VoyZee Privacy Policy
Effective date: Oct 26, 2026 · Last updated: Oct 23, 2026
This Privacy Policy explains how Universe Voy, Lda ("Universe Voy", "we", "us") collects, uses, shares and protects personal data when you use the VoyZee Travel mobile app for iOS and Android (the "App") and the website voyzee-travel.com (the "Website"), together the "Services".
We wrote it to comply with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR"), Portuguese Law 58/2019, the Portuguese electronic communications privacy law (Law 41/2004), and, for users in those places, the laws of the United States (including California) and Brazil described in section 12.
In short:
- We use your data to run VoyZee: your account, trips, passport, visited places and subscriptions.
- We do not sell your personal data, show you ads, or use advertising or analytics trackers in the App.
- Your precise location is used only on your device and is never sent to or stored on our servers.
- You can access, correct, export or delete your data at any time (section 9).
1. Who is responsible for your data
The data controller is:
| Company | Universe Voy, Lda |
| Tax number (NIF) | 519712340 |
| Registered address | Rua Castilho 14C 5ºandar, 1250-069 Lisboa, Portugal |
| Privacy contact | voyzee.travel@gmail.com |
We have not appointed a Data Protection Officer, because the GDPR does not require one for our activities (Article 37 GDPR). For any privacy question or request, write to the contact above; it also serves as our contact channel for users in Brazil (section 12.2).
2. The data we collect
We collect only what we need to run the Services. You can use the App without an account (as a guest); in that case your data stays on your device, except purchase data handled by the app stores and RevenueCat (section 4).
| Category | What it includes | Where it comes from |
|---|---|---|
| Account data | Email address, password (stored only in encrypted, hashed form), and an identifier from Apple or Google if you sign in with them | You, or Apple / Google when you use their sign-in |
| Profile data | Username and profile picture. Optional: full name, date of birth, nationality and gender, used only to fill in your digital passport | You |
| Travel content | Trips (names, dates, destinations, cities, attractions, accommodation, transport, daily plans, checklists, budgets and expenses), names of trip participants you add, trip cover photos, trip memories (photos and notes) | You |
| Passport and visited places | Visited countries, regions and cities with dates; passport pages, stamps (including the photos, frames and colours you choose) and badges | You |
| Verified places | The place you claimed a verified stamp for, and when. Your precise location is not collected (section 8) | The App |
| Social data | Trips you share and with whom, invitations and their status, collaborator roles, users you block, and reports you make about other users or content | You and other users |
| Purchase data | Subscription plan, status, start and expiry dates, renewal status, store (App Store, Google Play or web), purchase and customer identifiers, amount, currency and any promo code. We never receive your full card number | App stores, RevenueCat, Stripe |
| Device and technical data | Push notification token, an app user identifier for subscriptions, operating system and app version, language and display settings, and IP address and request logs on our servers | Your device and our servers |
| Communications | Messages you send to our support team and our replies | You |
| Website data | Cookies and similar technologies (section 10.3), and data you enter when buying a subscription on the Website | Your browser, you, Stripe |
Information about other people. If you add other people to a trip (for example as participants in shared expenses), you are responsible for having the right to share their names with us and for telling them about this Policy.
What we don't collect. We do not use advertising identifiers, do not run analytics or tracking tools in the App, and do not collect special categories of data (such as health, religion or sexual orientation). Please don't include such information in your trips, notes or reports.
