Privacy Policy
Last updated: 2026-11-02
1. Who is responsible?
The data controller is Olidourado LLC.
Registered office: 7345 W Sand Lake Rd, Suite 210, Office 8080, Orlando, FL 32819, United States.
Contact for any privacy matter: contact@govumbora.com.
2. The short version
GoVumbora works without accounts. We do not ask who you are, we keep no access logs, and the only data that reaches our own server is what you search (your route, dates and party size) and your IP address, which it uses for a few minutes to make sure nobody overloads the service.
The one exception to "we run no advertising": with your consent, the app and this site show ads served by Google (AdMob in the mobile apps, AdSense on the website). If you decline, nothing ad-related is loaded — the ad slots stay empty. If you accept, Google receives your IP address and, where required by law only after a separate consent, parts of your device/ad identifiers so the ads can be measured and (only with that second consent) personalised. You can change your choice at any time from the privacy options entry point in the app's settings or the "Ad choices" link on the site.
Booking links on the travel guides are a second, smaller exception: some of them are affiliate links. When you follow one, our affiliate partner Travelpayouts may store a short-lived reference (a cookie) in your browser so a booking made through the link can be credited to this site. Nothing more is asked of you; §8 has the details.
We also measure how the site itself is used — which pages are visited and where visitors arrive from — with our own cookieless, self-hosted analytics. It stores no name, no cookie and no raw IP address, so it cannot tell who you are; §3 and §7 have the details.
3. What we process
- Search parameters: departure and destination, travel dates, number of passengers or guests, and any free-text place name you type. These describe your trip, not you: they are not linked to any name, email or account, because none exist.
- IP address: used solely to protect the service against overload and abuse (rate limiting). It is kept in server memory for at most one hour, is never written to a database or a log file, and is never forwarded to third parties.
- Site usage (analytics): when you browse the site, our self-hosted analytics records the page address (including the search parameters visible in the app URL — the same trip data as above), the referring page, your screen size and a coarse browser/operating-system class. It uses no cookies and no identifiers; to tell returning visits apart it stores a one-way hash of IP address + browser details, which cannot be reversed to identify you.
When, and only when, you consent to ads, processing by Google's ad systems is added: your IP address (transmitted with every ad request), coarse interaction data (ad views/clicks), and — subject to a separate consent for personalised advertising — device identifiers such as the mobile advertising ID. Without consent, no ad request is made at all.
We do not process: names, emails, postal addresses, payment details, precise geolocation, contacts, photos, or any special categories of data. Advertising identifiers are processed only by Google's ad systems and only with your consent (see §5 and §8).
4. Why we process it (purposes and legal bases)
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Providing the price search you request (including caching results so repeat searches stay fast) | Search parameters | Legitimate interest, Art. 6(1)(f) GDPR |
| Keeping the service available and protecting paid data sources from abuse (rate limiting) | IP address | Legitimate interest in network and information security, Art. 6(1)(f) and Recital 49 GDPR |
| Crediting bookings made through affiliate links (attribution) | A click reference stored in your browser when you follow an affiliate booking link | Legitimate interest, Art. 6(1)(f) GDPR |
| Understanding aggregate site usage (page views, referrers, device mix) to improve the content | Page address, referrer, screen size, browser class, hashed-IP session key | Legitimate interest, Art. 6(1)(f) GDPR |
| Serving advertising, measuring its delivery (aggregated) | IP address, interaction data | Consent — Art. 6(1)(a) GDPR, via the consent banner / UMP form |
| Personalising advertising (optional, separate toggle) | Advertising / device identifiers | Consent — Art. 6(1)(a) GDPR, revocable at any time |
We do not use your data for profiling or automated decision-making, and we do not sell it. Advertising is served by Google under your consent, as described in §5 and §8.
5. Who receives data?
To answer a search we must ask third-party data providers. They receive only the trip parameters needed for the query (city or airport codes, dates, party size), never your IP address and never any request headers:
- Booking.com data via the RapidAPI gateway: flight and hotel price searches, and place-name autocomplete.
