Privacy Policy

The controller is the Menina da Serra pousada operation, located in Distrito de Camisão, Aquidauana — MS, Brazil (Estrada do Mirante, 3 km).

Privacy and data-subject requests: reservas@meninadaserra.com.br · WhatsApp +55 67 99930-4767 · meninadaserra.com.br.

This Policy applies to meninadaserra.com.br and subdomains under our control, the virtual assistant (“Nina”), booking and contact pages, and personal data collected in digital interactions related to stays, experiences and service communications.

It does not cover third-party sites we link to (WhatsApp, social networks, maps, future payment gateways), which have their own policies.

We process only what is needed for stated purposes. Categories may include:

• Identity and contact: name, email, phone/WhatsApp, language preference.
• Booking and stay: dates, room, guest count, meal preferences, operational notes and request status.
• Communications: chat, forms or support messages.
• Technical data: IP address, device/browser, pages viewed, timestamps, session IDs and cookies (per your choices).
• Admin authentication data for the internal panel (not exposed publicly).

We do not routinely request sensitive data. If you send it voluntarily, processing is limited to handling your request.

We process personal data only with an adequate legal basis under the LGPD, including:

• Contract and pre-contractual steps — quotes, bookings and stay support.
• Legal obligations — tax/accounting records and lawful authority requests.
• Legitimate interests — site security, abuse prevention, service improvement and operational messages about your request, with minimization.
• Consent — non-essential cookies, optional marketing and other cases requiring free, informed and unambiguous opt-in.

We use cookies and local storage for core site functions, language preference, session security and, only with consent, optional categories (functionality, analytics, marketing).

You may accept, reject non-essential cookies or customize categories in the consent banner. Essential features remain available. See our Cookie Policy for details.

We do not sell personal data. We may share data with processors strictly as needed under confidentiality and LGPD, such as:

• Hosting and edge delivery providers.
• Application database and auth infrastructure.
• Messaging providers (WhatsApp/Meta, email) when you contact us there.
• Language models when the assistant uses AI processing — limited to answering pousada questions, with guardrails.
• Public authorities when legally required.

Some providers may process data outside Brazil. We apply LGPD-compatible safeguards (contractual clauses, vendor review, minimization) where applicable.

We keep data only as long as needed for purposes and legal duties. Booking requests and communications may be retained for operational and accounting periods. Technical logs and cookie consent records may be kept for security and accountability.

After that, we delete or anonymize data, except where retention is legally required.

We apply reasonable technical and organizational measures: admin access control, HTTPS, environment separation, least privilege and secure development practices.

No system is fully immune. Relevant incidents will be assessed for notice to individuals and ANPD as required.

Under the LGPD you may request confirmation of processing, access, correction, anonymization/blocking/deletion where applicable, portability within legal limits, information on sharing, withdrawal of consent, and objection in eligible cases.

Use the channels in section 1. We may verify identity and protect third-party data. We respond within a reasonable period under the LGPD.

The site and stays are primarily for adults and young people within the age policy of the pousada. We do not knowingly collect children’s data without guardians. Contact us to delete improper collection.

The chat answers from pousada knowledge (RAG). Messages may be processed to generate replies. Do not send sensitive data, passwords or documents in chat. Prefer official secure channels for bookings and payments.

Links to social networks, WhatsApp and maps are governed by those platforms’ policies.

Availability, prices and experiences may change; simulation flows are not a final charge until confirmed by the pousada. We are not liable for misuse, force majeure, or third-party failures beyond reasonable control. Consumer and statutory rights remain intact.

We may update this Policy for legal, technical or operational reasons. Material changes may be highlighted or require new consent when mandatory.

Governed by the laws of Brazil. Venue: Aquidauana/MS, except consumer forum when mandatory by law.