Privacy Policy

1. About this Policy

This Privacy Policy explains how Plataforma eTrilhas LTDA, enrolled with CNPJ No. 60.107.731/0001-62, headquartered at Av. Raja Gabaglia, No. 1,617, Suite 501, Luxemburgo, ZIP 30.380-435, Belo Horizonte/MG (“eTrilhas”, “we”), collects, uses, stores, shares and protects the personal data of those who use the websites, apps, events and other services operated under the eTrilhas brand — including the eTrilhas app for Android and iOS and the website etrilhas.com.br (together, the “Platform” or the “services”).

Some services operated on our platform, such as partner trail apps, may have their own privacy policy. In those cases, the service-specific policy prevails, not this Policy.

For the purposes of the Brazilian General Data Protection Law — Law No. 13,709/2018 (“LGPD”), eTrilhas acts as the controller of the personal data processed on the Platform, that is, the party that makes decisions about the purposes and means of processing.

By using the Platform, you declare that you have read and understood this Policy. If you do not agree with any of its terms, we ask that you do not use the Platform.

2. Definitions

• Personal data: information related to an identified or identifiable natural person (e.g., name, email, location).
• Data subject: the natural person to whom the personal data refers — you.
• Processing: any operation performed with personal data, such as collection, use, storage, sharing and deletion.
• Controller: the party that makes decisions about the processing of personal data. In this Policy, eTrilhas.
• Processor: the party that processes personal data on behalf of the controller (e.g., cloud hosting services). Processors may engage sub-processors, who are subject to the same data protection obligations.
• Privacy channel: eTrilhas’ point of contact with data subjects and with the ANPD for privacy and data protection matters (section 16).
• ANPD: the National Data Protection Authority, the body responsible for overseeing compliance with the LGPD in Brazil.
• Trail manager: the body, entity or person responsible for managing a trail, park or Conservation Unit registered on the Platform.
• Cookies: small files stored in your browser or device that allow recognizing preferences and analyzing website usage.

3. What personal data we collect

3.1. Data you provide to us

• Registration data: name, email, phone number and password when you create an account, as well as your current location and your trail preferences, used to personalize the service.
• Profile data: photo, display name, your trail experience, photos of trails you have hiked and other interests you choose to add.
• Content you generate: trail reviews and comments, photos and videos, check-ins, problem reports and alerts sent to managers, recorded routes and items in your trail passport, as well as the metadata associated with this content (information about how, when and where it was created). To add photos and videos, you may grant us access to your device’s camera or photo album — permissions you control in the device settings.
• Communications: messages sent to our support and responses to surveys, when you choose to participate.

Mandatory data is indicated at the time of collection; without it, it is not possible to create an account or use certain features. Other data is optional, and some may be visible to other users according to your settings.

3.2. Data received from third parties

• Social login: if you choose to sign in with your Google or Apple account, we receive from the provider the data you authorize, such as name, email and profile photo. We do not have access to the passwords of those accounts.
• Trail managers: registration and contact data provided by managers within the Platform’s administrative system.
• eTrilhas social media: we maintain pages on social media; if you interact with them, we may collect the data you make available in those interactions, and the platforms may provide us with aggregated statistics about the use of our pages.

3.3. Data collected automatically

• Device data: model, operating system and version, language and device and app-installation identifiers, including advertising identifiers when authorized by you.
• Usage data: trails explored and viewed, features used, dates and times of access, crashes and performance diagnostics.
• Access logs: IP address, date and time of access, as required by the Brazilian Internet Civil Framework (Law No. 12,965/2014).
• Approximate location: we may estimate your approximate location (city or region) from your IP address, to show nearby trails and content.
• Activity statistics: from recorded routes, we calculate metrics such as distance covered, duration and pace.
• Inferences: we may combine the information collected to infer your preferences and interests, used to personalize the service, such as in trail suggestions.
• Cookies and similar technologies on the website, described in section 7.

