Privacy policy

Version 2026-11-04. This policy explains what personal data we process when you visit atacamastargazing.com, use the site chat, write to us or book a tour with us, and how you can exercise your rights.

It follows Chile's Law No. 19.628 on the Protection of Personal Data, as amended by Law No. 21.719, in the text in force from 1 December 2026. The articles we cite are those of that text, published by the Library of the National Congress of Chile (bcn.cl/leychile, in Spanish).

1. Who is responsible for your data

• Controller: Agencia de Turismo Patricia María Díaz López E.I.R.L., trading as AtacamaStargazing, Chilean tax ID (RUT) 77.373.215-9.
• Legal representative: Patricia María Díaz López.
• Address: San Pedro de Atacama, Antofagasta Region, Chile.
• Data protection officer: we have appointed one (art. 50). You reach them through the same form on this page.
• How to contact us about your data: use the «Exercise your rights» form at the end of this page. It goes straight to the person who handles privacy (art. 14 ter, letter c).

2. What data we process, why, and on what legal basis

For each use we state the data, the purpose, the legal basis (arts. 12 and 13), who else receives it and how long we keep it. We do not sell personal data.

2.1 Visiting the site

• Data: IP address, requested page, time, browser and server response.
• Purpose: to serve the site, detect attacks and diagnose faults.
• Legal basis: our legitimate interest in keeping the site available and secure (art. 13, letter d).
• Who receives it: Hostinger, which hosts our server in Brazil.
• Retention: 14 days. Then the log is deleted.

2.2 Analytics and advertising, only if you accept

• Data: a cookie identifier, the pages you view, clicks to WhatsApp and other browsing events, the device type, the IP address and, if you buy, the value, currency and number of the purchase (with no data about you).
• Purpose: to know how many people visit the site and which pages help them, and to measure and show our ads on Google, including ads to people who already visited the site (remarketing).
• Legal basis: your consent (art. 12). Analytics and advertising cookies are only set if you choose «Accept» in the cookie notice.
• Who receives it: Google LLC (United States), through a single Google Tag Manager tag that loads Google Analytics 4 and Google Ads.
• Retention: Google Analytics keeps events for 14 months. Each cookie's lifetime is in section 3. Google Signals is switched off, so Google does not link this data to your Google account.

Two details about how Google works:

• If you have not chosen, or you reject, Google's tags set no cookies and only send cookieless pings with no advertising identifiers (for example, that a page was viewed), which Google uses to estimate measurement in aggregate. As with any connection to a server, Google receives the IP address and technical browser data.
• If you accept, Google's tag may detect the email or phone number you type into a form on the site or at checkout in the booking system, and send it to Google as an irreversible SHA-256 hash, never readable, to learn which bookings come from our ads (enhanced conversions). If you reject, nothing is sent.

2.3 Your cookie choice

• Data: your decision (accept or reject), the version of this policy, the language, the notice variant you saw, the date and a random identifier. We do not store your IP address or anything that identifies you.
• Purpose: to remember your choice and to be able to prove that we have your consent, as the law requires (art. 12, last paragraph).
• Legal basis: compliance with that legal obligation (art. 13, letter b).
• Where: in a cookie in your browser (as_consent, 180 days) and in a log on our server that carries the same random identifier as the cookie.
• Retention: 24 months from each choice.

2.4 Site security and errors

• Data: the IP address behind each request to our forms, for one minute, to limit abuse; and technical data about site errors (what failed, on which page, in which browser), which may include the IP address.
• Purpose: to stop attacks and fix faults.
• Legal basis: our legitimate interest in a secure, working site (art. 13, letter d).
• Who receives it: Upstash, Inc. (United States) for the request limit, and Functional Software, Inc. (Sentry, United States) for errors. We do not record your session or what you type on the site.
• Retention: the request limit forgets the IP address after one minute. Errors are kept for up to 90 days.

2.5 Bookings and payments

Bookings and payments are made at book.atacamastargazing.com, run by Roverd (the Netherlands), our booking system provider.