3. How we use your data and our legal bases
Under the GDPR we may only use personal data when we have a legal basis. These are our purposes and the basis for each (Article 6(1) GDPR):
| Purpose | Data used | Legal basis |
|---|---|---|
| Create and run your account, and provide the App's features (trips, passport, visited places, memories) | Account, profile, travel and passport data | Performance of our contract with you (Art. 6(1)(b)) |
| Sync your data between devices and keep a copy on your device so the App works offline | Account, profile, travel and passport data | Contract (Art. 6(1)(b)) |
| Optional passport details (full name, date of birth, nationality, gender) | Those fields | Your consent (Art. 6(1)(a)); you can remove them at any time |
| Show nearby places and verify a stamp claim | Location, processed on your device only | Your consent, given through your device's location permission (Art. 6(1)(a)) |
| Share trips and collaborate with the people you invite | Username, profile picture, shared trip content | Contract (Art. 6(1)(b)) |
| Sell, activate and manage subscriptions, and link a subscription to one account | Purchase and account data | Contract (Art. 6(1)(b)) |
| Keep invoices and payment records | Purchase data | Legal obligation under Portuguese tax and accounting law (Art. 6(1)(c)) |
| Send service notifications (trip updates, invitations) | Push token, account data | Your consent through your device's notification permission and in-app settings (Art. 6(1)(a)) |
| Send news, offers and updates about VoyZee and Universe Voy (by email or push) | Email, push token, name | Your consent, or, where the law allows for existing customers, our legitimate interest. You can opt out at any time (section 10.2) |
| Keep users safe: handle reports, blocks and misuse, and enforce our Terms | Social data, reported content, account data | Legitimate interests in a safe service (Art. 6(1)(f)) and legal obligations (Art. 6(1)(c)) |
| Protect the Services: security, fraud and abuse prevention, error fixing | Technical data, logs | Legitimate interests (Art. 6(1)(f)) |
| Answer your questions and requests | Communications, account data | Contract and legitimate interests (Art. 6(1)(b) and (f)) |
| Comply with the law and establish, exercise or defend legal claims | Any relevant data | Legal obligation and legitimate interests (Art. 6(1)(c) and (f)) |
Where we rely on legitimate interests, we have balanced them against your rights, and you can object at any time (section 9). Where we rely on consent, you can withdraw it at any time without affecting earlier processing.
No automated decisions. We do not take decisions that have legal or similarly significant effects on you based solely on automated processing, and we do not profile you for advertising.
4. Who we share your data with
We do not sell your personal data and do not share it for targeted advertising. We share it only as follows.
Other VoyZee users.
There are no public profiles. Other users can see only:
- your username and profile picture, when you share a trip with them, invite them, or they invite you;
- the trip content you choose to share with them, with the role you give them (viewer or editor).
Service providers (processors).
These companies process data on our behalf, under written agreements that require them to protect it and use it only on our instructions (Article 28 GDPR):
| Provider | What they do for us | Where data is processed |
|---|---|---|
| Supabase, Inc. | Database, user accounts, file storage, email for sign-in and password reset, server functions | European Union (Ireland, AWS eu-west-1); support access from the United States |
| RevenueCat, Inc. | Manages in-app subscriptions and checks who is entitled to Premium | United States |
| 650 Industries, Inc. (Expo) | Sends push notifications to your device | United States |
| Website hosting provider | Hosts voyzee-travel.com | [insert provider and location] |
| Email provider (Google) | Our support mailbox | European Union and United States |
Independent controllers.
These companies process your data under their own privacy policies when you use their services through VoyZee:
- Apple (App Store, Sign in with Apple, push notifications, Apple Maps) and Google (Google Play, Google sign-in, Firebase Cloud Messaging, Google Maps) handle in-app payments, sign-in, notification delivery and map display.
- Stripe (Stripe Payments Europe, Ltd.) processes payments made on the Website, including your card details, which we never see.
Other cases.
We may also share data:
- with our accountants, auditors and legal advisers, under confidentiality duties;
- with public authorities, courts or law enforcement when the law requires it;
- to protect the rights, safety or property of our users, the public or Universe Voy;
- with a buyer or successor if Universe Voy is involved in a merger, acquisition or sale of assets. We will tell you before your data becomes subject to a different privacy policy.
5. International data transfers
Your account and travel data are stored in the European Union (Ireland). Some of our providers are based in, or may access data from, countries outside the European Economic Area, mainly the United States.
When personal data leaves the EEA, we make sure it stays protected by at least one of these safeguards:
- an adequacy decision of the European Commission, including the EU-US Data Privacy Framework for providers certified under it;
- the European Commission's Standard Contractual Clauses (Decision (EU) 2021/914), with additional security measures where needed.
You can ask us for more information about these safeguards, or for a copy of them, using the contact in section 1.