3.4. Location data

Location is essential to the Platform’s main features. With your permission, granted in the device settings, we collect your precise location (GPS) to:

• show your position on the map and display nearby trails;
• record check-ins at the points of the trails you visit;
• track, in real time, your progress when you start a trail and record your routes. During recording, location collection may occur in the background, even with the screen locked or the app minimized, until you pause or end the activity.

We collect your real-time location only during active use of the maps and while tracking a trail you have started. Uploaded photos may contain location metadata (geotags); keep this in mind when publishing them.

You can revoke the location permission at any time in your device settings. In that case, features such as route recording, check-in and map position will stop working, but you will still be able to view trail content.

3.5. Sensitive personal data

We do not request or need sensitive personal data (art. 5, II, of the LGPD), such as information about health, biometrics, religion, political opinion or sex life, and we ask that you do not include it in your profile or in the content you publish. If you choose to share information of this kind in public content (e.g., in a review), this sharing occurs at your own initiative and the data will be visible as described in section 6.1.

4. What we use your data for

• Operate the Platform: create and manage your account, manage login, display trails, maps and fact sheets, record check-ins and routes, build your trail passport, enable offline use and stay in touch about matters related to use of the service.
• Connect you to the management of trails, destinations and protected areas: forward your problem reports, alerts, check-ins and reviews to the responsible managers, contributing to the conservation, maintenance and safety of the trails.
• Personalize your experience: organize your timeline, suggest relevant trails and content and connect users, through automated solutions. You may request the review of automated decisions that affect your interests (section 11).
• Communication: send notifications about the trails you follow, manager announcements, safety notices and messages about your account; and, with your consent, email marketing about eTrilhas or partner services. We may record open confirmation and clicks on the emails sent, to measure the effectiveness of communications.
• Advertising: display third-party ads on the Platform, which may be targeted based on your use of the service. Targeted advertising is not directed at children and adolescents (section 12).
• Improvement and statistics: understand how the Platform is used, fix bugs, develop new features and produce internal reports and visitation statistics that support trail management and conservation — whenever possible, in an aggregated or anonymized form, such as heatmaps showing the most-used segments without identifying you.
• Security and fraud prevention: protect accounts, prevent misuse, investigate unlawful or harmful conduct and ensure the integrity of the Platform and the safety of the community.
• Compliance with legal obligations: meet legal and regulatory requirements and respond to competent authorities.

Some Platform features use artificial intelligence (“AI”), such as review summaries, trail and content suggestions and the automatic translation of content you have made public, to display it to users of other languages. When you use these features, the information you provide (e.g., texts and queries) and the data necessary for the feature to work are processed by AI technology, which may involve specialized processors engaged by us (section 6.3). We do not use your personal data to train AI models, and we do not make solely automated decisions that produce legal or similarly significant effects on you.

If it becomes necessary to process your data for a purpose not provided for in this Policy, you will be informed in advance.

5. Legal bases for processing

We process your personal data based on the legal bases set out in art. 7 of the LGPD, according to the purpose:

When processing is based on your consent, you may revoke it at any time (section 11), without compromising the lawfulness of the processing carried out until revocation. Permission to access location, camera and photo album is controlled by you directly in the device settings.

6. Who we share your data with

We do not sell your personal data. We share data only in the situations described below.

6.1. Other users and the public

The Platform is community-based. The content you publish — reviews, comments, photos and problem reports — is visible to other users, associated with your display name and profile photo, as is your profile while the account is active. Your check-ins and recorded routes are not visible to other users: only you see them (and the responsible managers, as described in section 6.2). If you wish, you can share them on your own social media using the sharing feature.

We do not display your email publicly to other users. If you publish content that contains third parties’ personal data — for example, photos in which other people appear in an identifiable way —, it is your responsibility to have obtained those people’s authorization.

Remember that public content may be viewed, copied, screenshotted or stored by third parties, including indexed by search engines, and we have no control over such uses outside the Platform.

