Privacy policy

This policy explains, in plain English, what Bagsage does with your data. It covers our obligations under the EU General Data Protection Regulation (GDPR) and the Brazilian Lei Geral de Proteção de Dados (LGPD).

Who runs Bagsage

Bagsage is operated by Atlaspass.app. You can reach us at contact@atlaspass.app or through our contact page. For anything in this policy — questions, corrections, requests — that is the right channel.

What we collect

• Your account: the email address you sign up with, and a password (stored hashed by our auth provider, never in plain text).
• Your trips: destination, number of days, climate, trip type, luggage, and any special notes you write.
• Your packing lists: the lists generated for each bag, including your edits and what you've checked as packed.
• Basic technical logs: minimal request logs (timestamps, coarse error information) used to keep the service running and safe.

We do not collect location, contacts, device identifiers beyond what your browser sends, or analytics events.

AI processing

To build your packing list, Bagsage sends your trip details (destination, days, climate, trip type, luggage, and any notes) to an AI provider (currently the Lovable AI Gateway, using Google Gemini). This transfer is essential to the service — without it, we cannot generate the list you asked for. The AI provider does not receive your email or account identifier.

Why we process it (legal bases)

• To provide the service you signed up for — GDPR Art. 6(1)(b), LGPD Art. 7, V. This covers your account, trips, lists, and the AI generation step.
• Legitimate interest in keeping the service safe — GDPR Art. 6(1)(f), LGPD Art. 7, IX. This covers minimal logs and rate-limiting to prevent abuse.

What we don't do

We do not sell your data. We do not use it for advertising. We do not run analytics or tracking. We do not share your data with anyone except the infrastructure providers listed below, and only as needed to run the service.

Who processes data on our behalf

• Hosting & database: our backend provider stores your account and bags securely, with encryption in transit and at rest.
• AI provider: processes only the trip details you provide to generate your list, as described above.

Retention

We keep your account and bags for as long as your account exists. When you delete your account (from the in-app settings, or by writing to us), we erase your account, all bags, and all associated data. Aggregated logs containing no personal data may be kept for a short period for reliability.

Your rights

Under GDPR and LGPD you have the right to:

• Access — ask us what data we hold about you.
• Correction — ask us to fix inaccurate data.
• Deletion — delete your account from settings, or ask us to erase your data.
• Portability — receive a copy of your data in a machine-readable format.
• Objection — object to processing based on our legitimate interest.

To exercise any of these rights, use the contact page. We respond within a reasonable timeframe (30 days at most).

International data processing

Bagsage serves travelers in Europe, Brazil and elsewhere. Your data may be processed on servers located outside your country, including in the European Union, the United States, or Brazil, depending on where our providers operate. When data is transferred outside the EU or Brazil, we rely on standard contractual clauses or equivalent safeguards.

Cookies

Bagsage uses only essential cookies to keep you signed in. See our cookie policy.

Changes to this policy

When we change this policy meaningfully, we update the "last updated" date at the top and, for material changes, notify signed-in users.