6. How long we keep your data
VoyZee is a long-term record of your travels, so we keep your account data for as long as your account exists, including while it is inactive, until you ask us to delete it. We keep other data only as long as needed for its purpose:
| Data | How long |
|---|---|
| Account, profile, travel and passport data | While your account exists. After you ask us to delete your account, our team deletes it within 30 days |
| Backups | Overwritten automatically within [90] days of deletion |
| Invoices and payment records | 10 years, as required by Portuguese tax and accounting law, and then deleted |
| Reports, blocks and safety records | While your account exists, and up to 1 year after it is deleted, unless needed longer for a legal claim or investigation |
| Support messages | Up to 2 years after your request is resolved |
| Server logs | Up to 90 days |
| Push notification token | Until you log out, turn off notifications or delete the App |
| Data stored on your device | Until you delete it, log out or uninstall the App (section 8) |
We may keep data longer when the law requires it, or to establish, exercise or defend legal claims. Data that no longer identifies you may be kept for statistics.
7. Children
The Services are not directed at children, and you must be at least 13 years old to use them.
If you are under the age at which you can consent to online services in your country (13 in Portugal; up to 16 in some EU countries), you may only create an account with the consent of a parent or legal guardian.
We do not knowingly collect personal data from children under 13. If we learn that we have, we will delete it.
If you are a parent or guardian and believe your child has given us personal data, contact us (section 1).
8. Device permissions, offline storage and subscriptions
Permissions. The App asks for permissions only when a feature needs them, and you can change them at any time in your device settings:
| Permission | Why | What happens to the data |
|---|---|---|
| Location (only while using the App) | Show nearby places and check that you are at a place before you claim its verified stamp | Processed only on your device to measure distance. Your coordinates are never sent to or stored on our servers; we only save which place you claimed |
| Photos | Choose a profile picture, trip covers, memories and stamp photos | Only the photos you select are uploaded and stored, in private storage |
| NFC | Read VoyZee place tags | Only the tag's place identifier is used |
| Notifications | Send trip updates, invitations and, if you agree, news | We store a push token to deliver them |
Offline storage. So the App works without internet, a copy of your data (trips, passport, visited places, settings and cached images) is stored on your device. Protect your device with a passcode. When you log out, account data is removed from the device, but your visited countries stay on it as guest data so you can keep using the App offline; uninstalling the App removes them.
Subscriptions without an account. You can buy Premium without an account. The subscription is then linked to an anonymous identifier on your device by RevenueCat. When you sign in or create an account, it is linked to that account, and it can only ever belong to one account. We tell you in the App before and after this happens. Once linked, Premium is no longer shown on the device after you log out.
9. Your rights
Under the GDPR (Articles 15 to 22) you have the right to:
- Access the personal data we hold about you and get a copy of it.
- Rectify data that is inaccurate or incomplete. You can edit most of it directly in the App.
- Erase your data ("right to be forgotten"), including deleting your account.
- Restrict how we use your data in certain cases.
- Data portability: receive the data you gave us in a structured, commonly used, machine-readable format, or have it sent to another provider.
- Object to processing based on our legitimate interests, and to direct marketing at any time, without giving a reason.
- Withdraw consent at any time, without affecting processing that happened before.
How to use your rights. Email voyzee.travel@gmail.com from the address linked to your account, or use the account deletion option in the App (Profile). We may ask you to confirm your identity before acting. We reply within one month; for complex or numerous requests this can be extended by two more months, and we will tell you why. Requests are free, unless they are clearly unfounded or excessive.
Deleting your account. When you ask us to delete your account, our team deletes your account and all associated data (profile, trips, passport, visited places, photos and files) within 30 days, except the records we must keep by law (section 6). Deletion cannot be undone. Active subscriptions bought through the App Store or Google Play are not cancelled automatically: cancel them in your store account to stop future charges.
Complaints. If you believe we have not handled your data correctly, you can complain to the Portuguese data protection authority, the Comissão Nacional de Proteção de Dados (CNPD), at www.cnpd.pt, or to the authority in your country of residence or work. We would appreciate the chance to resolve your concern first.
10. Security, marketing and cookies
10.1 How we protect your data
We use technical and organisational measures appropriate to the risk (Article 32 GDPR), including:
- encryption of data in transit (HTTPS/TLS) and at rest by our hosting provider;
- passwords stored only as secure hashes;
- database access rules so each user can reach only their own data and the trips shared with them;
- photos kept in private storage, opened only through short-lived signed links;
- access to personal data limited to the people at Universe Voy who need it.
No system is completely secure. If a personal data breach is likely to put your rights at risk, we will notify the CNPD within 72 hours and inform you without undue delay, as the GDPR requires.
