Privacy Policy — DreamRoutes
Last updated: October 30, 2026 Version: 1.3
This English version is the reference text. For consumers residing in Brazil, the Portuguese version prevails (Brazilian Consumer Protection Code, arts. 31 and 46).
1. Who we are
DreamRoutes (https://dream-routes.com) is a platform that generates personalized travel
itineraries using artificial intelligence.
The service is operated by MAYCON F S BRITO LTDA, a limited liability company registered in Brazil under company registry number (CNPJ) 36.899.760/0001-20, with its registered office in João Monlevade, Minas Gerais, Brazil, acting as the data controller under Brazilian Law No. 13,709/2018 (General Data Protection Law — LGPD) and, where applicable, the EU General Data Protection Regulation (GDPR).
Contact for privacy matters and to exercise your rights: support@dream-routes.com
The company's full registration details, including its registered address, are public and can be verified from the CNPJ above in the Brazilian Federal Revenue Service registry, or requested through the address above.
This Policy explains what data we collect, why, who we share it with, and what your rights are. It applies to everyone who visits the site, with or without an account.
2. What we collect
2.1 Data you provide
| Data | When | Required |
|---|---|---|
| Sign-up | Yes — it identifies your account | |
| Password | Sign-up | Yes — stored only as a hash, never in readable form |
| Country | Sign-up | Yes — used to tailor itinerary suggestions |
| Display name | Sign-up | Derived automatically from your email |
| Avatar | Sign-up | Picked automatically from our catalogue; you can change it |
| Marketing consent | Sign-up | No — optional, unchecked by default |
2.2 Data you create by using the service
- Itinerary parameters: destination, dates or duration, estimated budget, travel companions, pace, interests, and any dietary restrictions you enter.
- Generated itineraries: the content the AI produces from those parameters, including every version created through refinement.
- Refinement conversations: the messages you write in the chat to adjust an itinerary.
⚠️ Be mindful of what you type. The refinement chat and interest fields are free text sent to an AI provider (see §4). Do not include sensitive data — health conditions, sexual orientation, religious or political beliefs, or other people's personal data — unless strictly necessary for the itinerary. Dietary restrictions you enter are treated as a travel preference, not as health data.
2.3 Usage and technical data
- IP address: used to rate-limit abusive login and generation attempts (protection against automated attacks). It is not used for advertising or profiling.
- Browser language: to serve the site in your language.
- Token transaction records: the history of credits and debits on your account.
- Itinerary generation records: each generation request (with the parameters above), how it ended and, when the response does not reach you, the type of browser (e.g., Safari, Chrome). They are used to diagnose failures and to recover an itinerary that was finished while the connection dropped.
- Site usage (only with your consent): pages visited, interface language, and actions such as starting or completing an itinerary generation; and a recording of your browsing — clicks, scrolling, mouse movement, and the content shown on screen — with numbers, email addresses, form fields, and chat messages hidden. They tell us where people get stuck so we can improve the product. None of this is collected from anyone who declines — see §9.2.
2.4 What we do not collect
We do not collect precise location data, do not use cookies for advertising, and do not sell data to anyone.
We do use two third-party analytics tools (Google Analytics and Microsoft Clarity), and only with your consent: if you decline, neither is loaded and none of your data — not even your IP address — reaches Google or Microsoft. Details, and how to change your mind at any time, in §9.2.
3. Why we use your data (legal bases)
| Purpose | Legal basis (LGPD art. 7 / GDPR art. 6) |
|---|---|
| Create and maintain your account; authenticate access | Performance of a contract |
| Generate, store, translate and display your itineraries | Performance of a contract |
| Process purchases and track your token balance | Performance of a contract |
| Send service emails (confirmation, password reset, notices) | Performance of a contract |
| Send promotional messages | Consent — revocable at any time |
| Measure site usage and record browsing (Google Analytics and Microsoft Clarity) | Consent — revocable at any time via the Cookies link in the footer |
| Prevent fraud, abuse and automated attacks | Legitimate interest |
| Comply with legal and tax obligations | Legal obligation |
4. Who we share with
To operate, DreamRoutes relies on third-party services (processors). Each receives only what it needs to do its job. None of them receives your password.