Be careful with your location: routes and check-ins may reveal places you frequent, including starting points near your home. Consider carefully before sharing them on social media or publishing photos and reports that indicate sensitive locations.

You may also, at your own initiative, share check-ins and reviews on social media; in that case, the privacy policies of those networks apply.

6.2. Trail managers and Conservation Units

To fulfill the Platform’s central purpose — supporting the conservation and management of trails and natural areas —, we make available to the responsible managers the check-ins performed, the reviews and the alerts and reports you send, together with your name, profile photo and registration email, as well as visitation statistics based on these records. Managers must use this information exclusively for the management, safety and conservation of the trails and are subject to contractual data protection obligations.

6.3. Processors and suppliers

We engage companies that process data on our behalf and under our instructions (“processors”), in the following categories: cloud storage and hosting; information security; data, usage and performance analytics; artificial intelligence tools; sending of notifications and emails; map services (Mapbox, rendered by the open-source Leaflet library); and social login providers (Google LLC and Apple Inc.). Processors may engage sub-processors with our approval. All are subject to specific contractual data protection clauses and may only use the data for the contracted purposes.

6.4. Local service providers

The Platform displays information about local guides and service providers (such as contact details and service descriptions) to help you find them. Contact and booking are carried out directly between you and the provider, outside the Platform; we do not intermediate or have access to that data.

6.5. Public authorities and legal obligations

We may share data to comply with a legal or regulatory obligation, court order or request from a competent authority, to protect the rights of eTrilhas, users or third parties, and in emergency situations involving risk to life or physical safety — for example, in support of search and rescue teams.

6.6. Corporate transactions

In the event of a merger, acquisition, corporate reorganization or sale of assets, your data may be transferred to the new entity, which will remain bound by this Policy until any update, about which you will be informed.

7. Cookies and similar technologies

On the website etrilhas.com.br we use cookies and similar technologies in the following categories:

• Essential: ensure the website works, such as authentication and session security;
• Preferences: remember the language and settings you chose;
• Statistics: measure audience and help understand navigation;
• Advertising: enable the display of ads and the measurement of their performance.

You can manage or block cookies in your browser settings. Blocking essential cookies may compromise the operation of parts of the website.

8. International data transfer

Some of our processors (section 6.3), such as cloud, map and social login providers, may store or process data on servers located outside Brazil. In those cases, the transfer is carried out in compliance with art. 33 of the LGPD: to countries that provide an adequate level of protection or through appropriate safeguards, such as contractual clauses that ensure your data a standard of protection equivalent to that provided for in Brazilian law.

9. How long we keep your data

• Account and profile: while your account is active. Accounts inactive for more than 2 years are automatically closed; after closure, your profile is no longer visible to other users.
• Security retention window: after the account is closed, we keep the data for up to 3 months — or up to 1 year, in case of a ban — exclusively to investigate unlawful or harmful conduct, defend rights and ensure the safety of the community.
• Access logs: for 1 year, in compliance with the Internet Civil Framework (which requires storage for at least 6 months).
• Data necessary to comply with legal obligations or for defense in proceedings: for the applicable legal or statute-of-limitations periods.
• Reviews and problem reports: after the account is deleted, they may be kept in an anonymized form, unlinked from you, for their value to the community and to trail management.
• Support communications: for up to 2 years or, when there is potential legal relevance, for the applicable statute-of-limitations periods.
• Records of data subject requests (section 11): for the period necessary to evidence that they were addressed, observing the applicable statute-of-limitations periods.

Once the periods above have elapsed, the data is securely deleted or anonymized; it may remain temporarily in backups until definitive deletion in the regular backup-update cycles. You may also request the removal or anonymization of your data at any time (section 11).

10. How we protect your data

We adopt technical and administrative measures suitable to protect personal data against unauthorized access, loss, alteration or destruction, such as encryption of communications, profile-based access control and systems monitoring. No system is absolutely secure; therefore, should a security incident occur that may cause relevant risk or harm to you, we will report the fact to the ANPD and to the affected data subjects, under the terms of art. 48 of the LGPD.

