Privacy Policy

Boutique de Viajes is a platform for tailor-made travel agencies: the agency builds the itinerary in a dashboard and the traveller opens it on a phone or computer with a link and a code (PIN). It is operated by Eleonora Elenberg, in Buenos Aires, Argentina.

Traveller and client data is entered by each agency, which is the controller of that database under Argentine Law 25,326. The platform stores and processes it on the agency’s behalf, only to provide the service. Data about dashboard accounts (the people who work at an agency) is handled by the platform directly.

This policy covers the website, the agency dashboard, the traveller itinerary and the app for iPhone, iPad and Mac, which shows the same content.

Dashboard accounts (agency staff):

• Name, email and, if you sign in with Google, the profile photo Google shares. An optional WhatsApp number the traveller sees when a trip is assigned to you.
• Your password, stored only as a hash (never readable).
• The agency you belong to and your role (owner, manager or sales).
• Open sessions: date, IP address and browser type of each, so you can see where you are signed in and sign out.
• An activity log of important actions: creating, publishing or deleting trips, team changes, and every time someone views, saves or deletes a medical card.
• Your preferences: dashboard accessibility and whether you want the daily summary email.

Client and traveller data entered by the agency:

• Name, email, WhatsApp or phone, nationality and agency notes.
• Date of birth, passport number, issuing country and expiry date: used to warn if a passport expires before or during the trip and to show visa requirements for that passport.
• Travel documents the agency keeps on the client record: passports, visas, ID card, vaccinations, insurance, driving licence and frequent-flyer programmes, with their photos or PDFs. Photos are stored encrypted (AES-256-GCM) and can only be opened from the agency’s panel.
• Cards, as a reference only: brand, last 4 digits, cardholder and expiry date. Never the full number or the security code. If the agency keeps a photo of a card, it is encrypted, only the owner and the manager can see it, and every view is logged.
• The trip: destinations, dates, flights, hotels, transfers, daily activities, prices, payments, receipts, travel insurance (insurer, policy, holders) and documents uploaded by the agency (vouchers, tickets, policies).

Medical card (sensitive data): blood type, allergies, medication, health conditions and an emergency contact. It is optional. The traveller can fill it in with explicit consent (the date is recorded), or the agency can. It is stored encrypted (AES-256-GCM) with a key that is not in the database, so not even a copy of the database shows it in plain text. Only the trip’s agency and the traveller behind their PIN can see it, and every view from the dashboard is logged.

What is generated when you use the itinerary:

• Visits: date and time, whether it was a phone or a computer, and which section was opened. Your IP and any identifier of yours are not stored: the agency sees how many times the trip was opened, not by whom.
• Whether you download or share a quote, and whether you accept a proposal: in that case the name you type, the date and the IP address are stored as a record.
• Your trip rating (stars and comment), the activities you mark as done and the experiences you are interested in.
• What you ask in “Ask about your trip”: the question, the answer, the language and the date, so the agency can see what its travellers want to know. Who asked, your IP and your device are not stored, and it is deleted together with the trip.
• If you turn on notifications: the technical address your browser provides to receive them and its encryption keys. It is not your number or your email.

Location: the live map can show where you are only if you turn it on. Your position is used on the phone to draw the dot and measure distances; it is not sent to our servers or stored. Pharmacies and hospitals “near the hotel” are looked up using the location of the hotel or the day’s place, not yours.

Camera and microphone: only when you use the translator. The photo of a sign or menu is sent to be translated and is not stored. Dictation uses your browser’s or system’s speech recognition.

Technical data: your IP address is used for a few minutes, in memory, to stop abuse (for example, too many PIN attempts); it is not stored in the database. If a screen fails, the error and the page where it happened are logged so we can fix it.

Stored only on your own device, never sent to us: your language and text size, the offline copy of the itinerary, the translator history and whether you already granted location permission.

• Building, storing and showing your itinerary, and letting the agency and you reach each other.
• Useful notifications: the night before each day of the trip and messages from the agency.
• Trip requirements: passport expiry, visas for your passport, weather, flight times and emergency numbers.
• Letting the agency keep its payments, receipts and statistics (trips, travellers, revenue and which sections are opened).
• Secure dashboard sign-in, with roles for each team member.
• Service emails: team invitations, password recovery, the agency’s daily summary and the emails the agency sends the traveller.

We do not sell or rent data, there is no advertising, we do not build advertising profiles, we do not track you across other sites and we do not use third-party analytics.

