Privacy policy

Who we are

This portal is maintained by Riotur, a tourism company in the city of Rio de Janeiro. The Riotur is the controller of personal data processed here under the General Data Protection Act (LGPD, Law 13.709/2018).

This policy explains, in simple language, what data the portal deals with, why it deals with them, with whom it shares them and what their rights are.

About this text and translations

Each version of this text has a number and a date of validity, indicated at the end of the page. When the text changes, the new version becomes valid and each authorization already given remains registered with the version that was in force.

The original text is in Portuguese. Versions in other languages are automatically translated from Portuguese, can be reviewed by the team and may contain inaccuracies. In case of divergence, the text is valid in Portuguese. Languages that do not yet have their own version of this text lead to the English version.

Data we handle

Sailing through the portal doesn't require an account. The data processed depends on what you do:

• Visitor registration: full name, email, WhatsApp, date of birth, country, state, city, password (protected only as cryptographic summary, never in open text), preferred language, accessibility preferences, registration origin (e-mail or Google), type of device and last-access dates. The bill requires 18 years or more.
• Login with Google: If you choose this option, we receive from Google the account identifier, email (if checked), name and language. We only ask for the basic scopes of identification; we do not access your Gmail, contacts, Drive or other Google data.
• Login session: session code summary, IP address, browser, device and dates. The session lasts 30 days.
• Account usage: bookmarks, scripts (dates, informed hosting, stops and notes), events followed and reminders, notice preferences and account browsing history, which you can pause.
• Quiz of suggestions: without account, nothing is recorded; the answers are calculated and returned. If you, logged in, ask to save the result in the bookmarks, it is recorded in your account.
• Sending events and establishments: requires account. We treat the sending data, the contact of the responsible person (name, email and phone), the images sent with credit and right statement, and the history of versions and decisions of the team, including messages to the author.
• Newsletter: email, language, selected news categories, date and version of the authorization. Registration is confirmed by email and the cancellation link does not expire.
• Emails sent through the portal: destination address, template, language and shipping status.
• Browser warnings (Web Push): the technical address of the registration provided by the browser, encryption keys, browser, device label and language.
• Site search: the terms sought without result are counted per day and language, without identifying the person.
• Authorizations: purpose, decision, text version, origin, IP address, browser and date. They're connected to it.
• Access records: the server registers, by request, time, IP address, accessed address, result and browser, for security and operation reasons.
• Audit trail: registration of who did what and when, for the actions of logged visitors and the team, with IP address and browser.

What we use the data for and on what legal basis

Each purpose is based on a legal basis of LGPD (art. 7o):

• Create and maintain your account, and allow bookmarks, scripts, submissions and notices you ask for: running the service you requested when creating the account.
• Terms of use and privacy policy in the registration: the acceptance is registered to prove that you have read the texts.
• Newsletter, email communication and WhatsApp, browser notices, audience measurement cookies and third party videos and albums: consent, which you can revoke at any time.
• Analysis and publication of events and establishments sent: execution of the service you requested and tourist dissemination activity of Riotur.
• Security, fraud prevention, access records and audit trail: legitimate interest of Riotur in protecting the portal and users, and compliance with legal obligations when there is.
• Portal usage and improvement statistics: aggregated data, without identifying people, and audience measurement only with your consent.
• Accept requests from the holder, authorities and exercise rights in proceedings: compliance with legal obligation and regular exercise of rights.

Commitments

Each authorization is separate, registered with date, origin and version of the text, and can be changed at any time:

• Terms of use and privacy policy: Accept required to create the account.
• Communication by e-mail and WhatsApp: optional and unmarked on registration.
• Warnings by email and browser: authorized by type of notice, in your account.
• Newsletter: registration by the news form, with the email informed.
• Audience measurement cookies: only after your acceptance in the cookie notice.
• YouTube videos and Flickr albums: offline until your permission.

Cookies and storage in your browser

The portal does not use advertising cookies or its own measurement cookie. When you log in, we use cookies required for operation: one session (inaccessible to scripts, 30 days) and one protection against misuse of the session by another site (30 days). The team also uses panel session cookies and, to view drafts, a cookie that lasts up to 15 minutes.

Your decision on cookies is only stored in your browser with the date. The portal does not create random identifier for you and does not send that decision to the server. The chosen accessibility options, the sound preference of the opening of the home page and, during the visit, the status of the audio and the pending action until the login is over are also left in the browser.

