Privacy policy

In short

The guide does not require a user account. It loads Google AdSense ad code and, only with your consent, Google Analytics, to measure visits. Places saved in "My trip" stay in your browser. We use Stadia Maps to display maps. We also maintain the waitlist service to manage existing subscriptions, confirmations and unsubscribe requests. New sign-ups to that waitlist are closed. When the ad code loads, Google receives technical data about your visit. Ads are only requested, and Google Analytics only loads, once you decide: in the European Economic Area, the United Kingdom and Switzerland, through Google's message; in the rest of the world, through our cookie notice.

The "My trip" account is optional: if you sign in with your email, your trip is saved in it so you can get it back on other devices. Below we explain what data it processes and who is involved.

Controller

The data controller is 2LABS Digital Innovation LLC (Wyoming, United States), owner of asesordeviaje.com.

• Owner: 2LABS Digital Innovation LLC (Wyoming, USA)
• Contact email: mail@2labs.app

What data is processed and why

What you store in your browser. "My trip" (the places you mark, the days of the route they come from and the start, end and days you arrange by hand) and your cookie decision are kept in your browser's local storage, under the keys asv:trip, asv:trip-days, asv:trip-route and asv:consent, and stay on your device until you delete them. If you choose a language in the language selector, it is also kept in local storage, under asv:idioma, to open the home page in that language; it stays until you choose another or delete it. The view you choose on the maps (map or list) is kept in session storage, under asv:map-view, and is deleted when you close the tab. They are not cookies: this is storage the features you use need. If you sign in to your "My trip" account, the browser also keeps your session (asv:cuenta: your email, your account identifier and the access credentials, one that expires within an hour and another that renews it while you keep using the account) and the state of the sync with your account (asv:trip-sync: the last version the account confirmed and whether there are changes to upload). In session storage, it also records that your session was checked a moment ago (asv:cuenta-comprobada), so it is not asked on every page. Deleting your account deletes all three; signing out deletes your session and, if your trip is saved in your account, also this browser's trip and its sync state. Without an account, this information is not sent to 2LABS: the site is static and has no server to receive it; with an account, your trip is saved in it, as explained in the section on the "My trip" account. When you share your trip, the list travels inside the link you copy.

Technical server logs. When you open a page, your browser requests files from the server hosting the site, which may log your IP address, the browser you use and the page requested, as any website does, for security and for a limited time.

Maps. When you open a page displaying a map, your browser requests background map images from Stadia Maps. To serve these requests, Stadia receives your IP address and technical request data, such as the requested tile and the reference to our domain used to authorise the service. We do not send it your waitlist email address or tokens. OpenStreetMap/OpenMapTiles map data is credited on the map; this does not mean that the images are downloaded from their public servers.

We use this service to display the guide’s maps. Information about Stadia’s processing, providers and retention periods is available in its privacy policy. Confirmation and unsubscribe pages do not load maps or analytics.

Measuring visits (Google Analytics). We use Google Analytics 4, from Google LLC, to know how many people visit the guide, which pages they read and how they reach them, and so improve it. We use it only with your consent: without it, the Google Analytics tag does not load and nothing is sent to Google. If you accept, the tag loads and sets the _ga and _ga_* cookies to tell visits and sessions apart, and Google receives data about how the guide is used: pages viewed, device type and browser, approximate location and how you arrived and, if you use "Save to My trip", which place you save or remove and on which type of page, with no personal data. We do not use Google Analytics' advertising features. In the European Economic Area, the United Kingdom and Switzerland you decide in Google's message; in the rest of the world, in our cookie notice: "Accept" turns on measurement; "Essentials only" does not. If you withdraw your consent, the tag stops loading on the following pages and, if you withdraw it in our notice, the site deletes its cookies from your browser. You can change your decision with "Manage cookies", at the foot of every page.

Advertising. We show Google AdSense ads. Their code loads when each page opens but does not request ads until you decide. Google AdSense services may use cookies and device identifiers to show ads, limit how often you see one, measure performance and, where your Google settings allow it, personalise them. In the European Economic Area, the United Kingdom and Switzerland you decide in Google's message, which applies your choice to its ads. In the rest of the world you decide in our cookie notice: with "Accept" the ads are shown; with "Essentials only" they are not shown and nothing from Google loads on the following pages. You can change your decision with "Manage cookies", at the foot of every page.

