Personal Data Protection Policy
Last updated: July 7, 2026.
This policy explains what personal data MagicAntioquia collects, what we use it for, and what your rights are, in line with Colombia's Law 1581 of 2012 and Decree 1377 of 2013 (the personal data protection framework, known as habeas data), and with international privacy best practices for visitors from other countries.
Who is responsible for processing your data?
The party responsible for processing your personal data is MagicAntioquia, an editorial and informational project about tourism in Antioquia, Colombia, run by its founding team. You can reach us at espesie@gmail.com for anything related to this policy.
What data do we collect?
We collect data depending on how you use the site: (1) if you write to us through the Contact form, we store your name, email address, phone number if you provide one, business name if applicable, and your message; (2) if you use the AI itinerary generator, we log your IP address to limit daily use and prevent abuse, and we send your trip preferences (available days, interests) to the AI provider that generates the response; (3) more generally, we collect browsing data (pages visited, device, approximate location) through Google Analytics. The site has no visitor registration or login: you don't create an account or share social-profile data to browse it. We do not directly process credit card or bank account data: donations are made through PayPal, on PayPal's own site.
What do we use your data for?
We use this data to respond to your contact messages, generate personalized itineraries, understand how the site is used so we can improve it, prevent abuse of our tools, and comply with legal obligations when applicable. We do not sell your personal data to third parties.
Authorization and legal basis
Under Colombia's Law 1581 of 2012 and Decree 1377 of 2013, processing your data requires your prior, express, and informed authorization. By submitting the Contact form or using the itinerary generator, we understand that you authorize the processing described in this policy for those specific purposes. You can revoke that authorization at any time by writing to us.
Who do we share your data with?
To operate the site we use external providers (data processors) that handle data on our behalf: Supabase (database), Google (Analytics), Resend (sending email notifications), PayPal (processing donations), and Travelpayouts (tracking travel affiliate links). If you use the itinerary generator, your trip preferences are shared with the AI provider that generates the response (currently xAI). The site's internal admin panel uses authentication restricted to the MagicAntioquia team — it is not a public-facing feature. Some of these providers process data outside Colombia; by using the site you accept that international transfer, which is necessary for the service to work.
Your rights as a data subject
You have the right to: know, update, and correct your data; request proof of the authorization you granted; be informed about how we use it; file complaints with Colombia's Superintendency of Industry and Commerce (SIC) for violations of the law; revoke your authorization and/or request deletion of your data when there is no legal duty to keep it; and access your personal data free of charge. You can exercise these rights by writing to espesie@gmail.com.
How long do we keep your data?
We keep your data for as long as needed for the purpose that led us to collect it, or until you request its deletion and there is no legal obligation requiring us to keep it longer.
Cookies and analytics
The site uses cookies and similar technologies from Google Analytics to measure site usage, and from Travelpayouts to attribute travel bookings made through our affiliate links. You can block or delete these cookies from your browser settings, though some site features may not work the same way without them.
Minors
MagicAntioquia is not directed at minors, and we do not knowingly collect data from anyone under 18. If you are a parent or guardian and believe a minor in your care shared personal data with us, please write to us so we can delete it.
Information security
We take reasonable measures to protect your data, but no system is completely secure. If we detect an incident that compromises your personal data, we will notify you as required by law.
Changes to this policy
We may update this policy when our practices or applicable regulations change. The date of the last update appears at the top of this page. We recommend checking back occasionally.
Contact
For any request related to your personal data, or if you have questions about this policy, write to us at espesie@gmail.com.