Privacy Policy

Last updated: October 30, 2026

Mamajuana Travel is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your personal information when you use our website and services.

1. Data Controller

The data controller responsible for your personal information is:
Mamajuana Travel
Santo Domingo, Dominican Republic
Email: info@mamajuanatravel.com

2. Information We Collect

We collect the following types of personal information:

• Identity information: First name, last name, and nationality.
• Contact information: Email address and phone number.
• Booking information: Tour selections, dates, traveler counts, and special requests.
• Payment information: Payments are processed by PayPal and, where offered, by our card payment processor through Stripe. We do not store credit or debit card numbers on our servers. We receive confirmation of payment and a transaction reference.
• Technical information: IP address, browser type, device information, pages visited and how you interact with them (including session recordings), collected automatically through cookies and analytics tools.
• Communications: Messages sent to us via email, WhatsApp, or our contact form.

3. How We Use Your Information

• Booking fulfillment: To process your reservation, confirm your booking, and coordinate tour logistics.
• Customer communication: To send booking confirmations, reminders, and respond to your inquiries.
• Payment processing: To facilitate secure payments through PayPal and our card payment processor.
• Payment disputes and fraud prevention: If you open a chargeback or payment dispute, we share the records of your booking (booking details, acceptance of our terms at checkout with date, time and IP address, confirmations, communications and attendance records) with the payment provider and card issuer handling it.
• Marketing: With your explicit consent, we may send newsletters and promotional offers. You can opt out at any time.
• Analytics and improvement: To understand how visitors use our website and improve our services.
• Legal compliance: To fulfill our legal obligations under Dominican Republic law.

4. Third-Party Services

We use the following third-party services that may process your data:

• PayPal: Payment processing (PayPal and cards through PayPal), fraud prevention and payment disputes. Privacy
• Stripe: Card payment processing where offered at checkout, fraud prevention and payment disputes. Card details are entered directly with Stripe and are not stored on our servers. Privacy
• Google reCAPTCHA: Protection of sign-in, contact and chat forms against spam and abuse. Privacy
• Google Places: Address and hotel search when you enter pickup details. Privacy
• Google Analytics 4: Website analytics (visits, pages, traffic sources, purchases), including purchase events sent from our servers. Privacy
• Google Ads: Advertising conversion measurement and remarketing. Privacy
• Meta Pixel and Conversions API (Facebook / Instagram): Advertising measurement, audiences and conversion deduplication (see the Meta Conversions API section). Privacy
• TikTok Pixel and Events API: Advertising measurement and audiences for TikTok campaigns, including events sent from our servers. Privacy
• Microsoft Clarity: Session recording and heatmaps: records how you use our pages (clicks, scrolling, mouse movement and page content) to improve the site. Privacy
• PostHog: Product analytics (page views, clicks and site events linked to a visitor ID). Privacy
• Vercel: Website hosting and cookieless traffic analytics. Privacy
• Sentry: Error monitoring; when an error occurs, a replay of the affected session may be captured to fix it. Privacy
• Mautic: Marketing email and on-site interest tracking (only marketing emails if you subscribed).
• Supabase: Database, customer accounts and file storage. Privacy
• Upstash: Rate limiting and abuse protection (IP address, kept temporarily). Privacy
• Inngest: Background processing of bookings, emails and notifications. Privacy
• Resend: Sending transactional emails (confirmations, vouchers, sign-in codes). Privacy
• Chatwoot: Customer support conversations (website chat and WhatsApp).
• OpenAI: AI assistant answers, translations, conversation summaries and voice/image processing (see the AI sections). Privacy

We also use our own business systems (Frappe CRM / ERPNext) for customer records, invoicing and bookings, and share the booking details needed to deliver your service with the guides, drivers and local providers who operate it.

5. Cookies and Tracking

We use cookies and similar tracking technologies to enhance your experience on our website. For detailed information, please see our Cookie Policy.

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this policy:

• Booking data is retained for 7 years for accounting and legal compliance purposes.
• Marketing data is retained until you withdraw consent.
• Technical logs are retained for up to 90 days.

7. Your Rights

You have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data, subject to legal retention requirements.
• Opt-out: Unsubscribe from marketing communications at any time using the link in our emails or by contacting us.

To exercise any of these rights, contact us at info@mamajuanatravel.com. We will respond within 30 days.

8. Children's Privacy

Our website is not directed at children under the age of 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us and we will promptly delete it.

9. International Data Transfers

Your data may be transferred to and processed in countries outside the Dominican Republic, including the United States, where our third-party service providers operate. We ensure that appropriate safeguards are in place for such transfers.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Our website uses SSL encryption for all data transmissions.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with a revised "Last updated" date. We encourage you to review this policy periodically.

