Your data, well looked after.

Passaporte Torres uses account data, stamps, reviews, coupons and optional selfies to operate the digital passport and project benefits.

Browser location is used during scanning to validate presence at the place, with a point-in-time check and minimized technical data.

Selfies are optional, private and encrypted. They appear only in the visitor's own history, in images they choose to create and, if they allow it, to the friends they share their passport with.

To protect accounts from bots that try passwords, every attempt to sign in (with a password or with Google) is recorded with the date, the result, the IP address and the browser. The e-mail typed is stored masked (only its first letters and the domain). These records are used only for security, stay with Passaporte Torres's administration and are deleted after 90 days.

When you sign in with Google, we receive the name, email address, account identifier and profile image made available by Google. This data is used only to create your session, protect the account, and sync stamps, rankings, coupons and privacy controls in Passaporte Torres. Your name (or the display name you choose) and profile picture are shown only to the people you share your passport with and to members of your groups; you can hide the picture in Share. Rankings and public comments show the display name, never your email address or picture.

Passaporte Torres stores this data in your account while it exists, together with the minimum Google provider link. Google access tokens, refresh tokens and ID tokens are not kept after sign-in because the app does not access Gmail, Drive, Calendar, Photos or other Google APIs.

We do not sell Google user data or use it for ads, retargeting, personalized advertising, credit-worthiness decisions, resale, data brokerage or AI model training. Sharing is limited to what is necessary to operate features requested by the visitor, comply with legal obligations, protect the service and support partners in benefit validation, always as described in this policy. Passaporte Torres' use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

You can disconnect Passaporte Torres from your Google Account at any time at myaccount.google.com/connections. This ends sign-in with Google but does not delete your Passaporte Torres account; to delete it, use the privacy center.

Human access to account data is restricted to support, security, bug fixing, legal obligations or aggregated operations, with administrative records when applicable.

Passaporte Torres does not sell or deliver anything. On a business's menu you put the order together, and it goes ready to the business's WhatsApp or, when you order from your table, to the kitchen screen. Sale, payment and delivery are arranged directly with the business, which receives what goes in the order: the items, your name, the delivery address and the payment method you chose. The site never asks for or keeps card numbers or any other payment data.

When you are signed in, we keep your last 20 orders for up to 12 months so you can order again, the addresses you choose to save (up to 3) and the last payment method you chose. Without an account, your name, payment method and addresses stay only on this device. In Profile › My orders you can see them and delete them one by one or all at once; this data is included in the export and deleted with the account.

For orders placed from the table, through the QR code, the business sees the table number, the items, the notes and your name if you give it. These orders are not linked to your account and are deleted after 48 hours. Statistics keep only the number of orders per day, with none of your data.

To know how many people use the site and which pages help visitors, we count visits anonymously: no cookies, no link to your account and no stored IP address. We keep only the page opened, the day and hour, the kind of device, the browser language and where the visit came from (for example, a search engine, a social network or a QR code). A scrambled code that changes every day tells visitors apart within the same day and afterwards can no longer be linked to any connection. If you have a validated resident registration and are signed in, the visit carries only a “resident” mark, with no link to the account, to tell residents and tourists apart in the statistics. These records are deleted after 13 months.

Stamps also feed aggregated statistics that help the city and local businesses plan tourism: busiest places and times, common routes, places visited together, trip profiles and seasons. Results are always group totals and never identify a visitor; combinations seen by fewer than 3 passports are hidden.

Friends and group actions, such as enabling sharing, sending or answering invitations, and creating or joining a group, are kept in your account history. Copying a link, opening WhatsApp and sharing through your device may also be counted, respecting this device’s measurement choice. Administrators see totals and group sizes, without people’s names or message contents. Deleting your account removes the link between these records and your profile.

Browsers with Do Not Track or Global Privacy Control turned on are not counted. You can also turn off the counting of your visits on this device.

People who live in Torres can fill in, in their Profile, an optional registration with WhatsApp, postal code (CEP), sex and date of birth. It is used to validate resident status and unlock resident benefits at participating businesses. The legal basis is your consent, recorded with the date and version of the acceptance.

Validation lasts 24 months and happens at a participating business or with the Passaporte team: a staff member checks a proof of address in person and confirms it through the QR code. The document is never photographed, uploaded or stored; only the date, the business and who validated are recorded.

When reading your QR code, the business sees your name, your postal code and the registration status. Sex and date of birth are not shown to businesses. Each use of the benefit is recorded (business, date and time) and, from then on, that business's managers see your name, your WhatsApp and your account's e-mail address for 24 months, to contact you about resident benefits; they may download these contacts as a spreadsheet and may not use them for anything else or pass them on. The City team that runs the Passaporte accesses the full registration to operate and correct validations, may use WhatsApp and e-mail to contact you about the registration and resident benefits, and uses sex and age (calculated from the date of birth) only in aggregated statistics that identify no one.

The registration is kept for as long as you want. You can correct the details or delete the registration at any time in your Profile, and it is also erased with the account. Changing the postal code requires a new validation, and false information may lead to revocation. When the registration is deleted, the uses already recorded remain only as numbers in the statistics, with no link to you.

Account holders get news, benefits and reminders from Passaporte Torres by email and, if they turn on notifications on their device, by notification too. This is on for every account: to stop receiving them, turn off Promotional communications in the Privacy Center at any time. Every email also has a way to leave the list. We only use the account's name and email and, for notifications, the device registration you allowed in the browser.

In the privacy center, you can review stored data counts, manage optional consents, export your data and delete your account.

Partners access the data needed to validate coupons and aggregated statistics of their own businesses, without identifying visitors. Public comments show your display name, the rating and the month you stamped the place; email, picture and internal identifiers stay private. The city and the business may reply publicly to a comment.

In each season's public ranking, those who choose to take part show their first name with the initials of their surnames, their points and their stamps. Your account photo shows on the podium and in the classification only if you turn that option on in the ranking, and you can turn it off at any time. Anyone can report an inappropriate photo: it leaves the ranking until City of Torres (Rio Grande do Sul, Brazil)'s moderation reviews it, and a photo moderation removes does not come back to the ranking.

Passaporte Torres is managed by the City of Torres (Rio Grande do Sul, Brazil), which is responsible for processing the data described in this policy under Brazil's General Data Protection Law (LGPD).

Questions or requests about your data or this policy: passaporte@torres.rs.gov.br