Privacy Policy

Last updated: June 18, 2026.

1. Data Controller

The data controller for your personal data is Milky Corp SpA (a Chilean company, Santiago, Chile), owner of the Cony service, domiciled in Chile.

2. What data we collect and why

Name you enter on the welcome screen — stored only in your browser (localStorage) to personalize greetings. It is not sent to our servers.
Itinerary data (city, dates, interests, language): sent to our AI provider to generate the itinerary. Legal basis: performance of the service you request.
Technical data (IP address, user-agent, application errors): for security, fraud prevention, and service improvement. Legal basis: legitimate interest.
Payment data (email, card details, country, taxes): collected and processed directly by Paddle.com, our merchant of record. We do not store or see your card details. Legal basis: performance of the purchase contract.
Analytics data (pages visited, interaction events, anonymized session recordings): collected by Google Analytics 4 and Hotjar via cookies. Only enabled if you accept optional cookies. Legal basis: consent.
Email address (if you leave it to receive your itinerary): used to send you that itinerary and occasional Cony communications. You can unsubscribe at any time via the link included in every email. Legal basis: consent.

3. Recipients of your data

Paddle.com Market Limited — our Merchant of Record that processes payments, manages billing, taxes, and refunds. See Paddle's privacy policy.
AI Provider (Google / models available via Lovable AI Gateway) — processes your itinerary text to generate it. We do not use your prompts to train models.
Hosting and database provider to run the site.
Authorities, when required by law.
Google (Google Analytics 4) and Hotjar — analytics and anonymized session recordings, only if you accept optional cookies.

4. International Transfers

Some providers process data outside your country (for example, the U.S. or the EU). We apply appropriate contractual safeguards (standard contractual clauses) where applicable.

5. Retention

The name is stored locally in your browser until you clear it. Itinerary data is not persisted on our servers beyond the time necessary to generate it. Technical logs are retained for up to 90 days. Tax and payment records are retained for the time required by applicable law (typically 5 to 10 years).

6. Your Rights

You have the right to access, rectify, delete, and port your data, to object to processing based on legitimate interest, and to withdraw your consent where applicable. If you are in the EU/EEA or the UK, you also have the right to lodge a complaint with your country's supervisory authority. To exercise these rights, contact us using the support option in the Service. For data processed by Paddle, go to paddle.net.

7. Security

We apply reasonable technical and organizational measures (encryption in transit via HTTPS, access controls, auditable logs).

8. Cookies and Local Storage

We use browser local storage to remember your language, name, cookie preferences and tip state. If you accept optional cookies, we load Google Analytics 4 and Hotjar, which set their own cookies for aggregate analytics and anonymized session recordings. You can change your choice by clearing site storage in your browser.

9. Changes

We may update this policy; we will post the date above.