With the providers that run the service, and only with what each one needs:

• Supabase: the database and the storage for photos and documents. Documents go to private storage and open with signed links that expire quickly. Photos of passports, visas and cards that the agency keeps on each traveller’s record are also encrypted by the app and open only from the agency’s dashboard.
• Vercel: hosts and runs the site, and keeps technical logs for a short time.
• Anthropic (Claude): the AI features — importing an itinerary from a PDF, Word file or email, editing with AI, building the day plan, reading documents such as an insurance policy, the translator (text and photos) and “Ask your trip”. Only what each request needs is sent (for example, the itinerary or the photo). Under its commercial terms, Anthropic does not by default use what it receives through its API to train models.
• Maps: Mapbox (maps and travel times between stops), OpenFreeMap and OpenStreetMap (maps), Nominatim (locating hotel and place addresses) and Overpass (pharmacies, hospitals and ATMs near a hotel). They receive addresses or coordinates of trip places, not your GPS.
• Open-Meteo (destination weather and air quality), AeroDataBox and Aviationstack (flight status, by number and date), Nager.Date (public holidays), open.er-api.com (exchange rates), MyMemory (fixed phrases, no personal data), Ticketmaster (events in the trip’s city) and Pexels, Unsplash and Wikimedia Commons (photos of places and hotels).
• Google: “Continue with Google” (name, email and photo) and Google Fonts typefaces.
• Email: emails are sent from the agency’s own mailbox on its domain (server mail.boutiquedeviajes.com), hosted by Mesi, its domain provider. If the agency has not set up that mailbox, they go out through Gmail (Google) or Resend. If the agency connects a mailbox to import bookings, only the emails the agency chooses to import are read.
• Notifications: your browser’s push service (Apple, Google or Mozilla) receives each encrypted notification to deliver it.
• WhatsApp (Meta): when you tap “message the agency”, WhatsApp opens, outside our app.

Like any page that shows a map, a photo or a typeface from another service, your browser connects to that service and it sees your IP address.

Several of these providers process data outside Argentina (mainly in the United States and the European Union). We chose them because they apply adequate security measures to that data.

We would also share data if a law or a competent authority requires it.

• Trips, clients, payments and documents: for as long as the agency keeps them. When the agency deletes a trip or a client, its data is deleted; uploaded photos and files may remain in storage until the agency closes its account. Closing the agency deletes everything, files included.
• Medical card: until the traveller or the agency deletes it, or the client is deleted.
• Dashboard session: 30 days, renewed each day you use it. Sessions can be closed in Settings › Security.
• Traveller access: the PIN is remembered for one year on that device, until you tap “Leave This Trip”.
• Notifications: until you turn them off, your browser stops accepting them or the trip is deleted.
• Backups: a daily copy of the database, stored privately; the one from each of the last 14 days and one per week for 8 weeks are kept.

• Everything travels encrypted (HTTPS).
• The database has no public access: every read goes through the server, which checks which agency each record belongs to.
• Each itinerary opens only with its link and its PIN, with a limit on attempts.
• Documents are in private storage and the medical card is encrypted.
• In the dashboard, each person signs in with their own account and sees only what their role allows.

No system is infallible. If an incident ever affects your data, we will tell you or your agency.

Under Argentine Personal Data Protection Law 25,326 you can ask to access your data, to have it corrected or updated, and to have it deleted. Access requests are answered within 10 calendar days and corrections or deletions within 5 business days.

If you are a traveller, your data was entered by your agency: ask them. You can also write to us and we will pass it on.

If you have a dashboard account, you can delete it yourself in Settings › Security › Delete my account. An agency owner can download all of the agency’s data (Settings › Export data, as CSV or JSON) and close the agency from there.

The data subject has the right to access their personal data free of charge at intervals of no less than six months, unless a legitimate interest is shown, as set out in article 14, paragraph 3 of Law 25,326.

The Agency for Access to Public Information (AAIP), as the supervisory authority of Law 25,326, is empowered to hear complaints and claims from anyone whose rights are affected by non-compliance with personal data protection rules. argentina.gob.ar/aaip

The service is not meant to be used by children on their own. When a family travels, the agency may enter minors’ data (name, date of birth, passport) with the authorisation of their parents or guardians, who can exercise the rights above on their behalf.

We use only the cookies the service needs to work, never for advertising or tracking:

• The itinerary cookie (“trip_auth_…”): remembers that you already entered that trip’s PIN. It lasts one year.
• Dashboard session cookies: keep you signed in (30 days).
• A dashboard accessibility cookie, if you change those settings.

Your browser also keeps your language, text size, offline copy and translator history on your device. They are removed when you clear the site’s data.

If we change this policy, the date at the top changes. If the change is significant, we will announce it in the dashboard or by email before it takes effect.

For any question about your data: eleonoraelenberg@gmail.com or via WhatsApp.