10.2 News and marketing
We may send you news, offers and updates about VoyZee and other Universe Voy services by email or push notification:
- only with your consent, or, where the law allows, about our own similar products if you are already a customer;
- you can stop them at any time with the unsubscribe link in each email, the "VoyZee updates" option in the App's notification settings, or by contacting us.
Service messages (security, account and subscription notices) are not marketing and will still be sent.
10.3 Cookies on the Website
The App does not use cookies or advertising trackers. The Website uses:
- strictly necessary cookies, which make the site and secure payments work (including Stripe's fraud-prevention cookies during checkout). These do not need consent;
- analytics or marketing cookies, only if you accept them in the cookie banner. You can change your choice at any time through the banner or your browser settings.
[Before publishing: list here the actual cookies the Website uses, with their provider, purpose and duration.]
11. Changes, governing law and contact
Changes to this Policy. We may update this Policy when our Services or the law change. The date at the top shows the latest version. If a change is significant, we will tell you in the App or by email before it takes effect, and ask for your consent again where the law requires it.
Governing law and courts. This Policy is governed by Portuguese law, and the courts of Portugal have jurisdiction over any dispute relating to it. If you are a consumer, this does not take away the protection of the mandatory laws of your country of residence, or your right to bring a claim before the courts or authorities of that country.
Out-of-court dispute resolution. Consumers in Portugal may also use an alternative dispute resolution entity; the list is available at www.consumidor.gov.pt.
Language. If this Policy is translated, the English version prevails in case of any difference, unless the law requires otherwise.
Contact. Universe Voy, Lda · NIF 519712340 · Rua Castilho 14C 5ºandar, 1250-069 Lisboa, Portugal · voyzee.travel@gmail.com
12. Additional information for users in the United States and Brazil
12.1 United States (including California)
This section applies to residents of California under the California Consumer Privacy Act as amended by the CPRA ("CCPA"), and of other US states with similar privacy laws.
Categories we collect (in the last 12 months), using the CCPA's categories:
| CCPA category | Examples | Disclosed for a business purpose to |
|---|---|---|
| Identifiers | Email, username, account and device identifiers, IP address | Service providers (section 4) |
| Personal records | Name, profile picture | Service providers |
| Characteristics of protected classifications (optional) | Date of birth, nationality, gender, only if you add them | Service providers |
| Commercial information | Subscription and purchase history | Service providers, app stores, Stripe |
| Audio, electronic, visual or similar information | Photos you upload | Service providers |
| Internet or other electronic network activity | Server logs, app version | Service providers |
| Sensitive personal information | Account login (email and password) | Service providers, only to provide the Services |
We do not collect precise geolocation (it stays on your device), and we use sensitive personal information only to provide the Services, as the CCPA allows, so the right to limit its use does not apply. Sources, purposes and retention are described in sections 2, 3 and 6.
We do not sell or share personal information, as "sell" and "share" are defined in the CCPA, and have not done so in the last 12 months, including of consumers under 16.
Your rights. You can ask to know what personal information we collect, use and disclose; to get a copy; to delete it; and to correct it. You can also opt out of sale or sharing, although we do not sell or share. We will not discriminate against you for using these rights. Send requests to the contact in section 1. We verify your identity by matching the request with your account email. You may use an authorized agent, who must show your signed permission; we may still ask you to verify your identity directly. If we deny a request, you may appeal by replying to our decision, where your state's law gives that right.
Do Not Track and Global Privacy Control. Because we do not sell or share personal information or track you across other sites or apps, these signals do not change how we process your data.
12.2 Brazil
For users in Brazil, we process personal data under the Lei Geral de Proteção de Dados (Law 13.709/2018, "LGPD").
Legal bases (Article 7 LGPD): performance of a contract, compliance with legal obligations, legitimate interests and consent, matching the purposes in section 3.
Your rights (Article 18 LGPD): confirmation that we process your data, access, correction, anonymisation, blocking or deletion of unnecessary data, portability, information about who we share data with, information about the consequences of refusing consent, and withdrawal of consent.
International transfers are made under the safeguards in section 5 and Article 33 LGPD.
Contact channel: send requests to voyzee.travel@gmail.com. You may also complain to the Autoridade Nacional de Proteção de Dados (ANPD) at www.gov.br/anpd.