• Data: first and last name, country, email, phone, hotel or pickup point, companions, coupon and payment details. We never see or store your card details: the payment is processed by Stripe inside Roverd's system.
• Purpose: to create and confirm your booking, take payment, organise the pickup and the tour, issue the receipt and contact you about your booking.
• Legal basis: performance of the contract you enter into when you book (art. 13, letter c), and our tax and accounting obligations (art. 13, letter b).
• Who receives it:
  • Roverd processes booking data under its own terms and its own privacy policy. We have asked it to sign an annex that binds it to process the data only on our behalf. Until it is signed, we are telling you how things stand.
  • Stripe processes the payment and Muscula supports the running of Roverd's system, both on Roverd's behalf.
  • We receive your booking details from Roverd and use them in our internal operations system, hosted by Supabase (São Paulo, Brazil), to build the passenger list and the pickups.
• Retention: as long as tax and accounting rules require for sales records (generally six years). After that, we delete or anonymise them.

2.6 Enquiries by WhatsApp, email or phone

This includes Private Tour quotes sent from its page: the form builds a WhatsApp message or an email that you send yourself.

• Data: your name, number or email, and whatever you write to us (date, group size, questions).
• Purpose: to answer you and, if you ask, quote and book.
• Legal basis: the pre-contractual steps you ask us to take (art. 13, letter c).
• Who receives it: WhatsApp (Meta Platforms, United States) and Google Workspace (Google, United States), where our mailboxes are.
• Retention: 12 months from your last message. Then we delete them, unless they became a booking (section 2.5).

2.7 Site chat

Our chat uses an artificial intelligence assistant that drafts the replies. A person on our team reviews them before they are sent, except for some standard replies. A voice message is always reviewed by a person.

• Data:
  • what you write in the chat and the details of your enquiry (date, people, tour, accommodation, language). You do not need to give any personal data to chat;
  • if you send a voice message, we transcribe it into text and do not keep the audio: only the text remains, with the same retention as any other message;
  • if you want us to contact you, an email (which we verify with a 6-digit code sent from chat@atacamastargazing.com) or a phone number for WhatsApp;
  • to book the Private Tour from the chat, each participant's full name and ID or passport number, and the hotel (optional);
  • chat statistics with no personal data (conversations started, links shown, clicks on the booking link).
• Purpose: to answer your enquiry, email you when we reply and you no longer have the chat open (at most one email per hour), create the Private Tour booking and improve the service with statistics.
• Legal basis:
  • your consent, for the contact details (art. 12). You give it by ticking the box in the chat form;
  • the steps you ask us to take to book, for the Private Tour participants' details (art. 13, letter c). By ticking the box, you confirm that the other people authorised you to share their data, or that you are their parent or guardian if they are minors (art. 16 quáter).
• How we protect it: contact details and participants' details are stored encrypted. The assistant and the AI model never see them, only the sales team can read them, and every read is logged.
• Who receives it:
  • our chat server (Hostinger, Brazil), where everything is stored. Backups are kept by the same hosting provider, Hostinger;
  • Anthropic, PBC (United States), whose language model processes the messages. Only if it fails are they processed by OpenRouter, Inc. (United States) with an Anthropic model;
  • OpenRouter, which transcribes voice messages with an OpenAI model;
  • Cloudflare (United States), which checks that the writer is not a bot;
  • Resend (United States), which sends the verification code and the reply notice from chat@. It receives only your email address and the text of that notice, never the conversation.
• Retention: 90 days without activity. Then it is deleted. An email that was never verified is deleted after 24 hours.
• Deleting it sooner: when you finish the conversation, type @anonymize in the chat. We remove your name and anything that identifies you from it and unlink it from your browser. After that we can no longer see what we talked about to follow up. If you no longer have that conversation open, ask in a new chat, saying roughly when you wrote to us, or use the form on this page.

2.8 Requests about your data

• Data: what you write in the «Exercise your rights» form (name, email, what you are asking for and the details).
• Purpose: to answer your request and be able to prove that we did.
• Legal basis: compliance with the law's obligations on your rights (art. 13, letter b).
• Who receives it: Resend (United States) delivers the form to our Google Workspace mailbox.
• Retention: 24 months from our reply.

2.9 Google content on the site

• Google reviews: we show public reviews from our Google profile, with the name and photo each author published. Legal basis: our legitimate interest in showing real customer opinions (art. 13, letter d). The photos load from Google's servers, which receive your IP address. We keep a copy of the reviews for 6 hours.
• Pickup map: the map on the transport page is from Google Maps. It only loads if you accepted cookies or if you tap «Show the map». When it loads, Google receives your IP address and may set a cookie of its own (NID, 6 months).

