Last updated: October 8, 2026

This Privacy Policy describes how EL VIAJERO HOSTELS S.A.S. ("we" or "our"), the company responsible for the Viajero mobile application ("the App") available on Google Play and the App Store, collects, uses, shares, and protects information from its users ("you").

By installing, registering, or using the App, you agree to the practices described in this Policy and authorize the processing of your personal data for the purposes stated here. If you do not agree, please do not use the App.

1. Data Controller

The controller responsible for your personal data is:

Legal name: EL VIAJERO HOSTELS S.A.S.

NIT (tax ID): 900375454-4

Address: Carrera 3 # 20-35, Bogotá, Colombia

Privacy email: marketing@viajerohostels.com

2. Information We Collect

2.1 Information You Provide

Account data: email address and password (encrypted) at sign-up. If you sign in with Apple or Google, we receive your email address and name from that provider (Apple lets you hide your real email).

Profile information: display name, profile picture (avatar), date of birth, gender, country, languages, interests, and travel style.

Chat messages: text messages and photos you send in conversations with other users.

Precise location: only when you choose to share it in a chat. We do not collect your location at any other time.

Reservations: hostel booking data (name, email, phone, dates, guests, and preferences) you provide to manage stays through our provider Cloudbeds.

Support and communications: content you send when contacting support, chatting with our assistant Kyto, or reporting other users or content.

2.2 Information Collected Automatically

User ID: an internal identifier linked to your account.

Notification token: the device's push notification token (Expo, FCM/APNs), along with device model and operating system.

Diagnostic data: technical logs, errors, and crashes, used to improve stability and performance.

2.3 Device Permissions

We only request permissions when needed for specific functionality. You can always deny or revoke them from your operating system settings.

Permission — What we use it for — Required?

CAMERA — Take photos to send in chat messages within the App. Photos are processed on your device, and only if you decide to send them are they uploaded to our servers (Supabase Storage) for delivery to the recipient. — No. Only requested when you tap the camera button inside a chat.

READ_EXTERNAL_STORAGE / WRITE_EXTERNAL_STORAGE / Photo Library — Pick existing photos to use as a profile picture or send in chats. Selected images are uploaded to our storage only when you send them. — No. Only requested when uploading a profile photo or attaching an image in a chat.

ACCESS_COARSE_LOCATION / ACCESS_FINE_LOCATION — Share your current location in a conversation when you explicitly tap "Share location". We do not track location in the background. — No. Only used when you manually share location.

INTERNET — Connect to our services to sync data. — Yes.

VIBRATE — Notify you of new interactions (messages, events) with vibration. — No.

Push notifications — Inform you about new messages, events, and reservation updates. — No. You can disable them at any time.

3. How We Use Your Information

Create and manage your account and user profile.

Allow sending and receiving of messages and content (photos, location) between users.

Display your profile, events, and contributions to the traveler community.

Manage accommodation bookings and payments through our providers.

Manage your participation in the points program.

Answer your questions through support and the Kyto assistant.

Send operational notifications (new messages, confirmations, events) and, only with your consent, promotional notifications.

Moderate content and detect and prevent fraud, abuse, spam, and violations of our Terms of Use.

Improve performance, security, and overall App experience.

Comply with applicable legal, accounting, and tax obligations.

4. Content Moderation

To keep the community safe, messages and profiles go through an automatic offensive-language filter. In addition, reports submitted by users are reviewed by the Viajero team, which may take action such as removing content or suspending accounts.

Reported content and report data (who reported, who or what was reported, the reason, and the date) are used solely to review the case, enforce the Terms of Use, and protect users.

5. Promotional Communications

We will only send you promotional push notifications if you expressly opt in, either on the "Before you start" screen or in Profile > Notifications. You can withdraw this consent at any time from Profile > Notifications or from your device settings. Operational notifications (for example, new messages or booking confirmations) are not promotional.