External links. When you follow a link to an operator, GetYourGuide, Sherpa, Google Maps or an official source, you leave this site and that third party's privacy policy applies.

"My trip" account (optional)

You do not need an account to use the guide or "My trip". If you want to get your trip back on another device, you can sign in with your email: we send you a one-time link and code, with no password.

What data we process. Your email address; the internal identifier of your account, created by the account service; your saved trip (the identifiers of the guide's places you choose, the days and the start and end you arrange) and its version; the dates you signed up, last signed in and last saved your trip; and the technical logs of the account service: your IP address, your browser, the time and the result of each sign-in, each save and each check of your session. We do not ask for your name, a password or any other data.

Why. To create and keep your account, send you the link and code to sign in, save your trip in it and give it back to you on your devices, and protect the service against abuse.

Session check. While you are signed in, the guide asks the account service whether your session is still valid: in "My trip", every time you open it; on the other pages, at most once every 5 minutes in each tab. With each check, Supabase receives your IP address, the time and your session identifier. It does not receive which page it is: your browser only sends it the guide's domain. If you sign out, it stops receiving this.

Who processes the data for us. Supabase hosts the database and the account service, with their logs, in the European Union (Frankfurt, Germany); the contract is with Supabase Pte. Ltd. (Singapore), and its support staff and some of its sub-processors may access them from outside the European Union, including from the United States (Supabase, Inc.). Resend (Plus Five Five, Inc., United States) sends the emails with the link and code, and processes that data in the United States. Both act as processors on behalf of 2LABS, under the data processing agreement that is part of their terms of service (GDPR, Art. 28), and neither may use your data for its own purposes. Transfers outside the European Economic Area rely on the European Commission's standard contractual clauses (Commission Implementing Decision (EU) 2021/914) included in those agreements; Resend also participates in the EU-U.S. Data Privacy Framework.

How long. Your account and your trip are kept while the account exists. When you delete it, your account, your sessions and your trip are removed from the database at once. Technical logs are deleted on their own: on the plans we use, Supabase keeps them for 1 day (the sign-in audit log, 1 hour) and Resend keeps each email's data and logs for 30 days. On the plan we use, Supabase does not include project backups; its data processing agreement says it makes daily backups of its own, without publishing how long it keeps them, and when the contract ends it deletes the data and its copies. Your account is not deleted on its own for not being used: it is kept until you delete it, from "My trip", or ask us to. If we later delete inactive accounts, we will email you first and say so here.

Security of your session. Your session is kept in this browser (asv:cuenta) and does not expire on its own while you use it. Any program running on the page can read it: the most likely case is not a virus, but one of the third-party programs the guide loads failing or being compromised (the ads, the consent management and, if you accept it, the analytics); whoever has access to your device can also read it. With those credentials someone could see your email and your account identifier, and see, change or empty your trip in your name, until you sign out of your account on that device and, at most, one hour longer. To delete the account, the service also requires a sign-in with a code from your email within the last 5 minutes; that is why "Delete my account and my trip" asks you for a new one. During those 5 minutes after each sign-in with a code or a link from your email, whoever had the credentials of that session could also delete it. On a shared device, sign out when you finish.

Deleting your account. In "My trip", inside your account, "Delete my account and my trip" asks you for a new code that we send to your email and, with it, deletes your account and the trip saved in it, and leaves nothing of them in this browser. On other devices where you signed in, the copy of the trip their browser keeps stays until you remove it: those devices are no longer connected to your account. It cannot be undone. You can also ask for it by writing to mail@2labs.app from the account's email; we reply within one month (GDPR, Art. 12(3)).

• Supabase data processing agreement
• Resend data processing agreement

Waitlist and communications

The controller is 2LABS Digital Innovation LLC (Wyoming, United States). If you joined the waitlist, we process your email address, language, subscription status, consent wording and sign-up, confirmation and unsubscribe dates to manage the launch and new-guide notices you agreed to receive. Where collected at sign-up, we also retain campaign parameters and the referring domain to understand how the subscription originated. We do not use this list to manage bookings or sell its data.

This processing is based on your consent. You can withdraw it through the unsubscribe link in our emails or by emailing mail@2labs.app from the subscribed address. Unsubscribing stops further notices. Confirmation links last 48 hours; the unsubscribe link in the confirmation email lasts one year, and future notices will include a valid unsubscribe link. If a link has expired or fails, you can request help or unsubscribe through that contact address.

