Privacy notice

1. Who is responsible for your data

The hotel operator is responsible for the personal data processed in connection with this website and your enquiries:

AIOLOS HOTEL & DISCOVERIES LTDA
CNPJ: 47.637.922/0001-78
Rua das Dunas, s/n · Vila Preá
CEP 62.595-000 · Cruz – Ceará · Brazil

For privacy enquiries, contact Aiolos Hotel Reception at admaioloshotel@gmail.com.
Telephone / WhatsApp: +55 88 98215-5941.

2. Website access and hosting

To deliver and protect a website, its hosting provider may process technical connection data, such as your IP address, access date and time, requested page and browser information.

This private preview is hosted on OpenAI Sites. Hosting for the final website has been ordered from cyon, but the technical setup is not yet complete.

[Before publication: confirm the actual processing and backup locations, data logged, deletion periods and applicable agreements with cyon.]

3. Enquiries about stays, transfers and day trips

We use the information you send us, such as travel dates, guest numbers, preferred accommodation, journey details, flight information and your message, to respond to your enquiry and plan the requested service. If you are travelling with children, you may provide their ages so we can suggest suitable accommodation.

The forms prepare a message in your browser. They do not automatically send the information to the hotel or store it in a website database. In this version, the form entries are not saved permanently in cookies or browser storage either.

Selecting “Open in WhatsApp” passes the prepared text to WhatsApp. The hotel receives your message only when you send it there.

4. Guest administration and identification documents

We use Desbravador as a cloud service for internal guest administration. Existing PDF copies of identification documents are stored in Microsoft OneDrive through a personal Microsoft account. According to the hotel, reception staff have access. Desbravador is not integrated with this website as a booking system.

The new internal policy does not provide for routinely keeping complete identification copies on a permanent basis. A copy should be retained only after a specific legal or operational need and a valid legal basis have been checked and recorded. A general possibility of a future police enquiry is not sufficient justification. Where retention is necessary and permitted, the provisional internal maximum is twelve months after check-out, subject to overriding obligations. Copies must be deleted sooner if the need ends earlier.

This policy replaces the earlier general statement that identification copies are deleted after one year. It does not confirm that existing files have already been reviewed or that automatic deletion has been configured.

[Before final approval: verify processing locations, provider agreements, access permissions and deletion procedures in Desbravador Cloud and the personal OneDrive account. Assess mandatory guest registration separately from complete identification copies.]

See the Microsoft Privacy Statement. The terms and safeguards applicable to the personal account actually used still need to be checked.

5. WhatsApp and email

We use WhatsApp Business to communicate with guests. Using it is optional; you can also contact us by email. On WhatsApp, we receive your phone number, possibly your profile name, and the content you send. WhatsApp also processes data under its own policies.

Our contact mailbox uses Google’s Gmail service. We use your email address, message and any information you include to respond to your enquiry. If further details are needed to confirm a booking, we will discuss them with you.

See the WhatsApp Privacy Policy and the Google Privacy Policy.

6. Booking.com, social media and maps

Booking.com, Instagram, Facebook and map services are provided as external links. We do not automatically load booking widgets, social media feeds or maps when you visit a page.

Following one of these links takes you away from our website. The relevant service then processes information under its own terms. If you book through Booking.com, we receive the details needed to manage your reservation.

The rating and review selection displayed on the website are a dated snapshot stored with the site. Reading them does not create a live connection to Booking.com. See the Booking.com Privacy Statement.

7. YouTube film

The film’s cover image is stored with the website. The YouTube player loads only after your explicit choice. In a preview opened as a local file, that choice opens YouTube directly.

Loading the player may send your IP address, device information and usage data to Google / YouTube. Data may be processed outside Brazil, including in the United States. The enhanced privacy mode does not mean anonymous use or that no data is processed.

You can close the film to remove the player. This does not undo data already sent. See the Google Privacy Policy.

8. Cookies, fonts and analytics

This version does not include an online shop, customer accounts or a newsletter service. The hotel has not added analytics or advertising tracking. Fonts and images are served with the website, without connections to external font servers.

External services you choose to open may use cookies or similar technologies. Before the final website is published, the hosting, security and video arrangements will be checked so the notice reflects the technologies actually used.

9. Purposes, legal bases and recipients

We use data to answer enquiries, take steps you request before entering into a contract, provide agreed services and meet applicable legal obligations. Optional features, such as the embedded film, may rely on consent.

[Before finalising this notice: confirm the LGPD legal basis for each purpose and assess whether any other data protection laws apply.]

The hotel reports that it does not share guest data with drivers or partners providing day trips or kite services. This is separate from processing by the technology providers mentioned here and disclosures required by law to competent authorities.

[Confirm provider roles, access rights and mandatory recipients.]

10. International processing and retention

WhatsApp Business, Gmail, Microsoft OneDrive, Desbravador Cloud, YouTube and Booking.com may process personal data in different locations. The countries and transfer arrangements applicable to the accounts actually used still need to be checked. [Document processing locations, provider roles and any required safeguards before final approval.]

Aiolos has adopted the following internal retention and deletion rules as its working basis. These periods are not statutory requirements or minimum retention periods. They do not justify keeping data without an ongoing purpose and a valid legal basis. Earlier deletion or anonymisation remains necessary where applicable.

Identification copies: as a rule, no permanent storage without a specific, previously checked need. Where retention is necessary and permitted, the provisional internal maximum is twelve months after check-out, subject to overriding obligations.

Booking enquiries that do not result in a reservation: an internal maximum of twelve months after the last contact.

General guest correspondence by email: an internal maximum of 24 months after check-out. Enquiries that do not result in a reservation follow the separate enquiry rule above.

WhatsApp conversations: an internal maximum of twelve months after check-out or, where there was no stay, after the last contact.

Working copies and operational guest lists: an internal maximum of 30 days after check-out. This concerns temporary working material, not original supporting documents or official guest registrations that must be retained.

Backups: the intended rolling retention window is generally 90 days, where technically feasible. The actual settings and deletion capabilities have not yet been confirmed. This is not a guarantee that data is already removed from every backup after 90 days.

Mandatory guest registrations, invoices and payment records: retention follows the Brazilian rules actually applicable to each record. No single internal period is presented as a statutory retention requirement for these records.

Mandatory registrations, particularly FNRH Digital, are separate from the hotel's copies. Our internal periods do not determine government retention. Registration duties and specific retention obligations remain applicable; the reporting process actually used still needs to be documented.

Legal obligations and a specific need to preserve data for an ongoing complaint or dispute take precedence over the internal periods. Any exception must be limited to the necessary data, with its reason, legal basis and review date recorded. Once the reason ends, the need for continued retention must be reassessed.

The policy provides for a monthly review and a record of deletion. This does not postpone deletion that is already due. Technical procedures in Desbravador, WhatsApp, OneDrive and backup systems remain unverified. Recycle bins, version history, local copies and restoration must be considered; previously deleted data should not return to active use without appropriate controls after restoration.

These periods describe the adopted internal policy, not verified technical implementation. This draft does not guarantee automatic deletion, complete removal by service providers or a completed review of existing files.

11. Your rights

Subject to applicable law, you may request confirmation and access to your data, correction, information about sharing, anonymisation, blocking or deletion where appropriate. You may also request portability under the applicable conditions and withdraw consent for future processing.

Send your request to admaioloshotel@gmail.com. We may need proportionate proof of identity to protect your information. We will consider applicable obligations and the requirements for each right.

You may also contact Brazil’s National Data Protection Authority — ANPD or another competent supervisory authority.