| Service | Purpose | What it receives | Processed in |
|---|---|---|---|
| Supabase | Database and authentication | Account, itineraries, transactions | USA (AWS, Ohio) |
| Google Cloud Run | Application hosting | Application traffic | USA (South Carolina) |
| Google Gemini | Itinerary generation and refinement | Your parameters and chat messages | USA |
| Google Places / Maps | Place data and photos | Names of the places queried | USA |
| DeepL | Translation of published itineraries | Content of the published itinerary | Germany / EU |
| Resend | Email delivery | Your email and message content | USA |
| Cloudflare | DNS and anti-bot protection (Turnstile, invisible mode) | IP and browser signals | Global network |
| Unsplash | Illustrative images | Search term (e.g. city name) | USA |
| Google Analytics | Measure site usage (only with your consent) | Pages visited, language, usage actions, and IP address | USA |
| Microsoft Clarity | Record browsing and build heatmaps (only with your consent) | Clicks, scrolling, mouse movement, content shown on screen (with numbers, email addresses, form fields, and chat messages hidden), browser and device data, and IP address | USA |
| Paddle | Sale and payment processing (merchant of record) | Payment and billing data, handled directly by them | United Kingdom |
About payments: Paddle acts as the merchant of record — it sells, charges and issues the receipt, and it is the name that appears on your statement. Card data is collected and processed by them, not by us: DreamRoutes never has access to your card number.
We may also share data when required by law, court order, or a request from a competent authority.
5. International transfers
Our infrastructure and most of the processors above are located outside Brazil, mainly in the United States. By using the service, your data is transferred to and processed in those countries, in accordance with art. 33 of the LGPD.
We select providers that adopt internationally recognised contractual clauses and security standards. If you are in the European Union, these transfers rely on the European Commission's Standard Contractual Clauses.
6. How long we keep it
- While your account exists: we keep the data needed for the service to work.
- When you delete your account: the account is deactivated and becomes inaccessible, but records remain in our database for up to 12 months to meet legal and tax obligations and to prevent fraud.
- Permanent deletion: you can request complete erasure of your data at support@dream-routes.com, and we will comply within 15 days, except for records we are legally required to retain (LGPD art. 16).
- Browsing recordings (Microsoft Clarity): kept for 30 days; heatmaps and aggregated click data, for up to 13 months. Microsoft deletes them after that.
- Published itineraries: if you published an itinerary, it may remain accessible and indexed by search engines even after your account is deleted, unless you expressly request its removal. Pages already visited may exist in third-party caches beyond our control.
7. Your rights
At any time, free of charge, you may:
- Confirm whether we process your data and access it
- Correct incomplete or outdated data (some of it directly in Settings)
- Request anonymisation, blocking or erasure of unnecessary data or data processed unlawfully
- Request portability of your data
- Withdraw marketing consent — via the unsubscribe link at the bottom of every promotional email, or in Settings — and analytics consent, via the Cookies link in the site footer
- Object to processing based on legitimate interest
- Be informed about who we share your data with
- Lodge a complaint with the Brazilian data protection authority (ANPD) or, in the EU, with your national supervisory authority
To exercise any of these: support@dream-routes.com. We may ask for additional information to verify your identity before acting — this protects you against fraudulent requests made in your name.
8. How we protect it
- Encryption in transit (HTTPS/TLS) across the entire site
- Passwords stored only as hashes — not even we can read them
- Per-user isolation in the database (Row-Level Security): each account can only reach its own rows
- Invisible anti-bot verification (Cloudflare Turnstile) and rate limiting on login, sign-up and password reset — see §9.1
- Infrastructure secrets kept in a managed vault, outside the codebase
No system is completely immune. If a security incident occurs that may pose a relevant risk to you, we will notify you and the ANPD, as required by art. 48 of the LGPD.
