1. Data controller
Rapa Nui Link SpA, based in Miru S/N, Hanga Roa, Isla de Pascua, Chile, is the controller of the personal data we collect through rapanuilink.com. You can contact us at: rapanuilink@gmail.com
2. Data we collect
Depending on how you use the platform, we may collect the following data:
- Account data: name, email address and profile photo, obtained when signing in with Google.
- Booking data: date and time of the chosen tour, group size and messages exchanged with the guide.
- Calendar data (guides only): access to the guide's Google Calendar events to sync availability and create booking events. This access is voluntary and can be revoked at any time.
- Technical data: IP address, browser type, pages visited and session duration, automatically collected by Firebase.
3. How we use your data
We use the data exclusively to:
- Manage your account and authenticate you securely.
- Process and confirm bookings between travelers and guides.
- Sync the guide's availability with their Google Calendar and create blocking events when a booking is confirmed.
- Send you confirmations, QR codes and notifications related to your booking.
- Improve the service and detect technical issues.
4. Legal basis
- Performance of a contract: to process bookings and manage your account.
- Explicit consent: for access to the guide's Google Calendar (granted in the OAuth linking flow).
- Legitimate interest: for the technical analysis that improves platform stability.
5. Sharing data with third parties
We do not sell or transfer your personal data to third parties for commercial purposes. The data may be processed by:
- Google Firebase / Google Cloud: authentication, database and storage infrastructure (servers in the United States, subject to Google's Data Processing Agreement).
- Google Calendar API: only when the guide voluntarily links their calendar.
All providers are subject to contractual confidentiality and security obligations.
6. International transfers
The data is stored on Google Cloud servers primarily located in the United States. Google complies with the standard contractual clauses approved by the European Commission and applies equivalent technical measures to protect users' data in Chile in accordance with Law No. 19,628 on the Protection of Privacy.
7. Data retention
- Account data is kept while the account is active.
- Booking data is retained for 3 years for accounting and legal obligations.
- Google Calendar access tokens are deleted when the guide unlinks their calendar.
- Technical logs are automatically deleted after 90 days.
8. Your rights
You may exercise the following rights at any time by writing to us at rapanuilink@gmail.com:
- Access: obtain a copy of your personal data.
- Rectification: correct inaccurate or incomplete data.
- Erasure: request the deletion of your account and data.
- Portability: receive your data in a structured format.
- Withdrawal of consent: withdraw access to Google Calendar from the guide panel at any time, without affecting the lawfulness of prior processing.
We will respond to your request within a maximum of 30 business days.
9. Security
We apply appropriate technical and organizational measures: OAuth 2.0 token authentication, in-transit encryption (HTTPS/TLS), restricted production access and regular security reviews. However, no system is completely foolproof.
10. Use by minors
The platform is not directed to children under 13. We do not knowingly collect data from minors. If you detect that a minor has provided data without parental consent, contact us to delete it.
11. Changes to this policy
We may update this policy when necessary. Significant changes will be notified by email or via a visible notice on the platform. The "last updated" date at the top of the document will indicate the version in force.
12. Contact
For any privacy queries, write to us at rapanuilink@gmail.com. We will do our best to reply in less than 48 hours.