Privacy Policy

GoWithPorto ("GoWithPorto", "we", "us") is a Porto-based tourism platform that helps travelers plan trips, book bike rentals and local experiences, and shop souvenirs from independent local shops in Porto, Portugal. GoWithPorto is the data controller responsible for your personal data described in this policy.

Questions about this policy or your data can be sent to support@gowithporto.pt.

We collect the minimum data needed to run the service:

• Account data — name, email address, and profile picture, provided by Google when you sign in with your Google account. We do not receive or store your Google password.
• Order & booking data — items purchased, shipping details, and order status for souvenirs, bike rentals, and local experiences.
• Payment data — handled entirely by our payment processor, Stripe. GoWithPorto never receives or stores your full card number.
• AI trip planner inputs — the dates, interests, and preferences you enter to generate an itinerary, and the itineraries generated for you, saved under "My Trips" in your account.
• Store owner content — if you sell on our marketplace, product listings and images you upload.
• Contact form messages — the name, email, and message you submit through our Contact Support page.
• Technical data — IP address and basic request metadata, used briefly for security purposes such as rate-limiting login attempts.

• To create and manage your account and let you sign in securely.
• To process orders and bookings, and send confirmation and shipping emails.
• To generate AI trip itineraries based on the preferences you provide.
• To respond to messages sent through our Contact Support page.
• To detect and prevent fraud, abuse, and unauthorized access.
• To meet our legal and accounting obligations.

We do not sell your personal data, and we do not use it for third-party advertising.

Under the GDPR, we rely on the following legal bases:

• Contract — processing needed to create your account, fulfil orders/bookings, and deliver AI itineraries you request.
• Legitimate interest — keeping the platform secure (e.g. rate-limiting), and responding to support requests.
• Legal obligation — retaining order and payment records as required by tax and accounting law.

GoWithPorto uses a small number of strictly necessary cookies: a secure session cookie to keep you signed in, and a preference cookie to remember your chosen language. We do not use third-party advertising or tracking cookies.

When you check out, our payment processor Stripe also sets its own cookies (such as __stripe_mid and __stripe_sid) to detect and prevent payment fraud. These are essential to process your payment securely and cannot be disabled while still allowing you to check out.

We only share personal data with service providers who process it on our behalf, strictly to run the service:

• Google — for secure sign-in (Google OAuth).
• Stripe — for payment processing at checkout.
• MongoDB Atlas — our database provider, hosted in the EU (Paris, France region).
• Cloudinary — for storing and serving product and profile images.
• Resend — for delivering transactional emails (order confirmations, receipts, welcome emails).
• Groq API — to generate AI trip itineraries from the preferences you provide, and to answer the questions you type into the Porto Buddy chat assistant (chats are not stored by GoWithPorto).
• Vercel — our application hosting provider.

Each provider is contractually restricted to using your data only to provide their service to us. We may also disclose data where required by law.

Some of our service providers (such as Google, Stripe, and Resend) may process data outside the European Economic Area, including in the United States. Where this happens, we rely on providers that offer appropriate safeguards, such as Standard Contractual Clauses, to protect your data in line with GDPR requirements.

We keep account data for as long as your account is active. Order and payment records are kept as required by Portuguese tax and accounting law. Contact form messages are kept only as long as needed to resolve your request. You can ask us to delete your account and associated data at any time — see Section 9.

Under the GDPR, you have the right to:

• Access the personal data we hold about you.
• Correct inaccurate or incomplete data.
• Request deletion of your data ("right to be forgotten").
• Restrict or object to certain processing.
• Receive your data in a portable format.
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, email support@gowithporto.pt. You also have the right to lodge a complaint with Portugal's data protection authority, the Comissão Nacional de Proteção de Dados (CNPD).

GoWithPorto is not directed at children, and we do not knowingly collect personal data from anyone under 16. If you believe a child has provided us with personal data, please contact us and we will delete it.

We use industry-standard safeguards to protect your data, including encrypted connections (HTTPS), access-restricted databases, and secure authentication. No method of transmission or storage is 100% secure, but we work to protect your information using commercially reasonable measures.

We may update this policy from time to time as our service evolves. Material changes will be reflected by updating the "Last updated" date at the top of this page.

For any questions about this Privacy Policy or how your data is handled, reach us at support@gowithporto.pt or via our Contact Support page. We're based in Porto, Portugal.