Privacy
Privacy policy
How SafeTrip processes personal data when you quote, purchase and manage a policy.
Version 1.0, updated November 1, 2026
1. Introduction and controller
This Privacy Policy explains how SafeTrip ("SafeTrip", "we") processes personal data when you quote, purchase and manage travel insurance and assistance products, in accordance with the Brazilian General Data Protection Law (Law No. 13,709/2018, "LGPD") and applicable law. For data processed on the platform, SafeTrip acts as controller. For data that the Provider (insurer or administrator) processes to issue and administer the insurance, the Provider acts as an independent controller under its own privacy policy. Channel for data subjects and the data protection officer: [email protected].
2. Data we process
(a) Quote and trip data: destinations, dates, ages, country of residence and nationality. (b) Registration and contact data: name, date of birth, ID or passport, email, phone and address of purchasers and travelers, where required. (c) Purchase data: order, payment (without the full card number), policy and issued documents. (d) Support data: messages exchanged with the Maya virtual assistant and the team, and claim requests. (e) Sensitive health data: when the User submits reports, prescriptions or receipts in a claim. (f) Browsing data: IP address, device identifiers, pages visited and usage events, collected through cookies and similar technologies.
3. Purposes and legal bases
(a) Generating quotes, processing purchases, issuing documents and providing support: performance of a contract and pre-contractual procedures (Art. 7, V, LGPD). (b) Meeting legal, regulatory, tax and accountability obligations: legal or regulatory obligation (Art. 7, II). (c) Preventing fraud and keeping the platform secure: legitimate interest (Art. 7, IX), after assessing that the data subject's rights do not prevail. (d) Exercising rights in judicial, administrative or arbitral proceedings: Art. 7, VI. (e) Measuring site usage, improving the platform and sending marketing communications: consent (Art. 7, I), which may be withdrawn at any time without affecting earlier processing. (f) Processing health data to assess and forward claim requests: specific and prominent consent (Art. 11, I) or, where indispensable, regular exercise of rights (Art. 11, II, "d").
4. Sensitive data
Health data is processed only when necessary to assess and forward the data subject's request and is shared only with those indispensable for that purpose, such as the Provider responsible for claims handling. Avoid submitting health information that has not been requested. Consent for this processing is collected specifically at the time of submission and may be withdrawn, except where retention is required by law or for defense in proceedings.
5. Sharing
We share data to the extent necessary with: (a) Providers (insurers, administrators and assistance companies); (b) financial institutions and payment and fraud-prevention providers; (c) infrastructure, hosting, authentication, email and communication providers; (d) the partner human-support team; (e) public authorities, where required by law or valid order; (f) legal advisers, auditors and insurers of SafeTrip, under a duty of confidentiality. We require processors to act on our instructions and apply adequate security measures. We do not sell personal data.
6. International transfers
To issue and administer the insurance, and because of the infrastructure of some providers, personal data may be transferred abroad, including to the United States and other countries. Transfers rely on the cases in Art. 33 of the LGPD, in particular where necessary to perform the contract requested by the data subject (Art. 33, IX), with contractual and security safeguards consistent with this Policy.
7. Cookies and similar technologies
We use cookies that are essential for operation. Measurement and session-recording tools, such as Google Analytics 4 and Microsoft Clarity, are activated only with the User's consent and remain off in restricted areas such as checkout and the customer area. The choice can be changed at any time. Details are in the Cookie Policy.
8. Virtual assistant and automated decisions
Maya is an AI assistant that answers questions and guides support. Conversations are recorded to provide the service, improve quality and ensure security. Maya does not decide on risk acceptance, coverage or claim payments. The data subject may request review of decisions made solely through automated processing that affect their interests (Art. 20, LGPD) and obtain information about the criteria used.
9. Retention
We keep data for as long as needed for the purposes of this Policy and for legal, regulatory and contractual obligations, including defense in proceedings, which generally corresponds to the applicable limitation period (in consumer relationships, generally 5 years) and, for application access logs, to the period set by the Brazilian Internet Civil Framework (6 months). Quotes without a purchase and browsing data are kept for shorter periods. After that, data is deleted or anonymized, except where retention is allowed under Art. 16 of the LGPD.
10. Data subject rights
Under Art. 18 of the LGPD, the data subject may request: confirmation that processing exists; access; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary, excessive or non-compliant data; portability; deletion of data processed with consent; information on the entities with which data was shared; information on the possibility of refusing consent and its consequences; and withdrawal of consent. Requests are sent to the channel in section 1 and answered within the legal deadline. To protect the data subject, we may ask for identity confirmation. The data subject may also petition the Brazilian National Data Protection Authority (ANPD).
11. Security and incidents
We adopt technical and organizational measures proportionate to the risk, such as access control, encryption in transit, environment segregation and access logging. No system is completely immune to incidents. In the event of an incident that may cause relevant risk or harm to the data subject, we will notify the data subject and the ANPD as required by law.
12. Children and teenagers
Data of persons under 18 is processed only to include them as travelers, at the request and under the responsibility of a legal guardian, and in their best interest (Art. 14, LGPD).
13. Updates to this Policy
This Policy may be updated to reflect legal, regulatory or service changes. The current version is available on the platform with its update date, and relevant changes will be communicated.