You also play an important role in protecting your account: use a strong and unique password and do not share it with third parties.

11. Your rights as a data subject

The LGPD (art. 18) guarantees you, at any time and upon request:

• confirmation of the existence of processing and access to your data;
• correction of incomplete, inaccurate or outdated data — most of it can be edited directly in your profile;
• anonymization, blocking or deletion of unnecessary or excessive data or data processed in noncompliance with the LGPD;
• portability of the data to another service provider, subject to ANPD regulation;
• deletion of personal data processed based on your consent;
• information about the public and private entities with which we share your data;
• information about the possibility of not providing consent and about the consequences of refusal;
• withdrawal of consent;
• objection to processing carried out on the basis of other legal bases, in case of noncompliance with the LGPD;
• review of decisions made solely on the basis of automated data processing that affect your interests.

To exercise your rights, use the tools available on the Platform itself or contact us at plataforma@etrilhas.com.br — in person or through a legally appointed representative. To protect your account, identity confirmation is carried out, as a rule, by verifying the registered email; we may request additional information when necessary. We will respond as soon as possible, observing the LGPD deadlines — as a rule, up to 15 days for confirmation of processing and access to data.

You can close your account at any time using the corresponding feature directly in the service. Note: uninstalling the app stops data collection by the app, but does not close your account.

If you believe your rights have not been properly addressed, you can file a complaint with the National Data Protection Authority (gov.br/anpd).

12. Children and adolescents

The Platform may be used by children and adolescents and encourages the whole family’s contact with nature. The processing of personal data of children and adolescents is always carried out in their best interest, under the terms of art. 14 of the LGPD, collecting the minimum data necessary, without targeting advertising and without sending marketing to this audience.

We recommend that the use of the Platform by children take place with the supervision and guidance of parents or guardians — especially in features involving location and content visible to other users. Parents and guardians may, at any time, request access to, correction or deletion of the data of children and adolescents under their responsibility through the channels in section 16.

13. Your choices and controls

• Device permissions: mobile platforms have permission systems for location, camera, photos, push notifications and advertising identifiers. You can grant, limit or revoke each permission in the device settings; some features may stop working.
• In-service tools: your account settings allow you to access, correct or remove information associated with your profile. If in doubt, contact our support.
• Push notifications: enable or disable them in the device or app settings.
• Email marketing: unsubscribe at any time via the link in the messages themselves.
• Uninstallation: stops data collection by the app, but does not close your account.
• Account closure: directly in the service, in your account area, or through the contact channels in section 16.

14. Third-party links and services

The Platform may contain links to third-party sites and services, such as managers’ pages, local providers, advertisers and social media. We are not responsible for the privacy practices of these third parties and we recommend reading the policies of each service you access.

15. Changes to this Policy

We may update this Policy to reflect changes to the Platform or to legislation. Any change will be communicated to you and published at https://etrilhas.com.br/politica-de-privacidade; in the case of relevant changes, notice will be given through the app, the website or by email before it takes effect. The effective date at the top of this page indicates the current version.

16. Privacy channel and contact

Privacy and data protection matters are handled directly by the eTrilhas team, which acts as the communication channel between you, the company and the ANPD, in accordance with the regulations applicable to small-scale processing agents:

• Email: plataforma@etrilhas.com.br.
• Address: Av. Raja Gabaglia, No. 1,617, Suite 501, Luxemburgo, ZIP 30.380-435, Belo Horizonte/MG.

17. Applicable law and jurisdiction

This Policy is governed by the laws of the Federative Republic of Brazil, in particular the LGPD (Law No. 13,709/2018) and the Internet Civil Framework (Law No. 12,965/2014). The courts of the judicial district of Belo Horizonte/MG are elected to resolve any disputes, without prejudice to the jurisdiction rules applicable to consumer relations.