Supabase stores the records and handles confirmations and unsubscribe requests. Resend provides email delivery. Hostinger hosts the website. The documented configuration of the waitlist project and email delivery service is in the United States; providers may use infrastructure and subprocessors in other countries under their terms. We do not publish tokens or private service keys. To limit abuse, the service processes IP addresses and retains a cryptographic fingerprint; it does not store plain IP addresses in the subscriber tables or rate-limit counters. Providers may keep their own technical logs.

Unconfirmed requests are deleted after 30 days; confirmed subscriptions after 24 months from confirmation; and unsubscribed records after 30 days from unsubscribing. Consent evidence follows the same retention period as the record. A daily task applies deletions after the relevant period has passed. These periods apply to our operational database; provider backups and logs have their own retention cycles. Restoring a website backup does not re-subscribe someone who has opted out.

• Supabase privacy policy
• Resend privacy policy
• Hostinger privacy policy

Legal basis

• Running the site, technical logs and maps: legitimate interest in delivering the guide you asked to see and keeping the service secure.
• Waitlist: your consent, which you can withdraw through the unsubscribe link or by emailing mail@2labs.app.
• Storing "My trip" and your cookie decision: necessary for the feature you switch on, and it stays on your device, except the trip you save in your account if you sign in.
• "My trip" account: creating your account, sending you the link and code to sign in, and saving your trip and giving it back to you are necessary to provide the service you ask for when you create it (GDPR, Art. 6(1)(b)). Protecting it against abuse, checking your session and keeping its technical logs rely on our legitimate interest in keeping the service secure (GDPR, Art. 6(1)(f) and Recital 49); you can object by writing to us or by deleting the account. The keys the account keeps in your browser are strictly necessary for that service, so they do not need your consent (Directive 2002/58/EC, Art. 5(3)).
• Google advertising: your consent, which you give or withdraw in Google's message (European Economic Area, United Kingdom and Switzerland) or in our cookie notice (rest of the world), from "Manage cookies".
• Measurement with Google Analytics: your consent, which you give or withdraw in Google's message (European Economic Area, United Kingdom and Switzerland) or in our cookie notice (rest of the world), from "Manage cookies". Without it, Google Analytics does not load.

Third parties that may receive data

• Google advertising technologies
• Google privacy policy
• Manage or turn off Google ad personalisation

International transfers

Google LLC processes Google Analytics and advertising data in the United States and other countries. For visitors from the European Economic Area, the United Kingdom and Switzerland, Google relies on the EU-U.S. Data Privacy Framework and its UK and Swiss extensions, and uses standard contractual clauses where needed. The controller, 2LABS, is also in the United States.

• Google's data transfer frameworks

How long data is kept

What is in your browser stays until you delete it (removing places from "My trip", changing your cookie decision or clearing the site's data in your browser). The waitlist periods are explained in its own section. Google's and Stadia Maps' retention periods are set by their own policies. Google Analytics keeps the data about how the guide is used for at most 14 months; its _ga and _ga_* cookies last up to 2 years, unless you withdraw your consent or delete them.

Your rights

If you live in Costa Rica, Law 8968 on the Protection of Individuals regarding the Processing of their Personal Data gives you the right to access, rectify and delete your data, to withdraw consent, and to complain to the Agencia de Protección de Datos de los Habitantes (PRODHAB).

If you visit from the European Union or the European Economic Area, the General Data Protection Regulation (GDPR) also gives you the rights to restriction, portability and objection, to withdraw consent at any time, and to lodge a complaint with your national supervisory authority.

You can request access, correction, deletion or withdrawal of consent at mail@2labs.app. If we need to verify ownership, we will ask only for the necessary information. We will address the rights available to you under applicable law. What is in your browser (such as "My trip") is under your direct control. If you have a "My trip" account, you can delete it yourself, with its trip, from "My trip". For anything that depends on Google, use its ad centre.

Children

The guide is not aimed at children. It only asks for one piece of data, the email, from whoever creates a "My trip" account, and you must be at least 16 to create one: the age the GDPR sets by default for a minor to give consent to online services (Art. 8), and no European Union country requires more. If you are under 16, do not create an account. If we learn that an account belongs to someone under 16, we delete it.

Cookies

Which cookies and storage this site uses, which belong to Google and how to change your decision is explained in the Cookie policy.

Changes to this policy

If anything relevant changes (for example, if we add affiliate agreements or new measurement tools), we will update this page and the date shown above.