Global compliance with China PIPL, Saudi Arabia PDPL (SDAIA), European GDPR, and Brazilian LGPD.
Request data export, correction, or permanent erasure under China PIPL (Arts. 44-47), Saudi SDAIA (Art. 5), GDPR (Art. 17), or LGPD (Art. 18).
The data controller is Rodrigo José (Lead Architect, karavans.guide). For all inquiries, data protection matters, or to contact the Data Protection Officer (DPO), email rodrigojcunha@gmail.com. We operate under strict accountability and compliance standards.
Accessing the platform requires zero registration. We do not collect national IDs, financial account numbers, or profiling histories. We only process: (a) anonymous aggregated traffic metrics with prior consent, (b) voluntary messages submitted through the contact form, and (c) browser push notification tokens when explicitly opted in.
In accordance with the Personal Data Protection Law (enacted by Royal Decree No. M/19 and amended by Royal Decree No. M/148) and its Implementing Regulations issued by the Saudi Data & AI Authority (SDAIA): (a) residents in the Kingdom have the right to be informed, right of access, right to request correction/updating, and right to request destruction of their personal data; (b) direct marketing requires explicit prior consent; (c) official statutory response to data subject requests is guaranteed within 30 days.
Under Regulation (EU) 2016/679: Users in the European Economic Area have the right to access (Art. 15), rectification (Art. 16), erasure / Right to be Forgotten (Art. 17), restriction (Art. 18), data portability (Art. 20), and objection (Art. 21). Lawful processing relies on explicit consent (Art. 6.1.a) or legitimate interests for platform integrity (Art. 6.1.f).
Pursuant to Brazilian Federal Law No. 13.709/2018 (Lei Geral de Proteção de Dados - LGPD) and National Data Protection Authority (ANPD) directives: Brazilian users hold all rights specified in Article 18, including confirmation of processing, access to data, correction of incomplete or outdated data, anonymization, blocking, deletion, and consent revocation at any time.
We deploy Google Consent Mode v2 with default denied states. Only strictly necessary operational cookies and client-side preferences (such as theme and accessibility font scale) are active prior to explicit choice. Telemetry cookies are deployed only after opt-in and can be revoked at any time.
Platform hosting is served across resilient edge cloud distribution networks and enterprise relational cloud databases with active Row-Level Security. Data in transit is protected using TLS 1.3 encryption, and connections to external aviation and hospitality telemetry feeds are secured with mutual integrity controls.
Inquiry messages submitted via contact forms are retained for a maximum of 12 months for correspondence purposes, after which they are permanently destroyed unless legal retention is required. Push tokens are purged immediately upon subscription unsubscribe or endpoint failure.
In accordance with the Personal Information Protection Law of the PRC (PIPL) and regulatory guidance from the Cyberspace Administration of China (CAC): (a) Individuals within China possess the rights to know and decide regarding the processing of their personal information, and may restrict or refuse data processing (Article 44); (b) Individuals hold the rights to access and obtain copies of their data (Article 45), as well as data portability rights; (c) Individuals have the right to request correction or completion of inaccurate data (Article 46) and complete erasure (Article 47); (d) Karavans strictly adheres to data minimization and purpose limitation, refrains from unauthorized cross-border transfers, and provides streamlined DSAR processing within statutory timeframes.
