Privacy Policy

Last updated: April 25, 2026

Mamajuana Travel is committed to protecting your privacy. This Privacy Policy explains how we collect, use, and safeguard your personal information when you use our website and services.

1. Data Controller

The data controller responsible for your personal information is:
Mamajuana Travel
Santo Domingo, Dominican Republic
Email: info@mamajuanatravel.com

2. Information We Collect

We collect the following types of personal information:

• Identity information: First name, last name, and nationality.
• Contact information: Email address and phone number.
• Booking information: Tour selections, dates, traveler counts, and special requests.
• Payment information: Payments are processed by PayPal. We do not store credit or debit card numbers on our servers. We receive confirmation of payment and a PayPal transaction reference.
• Technical information: IP address, browser type, device information, and pages visited, collected automatically through cookies and analytics tools.
• Communications: Messages sent to us via email, WhatsApp, or our contact form.

3. How We Use Your Information

• Booking fulfillment: To process your reservation, confirm your booking, and coordinate tour logistics.
• Customer communication: To send booking confirmations, reminders, and respond to your inquiries.
• Payment processing: To facilitate secure payments through PayPal.
• Marketing: With your explicit consent, we may send newsletters and promotional offers. You can opt out at any time.
• Analytics and improvement: To understand how visitors use our website and improve our services.
• Legal compliance: To fulfill our legal obligations under Dominican Republic law.

4. Third-Party Services

We use the following third-party services that may process your data:

• PayPal: For secure payment processing. See PayPal's Privacy Policy.
• Resend: For sending transactional emails (booking confirmations).
• Supabase: For secure database storage of booking and user data.
• Vercel: For website hosting and deployment.
• Google Analytics: For website traffic analysis (anonymized data).
• Meta Pixel (Facebook): For marketing analytics and advertising measurement. This tool uses cookies to track conversions.

5. Cookies and Tracking

We use cookies and similar tracking technologies to enhance your experience on our website. For detailed information, please see our Cookie Policy.

6. Data Retention

We retain your personal information for as long as necessary to fulfill the purposes described in this policy:

• Booking data is retained for 7 years for accounting and legal compliance purposes.
• Marketing data is retained until you withdraw consent.
• Technical logs are retained for up to 90 days.

7. Your Rights

You have the right to:

• Access: Request a copy of the personal data we hold about you.
• Correction: Request correction of inaccurate or incomplete data.
• Deletion: Request deletion of your personal data, subject to legal retention requirements.
• Opt-out: Unsubscribe from marketing communications at any time using the link in our emails or by contacting us.

To exercise any of these rights, contact us at info@mamajuanatravel.com. We will respond within 30 days.

8. Children's Privacy

Our website is not directed at children under the age of 16. We do not knowingly collect personal information from children under 16. If you believe a child has provided us with personal information, please contact us and we will promptly delete it.

9. International Data Transfers

Your data may be transferred to and processed in countries outside the Dominican Republic, including the United States, where our third-party service providers operate. We ensure that appropriate safeguards are in place for such transfers.

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data against unauthorized access, alteration, disclosure, or destruction. Our website uses SSL encryption for all data transmissions.

11. Changes to This Policy

We may update this Privacy Policy from time to time. Changes will be posted on this page with a revised "Last updated" date. We encourage you to review this policy periodically.

12. Contact Us

For privacy-related inquiries:

• Email: info@mamajuanatravel.com
• Phone: +1 809 286 1730
• Address: Santo Domingo, Dominican Republic

13. Automated AI Processing

We use artificial intelligence (OpenAI gpt-4o-mini) to analyze conversation history when a customer support conversation is resolved. This analysis extracts tour interests, client intent, detected language, sentiment, unanswered questions, and produces a summarized client profile. The purpose of this processing is solely to improve the quality of future service interactions with returning clients.

AI-generated summaries are stored in our internal CRM system (Frappe CRM, hosted at erp.mamajuanatravel.com) under a restricted namespace accessible only to our service team. Personal identifiers — including email addresses, phone numbers, and passport numbers — are automatically redacted from conversation text before the AI analysis is performed and before any summary is stored.

