Privacy Policy

Last updated: November 1, 2026

This Privacy Policy describes how 49.864.540 Victor Augusto Tesoura Segundanhe Junior ("Cosmopolita", "we", "us", or "our") collects, uses, stores, and shares your personal data when you use our platform at cosmopolita.me and its products (Cosmopolita Property Manager and its iOS and Android app, AI Planner, Flights).

We are committed to protecting your privacy and complying with the Lei Geral de Proteção de Dados (LGPD — Law 13.709/2018) and, where applicable, the General Data Protection Regulation (GDPR).

1. Who We Are

Controller: 49.864.540 Victor Augusto Tesoura Segundanhe Junior
Contact: legal@cosmopolita.me
Website: https://cosmopolita.me

2. Data We Collect

2.1 Data you provide directly

• Account information: name, email address, phone number, profile photo
• Identity documents: passport or national ID number (for visa/stay permit services only)
• Payment information: billing address, card details (processed by our payment partners — we do not store card numbers)
• Payout details (hosts): account holder name and tax ID (such as CPF/CNPJ), Pix key, bank, branch and account number, CBU/CVU or alias, or international bank details, depending on your country. Used only to send your payouts and stored encrypted
• Booking details: travel dates, destination, number of guests, special requests
• Communications: messages sent to our support team

2.2 Data collected automatically

• Usage data: pages visited, features used, clicks, session duration
• Device data: IP address, browser type, operating system, device identifiers
• Location data: country/region inferred from IP address (we do not track GPS location without explicit consent)
• Cookies and similar technologies: see Section 7

2.3 Data from third parties

• Google: if you sign in with Google, we receive your name, email, and profile photo from Google
• Microsoft: if you sign in with Microsoft, we receive your name, email, and profile photo from Microsoft
• Payment providers (Stripe, MisticPay): transaction status and payment identifiers
• Property managers: booking information shared by hosts on Cosmopolita Property Manager

2.4 Mobile app (iOS and Android)

When you use the Cosmopolita Property Manager app, we also collect:

• Push notification data: your device's push token, platform (iOS or Android), app language and app version, so we can send you notifications in your language
• Camera and photos: only when you choose to take or attach a photo (for example task photos, property galleries, guest ID photos at check-in or knowledge-base pictures). The app does not access your camera or photo library in the background

The app does not collect your precise location, contacts or advertising identifiers, and does not track you across other apps or websites. You can turn off notifications at any time in your phone's settings.

3. How We Use Your Data

We use your personal data for the following purposes and legal bases:

4. How We Share Your Data

We do not sell your personal data. We share it only in the following situations:

• Service providers: companies that help us operate (hosting, email delivery, payment processing, analytics). These act as data processors under a data processing agreement.
• Property managers (Cosmopolita Property Manager): when you make a booking, relevant information (name, dates, guest count) is shared with the host.
• Banks and payment institutions: to send host payouts, we share the payout details with the bank or payment institution that makes the transfer.
• Legal requirements: when required by applicable law, court order, or governmental authority.
• Business transfers: in the event of a merger, acquisition, or sale of assets, your data may be transferred. We will notify you in advance.

Our main processors:

AI providers process the content needed for each request (for example a guest message or a photo you upload) to return a result. We don't use your data to train AI models.

5. Data Retention

We retain your data for as long as your account is active or as needed to provide services. After account deletion:

• Account data: deleted or anonymized within 30 days. If you own an organization on Cosmopolita Property Manager, your name and email stay linked to its booking and payment records and are kept for the same 5-year period
• Booking records: retained for 5 years for tax and legal compliance
• Payment records: retained for 5 years as required by Brazilian financial regulations
• Marketing consent logs: retained for 5 years as evidence of consent
• Mobile devices (push tokens): deleted when you sign out of the app, uninstall it, or delete your account
• Photos used for AI task drafts: deleted after 24 hours if no task is created

6. Your Rights

Under the LGPD, you have the right to:

• Access — request a copy of your personal data
• Correction — request correction of inaccurate or incomplete data
• Deletion — request deletion of your data (subject to legal retention obligations). You can also delete your account yourself in the mobile app (Profile → Delete account); organization owners must first delete or transfer their organizations
• Portability — request your data in a machine-readable format
• Opt-out — withdraw consent for marketing communications at any time
• Information — know which third parties we share your data with
• Oppose — object to processing based on legitimate interest

To exercise any of these rights, contact us at legal@cosmopolita.me. We will respond within 15 business days.

If you are located in the European Economic Area, you also have the right to lodge a complaint with your local data protection authority.

7. Cookies

We use cookies and similar technologies to:

• Keep you signed in (essential)
• Remember your language preference (essential)
• Analyze platform usage (analytics)
• Personalize content (functional)

You can manage cookie preferences through your browser settings. Disabling essential cookies may affect platform functionality.

For full details, see our Cookie Policy (coming soon).

8. Children's Privacy

Our platform is not directed to children under 18. We do not knowingly collect personal data from minors. If we become aware that we have collected data from a child under 18 without parental consent, we will delete it promptly. Contact us at legal@cosmopolita.me if you believe this has occurred.

9. International Transfers

Your data may be transferred to and processed in countries other than Brazil, including the United States. When we transfer data internationally, we ensure appropriate safeguards are in place, such as standard contractual clauses or reliance on providers certified under applicable data transfer frameworks.

10. Security

We implement technical and organizational measures to protect your data against unauthorized access, alteration, disclosure, or destruction. These include:

• Encryption in transit (TLS) and at rest
• Access controls and authentication
• Regular security reviews
• Incident response procedures

No method of transmission over the internet is 100% secure. In the event of a data breach that poses a risk to your rights, we will notify the relevant authority (ANPD) within 72 hours and affected users promptly.

11. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify you of significant changes via email or a prominent notice on our platform. The "Last updated" date at the top of this page reflects the most recent revision. Continued use of our platform after changes constitutes acceptance of the updated policy.

12. Contact

For privacy-related questions, requests, or complaints:

Legal: legal@cosmopolita.me — privacy requests, data rights, compliance, and legal questions
Abuse: abuse@cosmopolita.me — privacy violations, safety issues, or abuse reports
Property Manager Support: pms-support@cosmopolita.me — property manager onboarding, listing updates, and operational support
Response time: up to 15 business days

You may also contact the Brazilian data protection authority:
ANPD (Autoridade Nacional de Proteção de Dados): https://www.gov.br/anpd