Privacy Policy
Last updated: 2026-09-21
1. Who is responsible?
The data controller is Olidourado LLC.
Registered office: 7345 W Sand Lake Rd, Suite 210, Office 8080, Orlando, FL 32819, United States.
Contact for any privacy matter: contact@govumbora.com.
2. The short version
GoVumbora works without accounts. We do not ask who you are, we keep no access logs, and the only data that reaches our own server is what you search (your route, dates and party size) and your IP address, which it uses for a few minutes to make sure nobody overloads the service.
The one exception to "we run no advertising": with your consent, the app and this site show ads served by Google (AdMob in the mobile apps, AdSense on the website). If you decline, nothing ad-related is loaded — the ad slots stay empty. If you accept, Google receives your IP address and, where required by law only after a separate consent, parts of your device/ad identifiers so the ads can be measured and (only with that second consent) personalised. You can change your choice at any time from the privacy options entry point in the app's settings or the "Ad choices" link on the site.
3. What we process
- Search parameters: departure and destination, travel dates, number of passengers or guests, and any free-text place name you type. These describe your trip, not you: they are not linked to any name, email or account, because none exist.
- IP address: used solely to protect the service against overload and abuse (rate limiting). It is kept in server memory for at most one hour, is never written to a database or a log file, and is never forwarded to third parties.
When, and only when, you consent to ads, processing by Google's ad systems is added: your IP address (transmitted with every ad request), coarse interaction data (ad views/clicks), and — subject to a separate consent for personalised advertising — device identifiers such as the mobile advertising ID. Without consent, no ad request is made at all.
We do not process: names, emails, postal addresses, payment details, precise geolocation, contacts, photos, or any special categories of data. Advertising identifiers are processed only by Google's ad systems and only with your consent (see §5 and §8).
4. Why we process it (purposes and legal bases)
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Providing the price search you request (including caching results so repeat searches stay fast) | Search parameters | Legitimate interest, Art. 6(1)(f) GDPR |
| Keeping the service available and protecting paid data sources from abuse (rate limiting) | IP address | Legitimate interest in network and information security, Art. 6(1)(f) and Recital 49 GDPR |
| Serving advertising, measuring its delivery (aggregated) | IP address, interaction data | Consent — Art. 6(1)(a) GDPR, via the consent banner / UMP form |
| Personalising advertising (optional, separate toggle) | Advertising / device identifiers | Consent — Art. 6(1)(a) GDPR, revocable at any time |
We do not use your data for profiling or automated decision-making, and we do not sell it. Advertising is served by Google under your consent, as described in §5 and §8.
5. Who receives data?
To answer a search we must ask third-party data providers. They receive only the trip parameters needed for the query (city or airport codes, dates, party size), never your IP address and never any request headers:
- Booking.com data via the RapidAPI gateway: flight and hotel price searches, and place-name autocomplete.
- OpenTripMap: attractions and sights near your destination.
- WhereNext: open-data food-cost estimates.
When you open a result's image or follow a booking link, you deal directly with that provider's systems; their servers see your IP address and browser information, and their own privacy policies apply from that point.
Our site is hosted by OVH HOSTING SISTEMAS INFORMÁTICOS UNIPESSOAL LDA in Portugal, which acts as our hosting processor under the GDPR.
When you consent to ads, Google Ireland Limited / Google LLC is added as a recipient: Google's ad systems (AdMob in the mobile apps, AdSense on the website) receive your IP address and ad-interaction data to serve and measure ads; with the separate personalisation consent they also receive device/ad identifiers. Google acts as an independent controller for these purposes; its own product privacy notices apply: policies.google.com/technologies/ads.
6. Data outside the EEA
Some providers or their gateways are based outside the European Economic Area (for example the United States). Where that is the case, transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework or on standard contractual clauses. We verify each provider's safeguards regularly and keep the record internally.
7. How long we keep it
| Data | Kept for |
|---|---|
| IP address (rate limiting, server memory only) | At most 1 hour, gone on restart |
| Flight search cache (route, dates, prices) | 12 hours |
| Hotel search cache | 18 hours |
| Attractions cache | 60 days (contains no personal data) |
| Food-cost cache | 90 days (contains no personal data) |
| Ad-request data (IP, interaction events) | Per Google's retention for ad serving; we keep no copy |
| Application logs | We keep no request logs: no IP addresses, no query contents |
8. Cookies and similar technologies
The site and apps themselves set no cookies of their own. When you consent to advertising, Google's ad systems use cookies (web) and device identifiers (mobile apps) to serve and measure ads — that is what the consent banner and, in the apps, the consent form ask about before anything loads. If you decline, no ad cookies or identifiers are used. You can revisit your choice at any time: "Ad choices" on the website, the privacy options entry in the apps.
9. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict, object to, and (where applicable) port your personal data. Because we hold no data attributable to any individual, these rights are mostly satisfied by design: there is no profile to inspect and nothing attributable to delete.
To exercise any right, email contact@govumbora.com. If you are not satisfied with our answer, you may lodge a complaint with the data protection authority where you live — in Portugal, the CNPD (Comissão Nacional de Proteção de Dados, www.cnpd.pt).
10. Security
The service runs on a hardened server in the European Union, encrypted with HTTPS (TLS), with the database reachable only from the application server itself. We practise data minimization: the least data possible, for the shortest time possible.
11. Changes to this policy
If the service ever changes, for example by adding accounts or analytics, we will update this policy and its date above before the change goes live.