12. Contact Us

For privacy-related inquiries:

• Email: info@mamajuanatravel.com
• Phone: +1 809 939 0555
• Address: Santo Domingo, Dominican Republic

13. Automated AI Processing

We use artificial intelligence (OpenAI gpt-4o-mini) to analyze conversation history when a customer support conversation is resolved. This analysis extracts tour interests, client intent, detected language, sentiment, unanswered questions, and produces a summarized client profile. The purpose of this processing is solely to improve the quality of future service interactions with returning clients.

AI-generated summaries are stored in our internal CRM system (Frappe CRM, hosted at erp.mamajuanatravel.com) under a restricted namespace accessible only to our service team. Personal identifiers — including email addresses, phone numbers, and passport numbers — are automatically redacted from conversation text before the AI analysis is performed and before any summary is stored.

AI conversation summaries are automatically deleted after 6 months from the date of generation. They are not shared with third parties, used for advertising profiling, or transferred outside our CRM system.

Legal basis: Legitimate interest (GDPR Art. 6(1)(f) / Dominican Republic Ley 172-13 Art. 5). A Legitimate Interest Assessment (LIA) documenting this processing is available upon request at info@mamajuanatravel.com.

14. Voice Message and Image Processing

When you send a voice message via WhatsApp or any other channel connected to our support system, your audio recording is transcribed using OpenAI's audio transcription service. The resulting text transcription is appended to your conversation record and used to enable our support team to respond accurately to your inquiry. Audio files are processed in-stream and are not stored in our AI processing pipeline beyond the duration of transcription. Original audio files remain in our customer support platform (Chatwoot) as part of your conversation history, subject to standard conversation retention.

When you send images via any supported channel, we use AI vision processing (OpenAI gpt-4o-mini) to generate a plain-text description of the image content. This description is used to assist our support staff in understanding and responding to your message. Image files are not additionally stored or retained in our AI processing pipeline; the original image remains in your Chatwoot conversation record.

Legal basis: Legitimate interest (GDPR Art. 6(1)(f) / Ley 172-13). Voice and image processing is necessary to enable efficient and accurate responses to customer-initiated communications. A Legitimate Interest Assessment is available upon request.

15. Meta Conversions API (CAPI)

When you submit a contact inquiry form or complete a booking on our website, we transmit certain personal data to Meta's Conversions API (CAPI) to measure the effectiveness of our advertising campaigns and to deduplicate conversion events with our Meta Pixel implementation. Your email address, phone number, first and last name, country and customer ID are hashed with the SHA-256 algorithm before transmission. Your IP address, browser user agent and Meta browser identifiers (the _fbp and _fbc cookies) are sent as they are, because Meta needs them to match events. We send equivalent events to TikTok (Events API) and purchase events to Google Analytics from our servers.

The hashed data is used only for advertising measurement and event deduplication. We do not use CAPI-transmitted data for any other purpose. Meta's processing of this data is governed by Meta's own Privacy Policy and Data Processing Terms.

Our cookie banner records your preferences, but at present it does not switch these transmissions off: CAPI and the other server-side events above are sent for every booking and contact inquiry, and the analytics and advertising tools listed in our Cookie Policy load for all visitors. If you object to your data being used for advertising measurement, email us at info@mamajuanatravel.com and we will answer your request within 30 days; you can also use the opt-out controls of each platform.

Legal basis: Legitimate interest in measuring our advertising and preventing fraud (GDPR Art. 6(1)(f) / Ley 172-13). You may object at any time as described above.

16. AI Knowledge Base (Qdrant Vector Database)

We maintain an AI-powered knowledge base using Qdrant vector database technology, hosted on our infrastructure (Easypanel VPS). This knowledge base contains tour information, frequently asked questions, and approved Q&A pairs derived from anonymized and team-reviewed conversation summaries. It is used to power our AI assistant (Hot AirBallon AI) when responding to customer inquiries via chat.

Vector embeddings stored in Qdrant are derived from FAQ content approved by our team. Raw conversation transcripts are not stored in the vector database. Only structured Q&A pairs that have been reviewed and approved by a team member are indexed. These approved entries do not contain personal data in identifiable form.

FAQ entries are retained in the knowledge base indefinitely as they represent business knowledge and may be updated or removed at our discretion. If an approved entry is found to contain personal data following a data subject erasure request, it will be removed within 30 days of a verified request.

17. Multi-brand Architecture

Mamajuana Travel is part of a portfolio of travel brands. Our data infrastructure is designed to support multiple brands within a shared technical platform while maintaining strict brand-level data isolation. Personal data collected under the Mamajuana Travel brand is not shared with, or made accessible to, other brands in the portfolio unless you explicitly engage with those brands and are informed of such sharing at the time of collection. Each brand maintains separate data namespaces, ensuring that your Mamajuana Travel data is processed solely in the context of your relationship with Mamajuana Travel.