Where the data comes from

You give us almost all of it, on the site, in the chat or when you book. Your booking details reach us from Roverd's system. Reviews come from public Google profiles (art. 14 ter, letter j).

Our legitimate interests

Where we rely on legitimate interest (sections 2.1, 2.4 and 2.9), that interest is keeping the site available and secure, fixing its faults and showing real customer opinions. You can object to these uses (section 6).

3. Cookies

We use cookies the site needs to work and, only if you accept, Google analytics and advertising cookies. You can change your choice at any time with «Cookie settings» at the bottom of every page. If you withdraw your consent, we delete Google's cookies on our domain. The ones Google keeps on its own domains are deleted from your browser settings.

The chat keeps its session in your browser's storage, on its own domain, with no third-party cookies.

4. Who receives your data, and transfers outside Chile

Besides our team, the providers in section 2 process data on our behalf: Hostinger (servers in Brazil), Supabase (Brazil), Google (United States), Upstash, Sentry, Anthropic, OpenRouter, Cloudflare and Resend (United States). Roverd, with Stripe and Muscula, processes booking data under its own terms (section 2.5). We only hand data to an authority when the law requires it.

International transfers (art. 14 ter, letter h, and arts. 27 and 28). None of these providers stores the data in Chile. Chile's Personal Data Protection Agency has not yet declared which countries provide an adequate level of protection, so we inform you that, today, neither the United States, Brazil nor the Netherlands has that declaration. These transfers rely on the data processing terms each provider offers, with their protection clauses (art. 27, letter b). Your booking details are also transferred because that is necessary to perform the contract you enter into when you book.

5. How long we keep data

We keep each piece of data only as long as its purpose requires. Then we delete or anonymise it (art. 3, letter c):

• server visit log: 14 days;
• Google Analytics events: 14 months;
• your cookie choice: 180 days in your browser and 24 months in our log;
• site errors: up to 90 days;
• chat conversations: 90 days without activity (an unverified email, 24 hours);
• enquiries by WhatsApp, email or phone: 12 months;
• requests about your data: 24 months from our reply;
• bookings: the tax and accounting period (generally six years).

6. Your rights

You have the right to (arts. 4 to 9):

• access: know whether we process your data and get a copy (art. 5);
• rectification: correct it if it is inaccurate, out of date or incomplete (art. 6);
• erasure: have it deleted in the cases the law sets out (art. 7);
• objection: stop a specific use, for example one based on our legitimate interest (art. 8);
• blocking: have its processing suspended temporarily (art. 8 ter);
• portability: receive the data you gave us in a commonly used electronic format (art. 9);
• not to be subject to automated decisions that affect you (art. 8 bis);
• withdraw your consent at any time, without affecting what was done before (art. 12). For cookies, use «Cookie settings» at the bottom of every page.

How to exercise them. Write to us with the «Exercise your rights» form at the end of this page. It is free of charge (art. 10). We will ask for what we need to confirm it is you. We will answer within 30 calendar days at most, which we may extend once by another 30, letting you know (art. 11). If you ask for a temporary block, we answer within 2 business days.

Complaint to the Agency. If we turn down your request or do not answer in time, you can file a complaint with Chile's Personal Data Protection Agency (Agencia de Protección de Datos Personales; arts. 11 and 41).

7. Automated decisions

We do not make automated decisions that produce legal effects for you or significantly affect you (art. 8 bis). The chat assistant drafts replies, but decides nothing for you: you make the booking yourself and a person reviews the replies. If you accept advertising cookies, Google may use your browsing on the site to show you our ads (remarketing). You can avoid this by rejecting those cookies.

8. Children and adolescents

The site is not aimed at minors. A minor Private Tour participant's details are given by their parent or guardian, and we use them only to create that booking (art. 16 quáter).

9. Security

We protect data with technical and organisational measures (arts. 14 quinquies and 14 quáter):

• the whole site runs over an encrypted connection (HTTPS);
• chat contact and participant details are stored encrypted;
• access is limited to the people who need it;
• we do not store your card details.

If a security breach occurs, we will report it to the Agency and, where the law requires, to you as well (art. 14 sexies).

10. Changes to this policy

When we change this policy, we will publish the new version here, with its date. If the change affects what you accepted in the cookie notice, we will ask you again.