6. Third Parties That Receive Data

We do not sell your personal data. We share information with the following providers, which help us operate the App under confidentiality and security obligations:

Provider — Purpose — Data

Supabase — Database, authentication, and file storage — Account, profile, messages, photos

Cloudbeds — Hostel reservations — Name, email, phone, dates

MercadoPago — Payments — Payment data (not stored by Viajero)

AKIN — Points program — Email, name, stays

Botpress (Kyto) — Support chat — Messages sent to Kyto

Expo, Apple (APNs), and Google (FCM) — Push notifications — Device token

Apple and Google — Sign-in — Email, name

Vercel — Website and links — Technical access data

We also share information in these cases:

With other users: your name, profile photo, country, interests, and public contributions (messages in chats you participate in, event attendance) are visible to users you interact with.

For legal reasons: when required by law, to comply with a court order, or to protect the rights, property, or safety of EL VIAJERO HOSTELS S.A.S., our users, or the public.

In business transfers: in the event of a merger, acquisition, or sale of assets, always with equivalent privacy commitments.

7. International Transfers

The App's database, authentication and files are hosted by Supabase on servers in the United States (us-west-2 region, Oregon). Other providers also have servers outside Colombia, so your data may be transferred to and processed in those countries. By using the App, you authorize these transfers. We choose providers that offer adequate levels of protection and take reasonable measures to protect your data during these transfers.

8. Security

We implement reasonable technical and organizational measures to protect your data: encryption in transit (HTTPS/TLS), encryption at rest in the database, secure authentication, policy-based access control (Row Level Security), and error monitoring. However, no method of internet transmission or electronic storage is 100% secure.

9. Data Retention and Deletion

We keep your data while your account is active. When you delete your account:

9.1 What is deleted

Your account and sign-in data.

Your profile and photos.

Your messages.

The push notification tokens of your devices.

9.2 What is kept and for how long

Reservations and payment records: kept to meet accounting and tax obligations, for up to 10 years under Colombian commercial law (Commercial Code, art. 60).

Reports and moderation records: may be kept as long as necessary for community safety and abuse prevention.

Technical logs: up to 90 days, unless longer retention is required for security reasons.

Learn more about how to delete your account at https://viajero-legal.vercel.app/eliminar-cuenta.

10. Your Rights (Law 1581 of 2012)

Under Colombian Law 1581 of 2012 and Decree 1377 of 2013, as the data subject you have the right to:

Know (access) the personal data we hold about you.

Update and correct your data when it is inaccurate, incomplete, or outdated.

Request deletion of your data when legal principles, rights, and guarantees are not respected.

Revoke the authorization you granted for the processing of your data.

Request proof of the authorization you granted for processing.

Be informed about how your data has been used.

File complaints with the Superintendence of Industry and Commerce (SIC) for violations of data protection law.

10.1 How to exercise your rights

Send an email to marketing@viajerohostels.com stating your name, your account email, and your request. Inquiries (consultas) are answered within 10 business days and claims (reclamos) within 15 business days of receipt, as provided by Law 1581 of 2012.

10.2 Users in other jurisdictions

If you are in another jurisdiction (for example, under the GDPR in Europe or the CCPA in California), you have equivalent rights, including data portability and objection to processing, which you can exercise through the same channel.

11. Account Deletion

You can delete your account in the App under Profile > Delete account, or by following the instructions at https://viajero-legal.vercel.app/eliminar-cuenta. You can also email us at marketing@viajerohostels.com. Deletion is irreversible. Section 9 details which data is deleted and which is kept due to legal obligations.

12. Children's Privacy

Viajero is not directed at persons under 18 years of age. We do not knowingly collect data from children under 18. If we discover we have collected data from a minor without valid consent from their parents or guardians, we will delete it as soon as possible. If you believe a minor has sent us information, please contact us.

13. Cookies and Similar Technologies

The mobile App uses secure local storage (AsyncStorage) to maintain session and preferences. We do not use advertising tracking cookies.

14. Changes to This Policy

We may update this Privacy Policy periodically. We will publish the updated version on this page and, when changes are material, we will notify you within the App or by email. The "Last updated" date indicates the current version.

15. Contact

If you have questions about this Policy or how we handle your data:

Controller: EL VIAJERO HOSTELS S.A.S.

NIT (tax ID): 900375454-4

Address: Carrera 3 # 20-35, Bogotá, Colombia

Email: marketing@viajerohostels.com