MaresiasTur
BookCart
EN

Privacy Policy

Last updated: November 5, 2026.

This Policy explains how MaresiasTur Receptivo & Ecoturismo LTDA (CNPJ, Brazilian company registration no. 35.417.415/0001-40), headquartered at Av. Francisco Loup, 500, Maresias, São Sebastião (SP), Brazil, as the controller of the data processed on this website, uses the personal data of people who browse, contact us or book an activity, in accordance with Brazil's General Data Protection Law (Law 13.709/2018 – LGPD).

1. What data we collect

  • Contact and booking data: name, email, phone/WhatsApp, chosen tour, date, time, number of people, boarding point, payment method, notes and answers to the tour questions.
  • Participant data: full name, document type and number, date of birth, city and state, used for the activity insurance and boarding control.
  • Health information, when you choose to share it: conditions the team needs to know for your safety during the activity, such as restrictions for rappelling or diving.
  • Conversations with Caiçara, the website assistant: the messages you write and which suggestions you tap (for example, opening a tour or going to WhatsApp). If you chat while signed in with your MaresiasTudo account, the conversation is linked to that account so you can pick it up where you left off on MaresiasTudo or on another device.
  • Browsing data: pages visited, device and interactions, collected by analytics and advertising cookies only if you accept them in the cookie notice.

We do not collect payment card data on this website.

2. Why we use it and on what legal basis

  • To record, confirm and run your booking, including check-in at boarding: performance of a contract (art. 7, V).
  • To take out the activity insurance and comply with legal and regulatory requirements, such as passenger lists and tax records: performance of a contract and compliance with a legal or regulatory obligation (art. 7, II and V).
  • To use health information you give us only to keep you safe during the activity: protection of life and physical safety (art. 11, II, "e").
  • To send information about your booking, changes due to weather conditions and support: performance of a contract.
  • To answer your questions through Caiçara, using the website's catalog and rules, and to resume the conversation when you come back: preliminary steps to a contract, at your request (art. 7, V).
  • To send news and offers by email to existing customers, with an unsubscribe option in every message: legitimate interest (art. 7, IX).
  • To measure the performance of the website and ads: consent (art. 7, I), given in the cookie notice.
  • To exercise rights in judicial, administrative or arbitration proceedings: regular exercise of rights (art. 7, VI).

3. Who we share it with

  • Guides, boat crew and partner operators who run the activity, only with the data needed for boarding.
  • The activity insurer, with the participants' data.
  • Providers that keep the website running, such as hosting, email delivery and payment link services.
  • Google and Meta, for analytics and ads, only if you accept the cookies.
  • MaresiasTudo (maresiastudo.com.br), which operates Caiçara: it receives the conversation messages to answer them and stores them under its own privacy policy. If you sign in with your MaresiasTudo account, it recognizes you, and the conversation continues on both websites for up to 7 days without use; when you sign out, it disappears from the screen. MaresiasTur does not receive your password.
  • Anthropic, which provides Caiçara's artificial intelligence and receives the messages to generate the answers.
  • Public authorities, when required by law.

We do not sell personal data.

4. International transfer

Some providers, such as Anthropic, Google and Meta, may process data on servers outside Brazil. In these cases, the transfer takes place in the situations permitted by the LGPD (art. 33), with providers that adopt contractual clauses and security measures compatible with the law.

5. How long we keep it

We keep data for as long as necessary to carry out the booking, provide support and comply with legal and tax obligations and our defense in any proceedings. After that, the data is deleted or anonymized. Data used based on your consent is deleted when you revoke it, unless there is another legal basis for keeping it.

6. Your rights

You may, at any time and free of charge, request:

  • confirmation that we process your data and access to it;
  • correction of incomplete, inaccurate or outdated data;
  • anonymization, blocking or deletion of unnecessary data or data processed in breach of the LGPD;
  • portability of the data to another provider;
  • deletion of data processed based on consent;
  • information about who we share your data with;
  • information about the possibility of not giving consent and its consequences;
  • withdrawal of consent;
  • objection to processing based on legitimate interest, such as sending offers.

To exercise your rights, write to contato@maresiastur.com.br. We may ask for information to confirm your identity. We reply within 15 days. If you are not satisfied, you may also file a complaint with Brazil's National Data Protection Authority (ANPD).

7. Privacy contact (Data Protection Officer)

Questions, requests and communications about personal data can be sent to our privacy contact: contato@maresiastur.com.br.

8. Cookies

We use essential cookies and local storage for the website to work, such as the cart and remembering your cookie choice. Analytics and advertising cookies (Google and Meta) are only enabled after you accept them in the notice shown on the website. If you decline, the website keeps working normally. We also keep, for up to 30 days, an essential visit-origin cookie (origem_visita): it only records where you came from (for example, a Google search, an ad or a campaign link) so we know which channels bring bookings. It contains no name, email, phone number or advertising identifiers. When you use Caiçara, we also keep the essential cookie caicara_visitante (a random code that links you to the conversation) and, if you sign in with your MaresiasTudo account, caicara_acesso. Neither contains your name, email or phone number. The browser's local storage holds only the code of your latest conversation (caicara-conversa-id), so it can be resumed when you come back; it is deleted when you sign out through Caiçara. Tour links suggested by Caiçara carry the conversation code, which is stored with the visit origin and with the booking, so we know how many bookings came from the assistant. You can change your mind by deleting the website's cookies and data in your browser settings; the notice will appear again.

9. Children and adolescents

Data of underage participants is provided by the parent or legal guardian who makes the booking, who, by providing it, gives specific consent for its use. This data is used only for the safe running of the activity, the insurance and boarding control (art. 14).

10. Security

We adopt technical and administrative measures to protect data, such as encrypted connections, restricted access to the admin panel by username and password, team permission controls and backups. If a security incident occurs that may pose a relevant risk or harm, we will notify the affected data subjects and the ANPD, as required by law.

11. Changes

This Policy may be updated. The date of the last update is always shown at the top of this page, and relevant changes will be highlighted on the website.