Audience measurement (Google Tag Manager and Google Analytics) is only loaded after your acceptance; before that, no requests are made. We send route, content type, language, category, neighborhood and performance metrics, without person identifier. The cookies Google defines (e.g. ga) are his, not the portal.

To review or revoke the decision, use "Cookie Preferences" at the bottom of any page. The new decision goes from there.

Third party services

To function, the portal uses the services below. Each one processes the data according to the policy itself:

• Hosting and infrastructure: virtual servers running the system, database, queues and files.
• Content delivery (CDN): when used, it receives visitors traffic (IP address and pages accessed).
• Email sending: confirmations, notices and newsletter, with protected connection.
• Google: login with Google when you choose this option; audience measurement (Tag Manager and Analytics), only with your accepted; Search Console, which receives only public addresses of the site.
• YouTube (Google) and Flickr (SmugMug): videos and albums appear first as an image delivered by the portal itself. The browser only contacts these services after your permission and click on the player; from there they can use their own cookies.
• OpenStreetMap: Maps of places and neighborhoods ask for map frames to OpenStreetMap when the map is displayed. OpenStreetMap sees your IP address and region shown, and this order does not go through the cookie notice.
• VLibras (federal government): the translation feature for Libras is loaded on every visit, without warning of cookies, because it is accessibility feature. The portal blocks the optional feature telemetry.
• Browser notification services (Google, Mozilla and Apple): receive the encrypted notice when you authorize browser warnings.
• Automatic translation: runs within the portal's own infrastructure (LibreTranslate), without sending texts to third parties. It translates editorial content, not personal data.
• Fonts: are from the portal itself; no external source service is used.

International sharing and transfer

We don't sell personal data. The data is shared only with the providers listed above, to the extent necessary for the service, and with authorities when required by the law.

Some providers (such as Google, YouTube, Flickr, OpenStreetMap, content delivery network, and browser notification services) can handle data on servers outside Brazil. In such cases, the transfer is based on the guarantees provided by the LGPD, such as its specific consent or appropriate contractual clauses.

Published events and establishments remain in the air, without connection to your account, even if you delete the account afterwards; what you wrote in the published text, including contact details, remains visible until the team withdraws it.

How long do we keep the data

The deadlines below are those set today on the system and can be adjusted by Riotur, with notice on this page:

• Unused account for 730 days receives a notice 30 days before and, if not used, is excluded. A new access resets the countdown.
• The account browsing history is deleted after 180 days.
• When you ask to delete the account, it is completed after a grace of up to 15 days, in which the order can be cancelled. After that, we remove sessions, bookmarks, scripts, history, notice registrations, preferences, newsletter and emails already sent, and anonymize what needs to be kept for statistics.
• Authorizations given shall be kept as evidence, without personal ties after the account has been deleted.
• The link to download the copy of your data expires in 48 hours.
• The server access records are for about 30 days. The audit trail is not changed and is discarded per month after long term.
• Registration in the newsletter is valid until cancellation.

How We Protect Data

We use protected connection (HTTPS), passwords saved only as a cryptographic summary, sessions that close when changing the password, access control by profile in the team, e-mail masked in the internal lists, and registration of opening accounts. No system is completely immune to failure; if there is an incident that could cause a relevant risk, we will communicate you and the competent authority, as the law determines.

Your rights

LGPD (Art. 18) guarantees the holder: confirmation that there is processing; access to data; correction of incomplete, inaccurate or outdated data; anonymization, blocking or deletion of unnecessary, excessive or processed data in disagreement with the law; portability; deletion of data processed with consent; information about who the data is shared with; information about the possibility of not consenting and its consequences; and revocation of consent.

In the "My Account" area you correct your data, download a copy of them (in JSON and PDF file), change each authorization, disable or reactivate the account and ask for deletion. For those who only signed the newsletter or only decided on cookies, the cancellation is in the emails and in "Cookie Preferences".

For the other requests, please contact the Riotur service channel indicated on the portal. We'll respond on time. You can also complain to the National Data Protection Authority (ANPD).

Children and adolescents

The visitor account is intended for people aged 18 years or older. Portal navigation, without account, does not collect registration data.

Changes to this policy

We can update this policy. The current version and date appear at the end of this page, and relevant changes will be informed on the portal.

Version 2026-10, in force since 21/10/2026.