Privacy Policy

1. Who is responsible

The data controller is Vamos, a travel agency incorporated in Venezuela. For any privacy question, to exercise your rights, or to request deletion of your account, write to soporte@vamosv.com.

2. What it covers

The public discovery surfaces (flight, bus and ferry search and map; Caracas mobility; country guides; the travel-package catalogue), the community incident map, the data-proposal space, the agency's quote and payment funnel, and the mobile app.

Browsing the web requires no account. The mobile app, by contrast, asks you to sign in before it can be used — a deliberate decision explained in section 6.

3. What data we collect

Anonymous device identifier: a random identifier stored in your browser or in the app. It lets us measure usage in aggregate and enforce anti-abuse limits. It does not identify you personally and we do not join it to your account.

Account data (only if you sign in): your email address and, if you use Google, the name and profile picture Google shares with us. Authentication is handled by Supabase; we never see or store your password. You may optionally add a contact phone, an address and your preferred language.

Location: only if you grant permission. We use it to centre the map, suggest the nearest airport and, in the Caracas planner, to take your position as the starting point of a trip. In that last case the coordinates are sent to our server to compute the route. You can deny or revoke the permission at any time: the app keeps working and you simply type the origin yourself.

Searches and usage: the trips you look up (airport codes, cities, dates, passenger counts), which results you open and which purchase links you click. This is what tells us which routes the country is missing.

Messages to the search assistant: the text you type into the AI assistant. See section 7.

Quote and booking data (only if you ask us to buy a ticket): traveller names and documents, email, phone and the Pago Móvil receipt. At quote time we ask only for ages — never names or documents.

Content you publish: transport data proposals and, on the community map, emergency reports.

4. Other people's data on the community map

The incident map exists to help locate people and coordinate help during an emergency. A report may include personal data about someone other than you: the name, age, description and photograph of a missing or trapped person, and the location of the event. That information is published visibly by its very nature — a map of missing people nobody can see is of no use.

Publish only what is strictly needed for that person to be found, and only if you have reasonable grounds to do so. Reports are anonymised and retired automatically once the crisis window passes. If you appear in a report and want it taken down, write to soporte@vamosv.com and we will do it without asking you to justify yourself.

5. What we use the data for

To provide the service: searching trips, planning routes, drawing the map, managing your account and, if you ask us to, quoting and buying a ticket in your name.

To protect the service: per-device and per-account rate limits, abuse detection and moderation of reported content.

To understand what is missing: aggregate statistics on which routes are searched for and do not exist. That analysis does not require knowing who you are.

To meet legal obligations, in particular those of operating as a licensed travel agency in Venezuela.

We do not sell your personal data, do not hand it to third parties for their own advertising, and do not build automated profiles producing legal effects on you.

6. The mobile app

The app asks you to sign in before it shows anything. We do this because someone who installs an app has already chosen Vamos, and because it makes every account-dependent feature (the assistant, proposals, your quotes) actually available instead of half-opening a browser. The web stays anonymous and will remain so.

Permissions it may request: location while you use the app (optional; see section 3). The app does not access your contacts, calendar, photo library, microphone or camera, and collects nothing in the background.

Your session is stored encrypted on the device, with the key protected by the operating system's secure store (Keychain on iOS, Keystore on Android).

7. The AI search assistant

The assistant turns a sentence such as “I want to go to Porlamar on 20 August” into a search. To do that, the text you type is sent to a language-model provider acting as a processor on our behalf. Today that provider is OpenAI; the transport incident engine uses Anthropic.

We do not send your email, your name or your account identifier alongside the message: the provider receives the sentence and the search context, not who wrote it. We do not use your messages to train models, and we have contracted the service so that the provider does not either.

Do not type sensitive data into the assistant. It is a search translator, not a customer-support channel.

8. Who we share data with

Providers processing data on our behalf under contract: Supabase (authentication, database and file storage), Vercel and Railway (hosting), OpenAI and Anthropic (the AI features described above) and Sentry (error diagnostics on the web).

Google Analytics, to measure web usage in aggregate. Only airport codes, airline names and event labels travel — never your email or your name.

When you open the map, your device requests map tiles directly from OpenFreeMap, which therefore sees your IP address. Address lookups go through our server before reaching OpenStreetMap, so that service sees ours and not yours.

When you tap “Buy” you leave Vamos for the airline's or operator's own site. What happens there is governed by their privacy policy, not this one.

Authorities, only where a legal obligation exists.

9. How long we keep data

Account data, for as long as the account exists (see section 10).

Community reports are anonymised and retired automatically once the emergency window passes.

Identity data attached to a purchase is deleted automatically after the ticket is issued. Accounting records and the purchase mandate are kept for as long as Venezuelan law requires, even if you close your account: we cannot delete the evidence of a transaction that really happened.

Aggregate statistics, which no longer identify you, are kept indefinitely.

10. How to delete your account

You can close your account yourself, without writing to us and without waiting for anyone to approve it. In the app: account menu → Delete account. On the web: /cuenta → Delete account. We will ask you to type your email address to confirm, because the action cannot be undone.

Deleting it removes your sign-in identity, your profile, your preferences, your assistant usage history and your notification subscriptions. Contributions the team already reviewed and published (routes, schedules) remain on the map but stop being linked to you: the data is still true after you leave.

Records of a purchase already made are kept as a legal obligation, as explained in section 9.

The full detail, and a way to request it if you can no longer sign in, is at /legal/eliminar-cuenta.

11. Your rights

You may ask us to access your data, correct it, obtain a copy, object to a processing activity or delete it. Some of that you can do yourself from your account; for the rest, write to us and we will answer within a reasonable time at soporte@vamosv.com.

We will not ask you to justify a deletion request, nor try to talk you out of it.

12. Minors

Vamos is intended for people aged 18 and over. We do not create accounts for minors nor knowingly collect their data. A minor may travel as a passenger on a purchase made by an adult: in that case we process their travel data because the airline requires it, under the responsibility of the person contracting. If you believe a minor created an account, write to us and we will delete it.

13. Security and where data is held

All traffic is encrypted (HTTPS). Payment receipts live in a private bucket reachable only through short-lived signed links. Staff access is limited by explicit permissions and separated by duty: whoever quotes is not whoever confirms the money arrived.

Our providers run servers outside Venezuela, mainly in the United States, so your data is transferred to and processed there.

No system is infallible. Should a breach occur that significantly affects you, we will tell you.

14. Changes to this Policy

If we change it, we will update the date in the header. Where the change materially affects how we process your data, we will tell you inside the product before it takes effect.