- OpenTripMap: attractions and sights near your destination.
- WhereNext: open-data food-cost estimates.
When you open a result's image or follow a booking link, you deal directly with that provider's systems; their servers see your IP address and browser information, and their own privacy policies apply from that point.
The usage analytics (§3) are served and stored by our own server inside the EU — no analytics data is shared with any third party.
Outbound booking links on the guides may be affiliate links handled by Travelpayouts (the affiliate network of the Aviasales group). When you follow one, its script may store an attribution cookie in your browser so the booking can be credited; what it processes is that click reference, not your identity. Travelpayouts acts as an independent controller for this purpose; its own privacy terms apply (see travelpayouts.com).
Our site is hosted by OVH HOSTING SISTEMAS INFORMÁTICOS UNIPESSOAL LDA in Portugal, which acts as our hosting processor under the GDPR.
When you consent to ads, Google Ireland Limited / Google LLC is added as a recipient: Google's ad systems (AdMob in the mobile apps, AdSense on the website) receive your IP address and ad-interaction data to serve and measure ads; with the separate personalisation consent they also receive device/ad identifiers. Google acts as an independent controller for these purposes; its own product privacy notices apply: policies.google.com/technologies/ads.
6. Data outside the EEA
Some providers or their gateways are based outside the European Economic Area (for example the United States). Where that is the case, transfers rely on the European Commission's adequacy decision for the EU–US Data Privacy Framework or on standard contractual clauses. We verify each provider's safeguards regularly and keep the record internally.
7. How long we keep it
| Data | Kept for |
|---|---|
| IP address (rate limiting, server memory only) | At most 1 hour, gone on restart |
| Flight search cache (route, dates, prices) | 12 hours |
| Hotel search cache | 18 hours |
| Attractions cache | 60 days (contains no personal data) |
| Food-cost cache | 90 days (contains no personal data) |
| Affiliate attribution reference (set when you click an affiliate booking link) | Typically 30 days; the exact window depends on the partner program |
| Analytics events (page, referrer, device class, hashed-IP session key) | 180 days, deleted automatically |
| Ad-request data (IP, interaction events) | Per Google's retention for ad serving; we keep no copy |
| Application logs | We keep no request logs: no IP addresses, no query contents |
8. Cookies and similar technologies
The site and apps themselves set no cookies of their own — our usage analytics (§3) is cookieless too. When you consent to advertising, Google's ad systems use cookies (web) and device identifiers (mobile apps) to serve and measure ads — that is what the consent banner and, in the apps, the consent form ask about before anything loads. If you decline, no ad cookies or identifiers are used. You can revisit your choice at any time: "Ad choices" on the website, the privacy options entry in the apps.
One category sits outside advertising: the guides' outbound booking links may be affiliate links. When you follow one, the Travelpayouts script may store a short-lived attribution cookie so the booking can be credited to this site. The cookie holds a click reference, not an identity; it is set on your click, not on page load, and it is not used to profile you. No data is sold, and no affiliate partner receives anything unless you click through.
9. Your rights
Under the GDPR you have the right to access, rectify, erase, restrict, object to, and (where applicable) port your personal data. Because we hold almost no data attributable to any individual, these rights are mostly satisfied by design: there is no profile to inspect. The one visitor-linkable store is the analytics session key (§3): if you exercise your rights, we will erase the analytics data we hold for you.
To exercise any right, email contact@govumbora.com. If you are not satisfied with our answer, you may lodge a complaint with the data protection authority where you live — in Portugal, the CNPD (Comissão Nacional de Proteção de Dados, www.cnpd.pt).
10. Security
The service runs on a hardened server in the European Union, encrypted with HTTPS (TLS), with the database reachable only from the application server itself. We practise data minimization: the least data possible, for the shortest time possible.
11. Changes to this policy
If the service ever changes, for example by adding accounts or analytics, we will update this policy and its date above before the change goes live.