AI conversation summaries are automatically deleted after 6 months from the date of generation. They are not shared with third parties, used for advertising profiling, or transferred outside our CRM system.

Legal basis: Legitimate interest (GDPR Art. 6(1)(f) / Dominican Republic Ley 172-13 Art. 5). A Legitimate Interest Assessment (LIA) documenting this processing is available upon request at info@mamajuanatravel.com.

14. Voice Message and Image Processing

When you send a voice message via WhatsApp or any other channel connected to our support system, your audio recording is transcribed using OpenAI's audio transcription service. The resulting text transcription is appended to your conversation record and used to enable our support team to respond accurately to your inquiry. Audio files are processed in-stream and are not stored in our AI processing pipeline beyond the duration of transcription. Original audio files remain in our customer support platform (Chatwoot) as part of your conversation history, subject to standard conversation retention.

When you send images via any supported channel, we use AI vision processing (OpenAI gpt-4o-mini) to generate a plain-text description of the image content. This description is used to assist our support staff in understanding and responding to your message. Image files are not additionally stored or retained in our AI processing pipeline; the original image remains in your Chatwoot conversation record.

Legal basis: Legitimate interest (GDPR Art. 6(1)(f) / Ley 172-13). Voice and image processing is necessary to enable efficient and accurate responses to customer-initiated communications. A Legitimate Interest Assessment is available upon request.

15. Meta Conversions API (CAPI)

When you submit a contact inquiry form or complete a booking on our website, we transmit certain personal data to Meta's Conversions API (CAPI) to measure the effectiveness of our advertising campaigns and to deduplicate conversion events with our Meta Pixel implementation. The data transmitted is limited to hashed identifiers: your email address and phone number are each hashed using the SHA-256 algorithm before transmission. We do not transmit raw (unhashed) personal data to Meta via CAPI.

The hashed data is used only for advertising measurement and event deduplication. We do not use CAPI-transmitted data for any other purpose. Meta's processing of this data is governed by Meta's own Privacy Policy and Data Processing Terms.

CAPI transmission is subject to your cookie consent preferences as managed by our cookie consent banner. If you decline marketing cookies, CAPI transmission for marketing measurement purposes is suppressed. Transmission for fraud prevention and deduplication purposes may continue under legitimate interest.

Legal basis: Consent (where marketing cookies are accepted) / Legitimate interest for deduplication and fraud prevention purposes (GDPR Art. 6(1)(f) / Ley 172-13).

16. AI Knowledge Base (Qdrant Vector Database)

We maintain an AI-powered knowledge base using Qdrant vector database technology, hosted on our infrastructure (Easypanel VPS). This knowledge base contains tour information, frequently asked questions, and approved Q&A pairs derived from anonymized and team-reviewed conversation summaries. It is used to power our AI assistant (Ballon AI) when responding to customer inquiries via chat.

Vector embeddings stored in Qdrant are derived from FAQ content approved by our team. Raw conversation transcripts are not stored in the vector database. Only structured Q&A pairs that have been reviewed and approved by a team member are indexed. These approved entries do not contain personal data in identifiable form.

FAQ entries are retained in the knowledge base indefinitely as they represent business knowledge and may be updated or removed at our discretion. If an approved entry is found to contain personal data following a data subject erasure request, it will be removed within 30 days of a verified request.

17. Multi-brand Architecture

Mamajuana Travel is part of a portfolio of travel brands. Our data infrastructure is designed to support multiple brands within a shared technical platform while maintaining strict brand-level data isolation. Personal data collected under the Mamajuana Travel brand is not shared with, or made accessible to, other brands in the portfolio unless you explicitly engage with those brands and are informed of such sharing at the time of collection. Each brand maintains separate data namespaces, ensuring that your Mamajuana Travel data is processed solely in the context of your relationship with Mamajuana Travel.