Privacy Policy
Passepartout recognizes how much it matters to protect the privacy and security of the personal data our travelers entrust to us. This Policy explains what data we collect through passepartout.travel, why, and what you can ask of us. The app has not launched yet: today the website runs only the waitlist and the traveler-type quiz, so that is all this Policy covers. We process personal data under the General Data Protection Regulation (GDPR), the Portuguese law that implements it (Lei n.º 58/2019) and the Portuguese law on electronic communications (Lei n.º 41/2004), which governs the emails we send.
1. Who we are
The website is run by Passepartout's two founders, Rita Pereira and Joana Pina, who decide together how personal data is used and are therefore joint controllers under the GDPR. For anything related to your data, write to info@passepartout.travel, which reaches both of us. You may exercise your rights with either of us, and we will answer together.
2. What we collect
We only hold what you give us through our two forms. When you join the waitlist, we keep your name and email address, the seat number and member code we assign you, and a record of your consent: when you gave it and the exact sentence you agreed to. We also note when each email was sent to you and, if you unsubscribe, when you did.
When you ask for your quiz result by email, we keep your email address, your answers and the traveler type they produced. If you take the quiz without asking for the result, nothing is stored: the result is worked out in your browser and never reaches us.
If, once the app launches, you enter your member code there, your waitlist record is linked to your new account so your seat and traveler type carry over. We never ask for payment details, identity documents or any sensitive information.
Giving us your details is entirely voluntary. The only consequence of not doing so is that we cannot hold a seat for you or send you your result.
3. Why we use it
We use your waitlist details to hold your seat, send you your code, tell you when the app opens and write to you occasionally about Passepartout. We do this on the basis of your consent, which you give by ticking the box on the form and can withdraw at any time. Your quiz details are used to send you the result you asked for, which is simply providing the service you requested. We also look at quiz answers in aggregate, never person by person, to understand which kinds of travelers we are building for; this rests on our legitimate interest in making a product that fits its users, and you may object to it. Finally, we keep the record of your consent because the law requires us to be able to prove it.
Your traveler type is worked out automatically from your answers. It is a light description of how you like to travel, used to send you your result and, later, to shape how the app greets you; it has no legal or similarly significant effect on you, and no other automated decision is made about you.
We will not use your data for anything else. If that ever changes, we will tell you first and, where needed, ask again.
4. Cookies
The website sets no cookies and runs no analytics, advertising or tracking of any kind. Your browser contacts two third parties. Google Fonts delivers the site's typefaces and, like any server, receives your IP address to do so. When you open the waitlist form, Cloudflare Turnstile checks that it is being filled in by a person and not a bot; to do so it receives your IP address and technical details of your browser, and it does not use them for advertising. This check rests on our legitimate interest in keeping fake sign-ups and strangers' addresses off the list. Our hosting and database providers also keep short technical logs of each visit, such as IP address, browser and time, to deliver the site and protect it from abuse; this rests on our legitimate interest in keeping the service secure, and these logs are never linked to your waitlist record.
5. Who else handles your data
We never sell your data or share it for anyone else's purposes. Four providers help us run the site and process data only on our instructions: Supabase hosts the database, Resend delivers our emails, Netlify hosts the website and Cloudflare runs the check against bots on our forms. Where any of them handles data outside the European Economic Area, the transfer is covered by the European Commission's Standard Contractual Clauses or the EU-US Data Privacy Framework, and you can ask us for a copy of the safeguard that applies. We would only disclose data to anyone else if the law required it, for instance at the request of a court.
6. How long we keep it
Your waitlist record is kept until you withdraw your consent, or until twelve months after the app launches if you have not created an account by then, whichever comes first. A quiz result on its own is kept for twelve months; if you also joined the waitlist, it follows the waitlist period. After that, the data is deleted or made anonymous.
7. How we protect it
Every connection to the site, the database and our email service is encrypted. The website can only add a signup or a quiz result to the database; it cannot read anyone's record, and only the two of us have access to the data. No system is completely secure, but if a breach ever put your data at risk, we would notify the Portuguese data protection authority within 72 hours and tell you as the law requires.
8. Your rights
You can ask us at any time to see the data we hold about you, correct it, delete it, limit how we use it, or send it to you in a portable format. You can also object to our use of it and withdraw your consent, without affecting anything we did before. Just write to info@passepartout.travel, ideally from the address you signed up with, so we know the request is yours. It costs nothing, and we reply within one month.
If you feel we have not handled your data properly, you can complain to the Comissão Nacional de Proteção de Dados (cnpd.pt), or to the data protection authority of the EU country where you live.
9. Unsubscribing
To stop hearing from us, write to info@passepartout.travel with the word "Unsubscribe", and we will stop within a few days. Your seat and code stay valid for the app unless you ask us to delete them too.
10. Children
Passepartout is meant for people aged 16 and over. If you believe someone younger has given us their details, let us know and we will delete them.
11. Changes to this Policy
When what we do changes, for example when the app launches, we will update this page and its date. If the change matters to you, we will email you before it takes effect, and we will ask for your consent again wherever it is needed.