address. You can turn statistics on or off at any time on the privacy choices page.
Experience analytics (off until you turn them on): with your consent, Hotjar creates heatmaps and recordings of visits that show how the website is used, so we can improve it. You can turn it on or off at any time on the privacy choices page.
Preference cookies: Remember your settings and choices (such as language or region) to provide a more personalized experience.
The website shows no ads of its own and sets no advertising cookies. A YouTube video, once you play it, follows Google's policy (see Section 6). The app shows ads, as described in Section 6. You can also manage or delete cookies in your browser settings; disabling essential cookies may affect how the website works.
Kiri Travel is intended for users aged 13 and above. We do not knowingly collect data from children under 13. If we discover that we have collected data from a child under 13, we will delete it promptly.
We may update this policy periodically. We will notify you of significant changes by posting a notice on our website or sending you an email. Continued use of our services after changes constitutes acceptance of the updated policy.
For all privacy-related inquiries, data protection requests, or to exercise your rights under GDPR, please contact our Data Protection team:
Email: contact@kiritravel.eu
Response time: We aim to respond to all requests within 30 days.
If you are not satisfied with our response, you have the right to lodge a complaint with the Portuguese Data Protection Authority (CNPD) at www.cnpd.pt .
If you have general questions about this policy or our practices, please contact us at contact@kiritravel.eu .
Last Updated: October 5, 2026
By accessing or using Kiri Travel's website or mobile app, you agree to be bound by these Terms and Conditions ("Terms"). If you do not agree to these Terms, please do not use our services.
Kiri Travel is operated by Icaro Sabino Torres. Contact: contact@kiritravel.eu.
Our services are designed to help you plan, organize, and enjoy your travels. You may use our services only as permitted by these Terms and applicable laws.
To use certain features, you may need to create an account. You are responsible for maintaining the confidentiality of your account credentials and for all activities under your account.
Kiri Travel is recommended for users aged 13 or older.
Our services may allow you to upload, submit, store, or share content. You retain ownership of your content, but grant us a non-exclusive, royalty-free license to use, reproduce, modify, and display your content for the purpose of operating and improving our services.
You are solely responsible for the content you post. Content must not be illegal, infringing, offensive, or violate the rights of others.
While we strive to provide accurate information about destinations, accommodations, and activities, we do not guarantee the accuracy, completeness, or reliability of any travel information.
For bookings made through our platform, the terms and conditions of the relevant travel service provider (airline, hotel, tour operator, etc.) will also apply.
Our services and content, including logos, trademarks, text, graphics, and software, are owned by Kiri Travel or our licensors and are protected by copyright and other intellectual property laws. You may not use, copy, or distribute our content without our permission.
When using our services, you must not:
Our services are provided "as is" without any warranties, express or implied. We do not warrant that our services will be uninterrupted, error-free, or secure.
To the maximum extent permitted by law, Kiri Travel shall not be liable for any indirect, incidental, special, consequential, or punitive damages arising from your use of or inability to use our services.
We may modify these Terms at any time. If we make material changes, we will notify you through our website or app. Your continued use of our services after changes indicates your acceptance of the revised Terms.
These Terms are governed by the laws of Portugal, without regard to its conflict of law provisions. Any disputes arising from these Terms shall be subject to the exclusive jurisdiction of the courts of Portugal.
You acknowledge that these Terms are between you and Kiri Travel only, and not with Apple Inc. or Google LLC. Kiri Travel is solely responsible for the app and its content. Apple and Google have no obligation to furnish any maintenance or support services for the app. To the maximum extent permitted by law, Apple and Google will have no warranty obligation whatsoever with respect to the app.
You agree to indemnify, defend, and hold harmless Kiri Travel, its officers, directors, employees, and agents from and against any claims, liabilities, damages, losses, and expenses (including reasonable legal fees) arising out of or in connection with:
This indemnification obligation shall survive the termination of your account and these Terms.
If you have any questions about these Terms, please contact us at contact@kiritravel.eu .