Privacy Policy

Who is responsible

Plora is operated by Flashbox Tecnologia LTDA, registered under 59.893.021/0001-26, at Av. Paulista, 1106, sala 1, andar 16, São Paulo/SP. We are the controller of the personal data described here.

For anything in this policy, including requests to access or delete your data, write to suporte@flashbox.ai.

What we collect

We only collect what the product needs in order to work:

• Your answers to the trip questionnaire: origin, destinations, dates, who is travelling, interests, pace, budget, accommodation and transport preferences, dietary restrictions and accessibility needs, and any free-text notes you write.
• Your first name and email address.
• Whether you agreed to hear from us about the upcoming Plora app.
• Payment confirmation data from Stripe. We never see or store your card number.
• Technical and advertising data: IP address, browser user agent, and the Meta cookies _fbp and _fbc when present.
• The itinerary we generate for you, including the PDF.

Why we collect it

To research your destination and produce your itinerary, which is the service you paid for. To process your payment. To email you the finished PDF and, if you consented, occasional news about the Plora app. To measure which advertising brought you here, so we do not waste money showing ads to the wrong people.

Legal basis

Performing the contract you entered when you bought an itinerary, for everything needed to deliver it. Your consent, for marketing email and for advertising measurement. Our legitimate interest, for security, fraud prevention, and keeping the service running. Legal obligation, for tax and accounting records.

Artificial intelligence

Your itinerary is written by an AI system. The answers you give in the questionnaire are sent to Anthropic, which operates the Claude models, in order to generate it. We also run web searches about your destination through a search provider. We do not send your email address or payment data to either of them.

This is worth stating plainly: if you write something in the free-text fields that you would not want processed by a third-party AI provider, do not write it there.

Who else touches your data

We use a small number of providers, each for one job:

• Supabase, for the database and for storing your itinerary PDF.
• Stripe, for payment processing.
• Anthropic, for generating the itinerary text.
• A web search provider, for destination research.
• Resend, for sending you the itinerary email.
• Meta, for advertising measurement. We send a hashed version of your email and first name, meaning it is converted into an irreversible code before it leaves us, alongside your IP address and browser.
• Vercel and Render, for hosting.

We do not sell your personal data, and we do not share it with anyone for their own independent marketing.

International transfers

Some of these providers process data outside your country, including in the United States. When that happens we rely on the safeguards each provider offers under applicable data protection law.

Cookies

We use very few. One remembers your language preference so the site loads in the right one. The Meta Pixel sets cookies that let us tell whether an ad led to a purchase. We do not use cookies to build profiles for other companies.

You can block these in your browser settings. The site will still work, though the language preference will reset on each visit.

How long we keep it

We keep your order and itinerary for as long as your account with us exists, so you can download the PDF again later. Payment records are kept for the period tax law requires. If you ask us to delete your data, we will, except for what we are legally required to retain.

Your rights

You can ask us to confirm whether we hold data about you, to give you a copy, to correct it, to delete it, to tell you who we shared it with, and to withdraw a consent you previously gave. Marketing email always has an unsubscribe link.

To exercise any of these, write to suporte@flashbox.ai. We will respond within the period the law allows.

Security

Data is transmitted over encrypted connections and stored with access restricted to what the service needs. No system is perfect, and we will not pretend otherwise, but we do not keep data we have no reason to hold.

Children

Plora is not intended for people under 18. We do not knowingly collect their data. A trip planned for a family may of course include children, and in that case we only use the ages you provide to make the recommendations appropriate.

Changes

If we change this policy we will update the date at the top. Material changes will be communicated to buyers by email.