9. Cookies
We use the bare minimum:
| Cookie | Purpose | Essential? |
|---|---|---|
| Authentication session | Keep you signed in | Yes |
| Language preference | Remember your chosen language | Yes |
| Cloudflare Turnstile | Tell humans from bots on forms (invisible, see §9.1) | Yes |
_ga, _ga_* (Google Analytics) | Measure site usage (see §9.2) | No |
_clck, _clsk (Microsoft Clarity) | Group the pages of one visit into a single recording and recognise returning visits (see §9.2) | No |
CLID, MUID and related (Microsoft) | Set by Microsoft Clarity on Microsoft's own domains to identify the browser (see §9.2) | No |
The first three are essential to the service — blocking them in your browser will prevent you from signing in. The Google Analytics and Microsoft Clarity ones are not essential: they only exist if you consent, which is why we show a consent banner on your first visit (see §9.2).
We do not use any cookie for advertising. The ones in the last row are set by Microsoft on its own domains, not ours, and let Microsoft recognise your browser on other sites that also use Clarity. We configure Clarity not to share data with Microsoft Ads.
9.1 Invisible anti-bot verification (Cloudflare Turnstile)
To stop automated attacks on sign-in, sign-up and password reset, we use Cloudflare Turnstile in invisible mode. There is no checkbox and no puzzle: the check runs automatically in the background, with no action required from you and no visual indication on screen.
To do so, Cloudflare analyses signals from your browser and device — such as IP address, user agent, and interaction patterns — to distinguish humans from bots. It does not read the content of the form, and we do not use these signals for advertising or profiling.
Legal basis: legitimate interest in protecting accounts against fraud and brute-force attacks. Cloudflare acts as our processor and its handling of this data is described in the Cloudflare Turnstile Privacy Addendum.
9.2 Analytics cookies and your consent
On your first visit we show a banner with two options of equal weight: accept or decline. Until you choose, nothing is measured.
- If you decline: neither Google Analytics nor Microsoft Clarity is loaded. None of their scripts is downloaded, no cookie is created, and none of your data — including your IP address — reaches Google or Microsoft. Nothing on the site stops working because of it.
- If you accept: we load two tools.
- Google Analytics 4, to measure pages visited and usage actions (for example, starting and completing an itinerary generation). We do not send your email, your name, or your account identifier — only whether you are signed in or not.
- Microsoft Clarity, which records your browsing — clicks, scrolling, mouse movement, and the content shown on screen, such as the itinerary you are viewing — so we can see where the site confuses people or gets in their way. Numbers, email addresses, anything you type into form fields, refinement chat messages, and your notes on itineraries are hidden in your own browser and never reach Microsoft. The site's administration area is never recorded. Microsoft's handling of this data is described in the Microsoft Privacy Statement.
- Changing your mind: the Cookies link in the footer of any page reopens the banner whenever you want. If you decline after having accepted, we delete the Google Analytics and Microsoft Clarity cookies stored on our domain and reload the page, so recording stops completely. The cookies Microsoft sets on its own domains cannot be deleted by us: you can remove them in your browser settings.
- New tools: if we start using another analytics tool, the banner will ask again so you can decide about it — what you accepted before does not cover something you did not know about.
Your choice is stored in your own browser's local storage, not in a cookie — which is why it does not appear in the table above. It applies to that browser: on another device, the banner will ask again.
10. Minors
DreamRoutes is intended for people aged 18 or over. We do not knowingly collect data from children or adolescents. If we identify an account belonging to a minor, it will be removed. Guardians who suspect this may write to support@dream-routes.com.
11. Automated decisions
Itineraries are generated by artificial intelligence from the parameters you provide. They are suggested content, not decisions affecting your rights, credit or access to services. You may request human review of any result at support@dream-routes.com.
12. Changes to this Policy
We may update this Policy. The date at the top always indicates the version in force. Significant changes will be announced by email or by a notice on the site before they take effect. Continuing to use the service after a change means you accept the new version.
13. Contact
Questions, requests or complaints about privacy:
Notice: this document was written to accurately reflect how the platform currently works, but it is not a substitute for legal advice. Review by a qualified lawyer is recommended before operating at scale.