1. Who we are
Amanda Solutions is a software-as-a-service platform for tour operators, operated by Amanda Solutions, a company organized under the laws of Costa Rica. You can reach us at privacy@amandasolutions.com.
This policy covers the website at amandasolutions.com and the app at any subdomain ending in .amandasolutions.com.
2. What we collect
2.1 Data you give us directly
- Account information: name, email, company name, phone number, password (stored hashed).
- Billing information: billing contact, VAT or tax ID, invoice address. We do not store payment card numbers — they are handled by our payment processor.
- Customer Data: everything you upload into your workspace — customers, vendors, quotes, bookings, tours, invoices, and so on. This is your data; we just host it.
- Support communications: emails, chat messages, and any attachments you send us when asking for help.
2.2 Data we collect automatically
- Usage logs: which pages you open, which features you use, timestamps. Used for product improvement and to diagnose bugs.
- Device and browser information: IP address, user agent, operating system, browser version.
- Cookies and local storage: see Section 7.
- Error reports: when something crashes, we capture the error message, the URL, and a stack trace so we can fix it.
3. Why we collect it
- To provide the Service: we can't run your workspace without storing your data in it.
- To bill you: for paid plans, we need billing information to charge your card.
- To communicate with you: product updates, security alerts, billing notices, price change notices, and support replies.
- To improve the product: aggregated, anonymized usage data helps us understand which features matter.
- To keep the service secure: we use logs to detect and respond to abuse, fraud, or security incidents.
- To comply with the law: when legally required (tax records, court orders).
We do not sell your personal data. We do not use your Customer Data to train machine learning models.
4. Legal basis for processing
Depending on your jurisdiction, we rely on one of the following legal bases to process your personal data:
- Performance of a contract — to deliver the Service you signed up for.
- Legitimate interest — to improve the product, prevent abuse, and keep the Service secure.
- Legal obligation — when the law requires us to retain or disclose data.
- Consent — for optional marketing communications and cookies that are not strictly necessary.
5. Who we share data with
We share data only with the subprocessors needed to run the Service. Each one is contractually bound to protect your data and use it only for the purposes we instruct.
- Supabase Inc. (United States) — hosts your database, handles authentication, stores uploaded files.
- Vercel Inc. (United States) — hosts the application and serves static assets from a global CDN.
- Google LLC (Global) — provides Maps and location services when you use address lookup or route planning.
- Anthropic PBC (United States) — powers the in-app AI assistant, which is available on the Scale plan only. On the Books and Operations plans the assistant is not available and nothing from your workspace is sent to Anthropic. On Scale, when you ask the assistant something, we forward your message and the records it reads to answer you: the assistant runs read-only queries against your own workspace, restricted to your company by row-level security, and those results are sent along with the conversation. If you never open the assistant, none of your workspace data is sent.
We do not share your personal data with advertisers, data brokers, or analytics companies that build cross-site profiles.
We will provide at least 30 days' notice before adding or replacing a subprocessor. If you object, you can terminate your subscription and receive a pro-rata refund of any unused prepaid annual cycle.
6. International data transfers
Amanda Solutions is based in Costa Rica, and our primary infrastructure (Supabase, Vercel) is hosted in the United States. By using the Service, you acknowledge that your data will be transferred to and processed in the United States and other countries where our subprocessors operate.
We implement appropriate safeguards for international data transfers, including standard contractual clauses with our subprocessors where applicable.
8. How long we keep your data
- Active workspaces: we keep your data as long as your Account is active.
- After cancellation: read-only for 14 days, then permanently deleted 30 days after termination.
- Billing records: retained for the period required by Costa Rican tax law (currently 5 years).
- Support communications: retained for up to 3 years so we can reference past conversations if you come back with a follow-up.
- Security logs: retained for up to 1 year for incident investigation.
9. Your rights
Depending on where you live (Costa Rica Ley 8968, GDPR in the EU, LGPD in Brazil, CCPA in California), you may have the following rights:
- Access — ask for a copy of the personal data we hold about you.
- Rectification — ask us to correct inaccurate data.
- Erasure — ask us to delete your personal data (subject to legal retention requirements).
- Portability — ask for your data in a machine-readable format.
- Restriction — ask us to pause processing while you contest something.
- Objection — object to processing based on legitimate interest.
- Withdraw consent — for anything you opted into.
- Lodge a complaint — with your local data protection authority.
To exercise any of these rights, email privacy@amandasolutions.com. We will respond within 30 days. We will verify your identity before acting on a request.
10. How we protect your data
- Row-level security on every table of our database, enforced at the Postgres level: each record carries the company it belongs to, and an account can only reach the records of its own company.
- TLS 1.2+ encryption for all data in transit.
- Encryption at rest for databases and file storage.
- Access controls limiting engineering access to production systems.
- Regular review of our subprocessors' security posture.
No system is perfectly secure. In the event of a breach affecting your personal data, we will notify you without undue delay — within 72 hours of becoming aware of the incident.
11. Children
The Service is for business use and is not directed at children under 18. We do not knowingly collect personal data from children. If you believe a child has provided us with personal data, email us and we will delete it.
12. Changes to this policy
We may update this Privacy Policy from time to time. For material changes, we will notify you by email and post a notice in the Service at least 30 days before the change takes effect. The “Last updated” date at the top of this page always reflects the most recent version.
13. Contact
Questions? Concerns? Data access requests?
Email: privacy@amandasolutions.com
Postal: Amanda Solutions, San José, Costa Rica