Privacy Policy

21 October 2026

Pursuant to Regulation (EU) 2016/679 (GDPR), this notice describes how Ci vediamo in Calabria processes the personal data of platform users.

1. Data controller

The data controller is Ci vediamo in Calabria. For privacy matters you can write to info@civediamoincalabria.it.

2. Data we collect

We process:
• identification and contact data (first name, last name, email, phone), when provided through accounts, contact forms, support requests or content proposals;
• login credentials and session data: the password is stored as an encrypted hash (bcrypt); if signing in with Google or Apple, the identifiers they provide; any two-factor authentication (2FA); session and refresh tokens with related technical security information;
• favourites/wishlist, requests to become an owner or collaborator, publication requests and messages sent through the platform;
• for owners, hosts and local businesses: images, descriptions, contact details, addresses, coordinates, opening hours, social profiles, any accommodation identification codes (CIN, CIR or other local codes where necessary) and information provided for publication;
• technical and log data (e.g. IP address, user-agent, application logs), also used for security and rate limiting;
• only with your prior consent, browsing and usage data collected through Google Analytics in aggregate and pseudonymised form (e.g. pages viewed, traffic source, main interactions);
• data relating to premium services or featured listings voluntarily requested by owners, hosts or local business owners: promoted content type, duration, promotional text, amounts, currency, payment status, technical payment-session identifiers and consents/acceptances linked to the service;
• if the contact fee is active and you choose to pay it: the listing whose contact details you unlock, amount, currency, payment status, technical payment-session identifiers, date of the unlock and the consents given (acceptance of the Terms and immediate provision of the service with loss of the right of withdrawal);

In addition to the data already indicated, we also process:
• data relating to the acceptance of legal documents: date and version of acceptance of the Terms and Privacy Policy (termsAcceptedAt, termsVersion);
• technical device information associated with each refresh token (user-agent and IP address), retained for security and session management purposes;
• published reviews, if enabled (star rating, title, text, language) and any public reply by the owner or host;
• user-submitted events and submitter data (name, email, account identifier);
• local business listings created by users or business owners (name, description, address, coordinates, contact details, including any WhatsApp number and social profiles, opening hours, images);
• content of support communications (subject, messages, category, action history, any references to accommodations or published content);
• push notification subscription: browser push service endpoint, cryptographic keys (p256dh, auth), technical device information (userAgent);
• messages sent through the contact forms of listings and experiences (name, email, any phone number and text): we forward them by email to the owner, host or experience organiser concerned, who can reply to you directly, without keeping the text on the platform;
• record of contacts with accommodations, only when you are signed in: we record the contact with an accommodation when you send its contact form, when the listing page shows you the contact details of the owner or host, and when you unlock them by paying the contact fee. For each of these three cases we keep a reference to your account, the accommodation, the type of contact and the date of the first and the latest contact: the record is used only to let you review that accommodation.

3. Purposes and legal basis

We process data to:
• manage accounts and profiles — performance of the contract (Art. 6.1.b GDPR);
• publish and maintain accommodation listings, local business listings, authorised contact details and informational content — performance of the contract or pre-contractual measures (Art. 6.1.b GDPR) and legitimate interest (Art. 6.1.f GDPR);
• assess and manage requests to publish, modify or remove listings and content — pre-contractual measures, performance of the contract and legitimate interest (Art. 6.1.b/f GDPR);
• send transactional emails and service communications — performance of the contract (Art. 6.1.b GDPR);
• comply with legal obligations, including authority requests and accountability obligations (Art. 6.1.c GDPR);
• ensure platform security, prevent abuse and fraud and apply rate limiting — legitimate interest (Art. 6.1.f GDPR);
• with your consent, analyse site use in aggregate form through Google Analytics to improve it — consent (Art. 6.1.a GDPR);
• demonstrate acceptance of legal documents — compliance with a legal obligation (Art. 6.1.c GDPR) and/or legitimate interest of the Controller (Art. 6.1.f GDPR);
• manage, moderate and publish reviews, owner replies and aggregate scores, if such features are enabled — performance of the contract and legitimate interest (Art. 6.1.b/f GDPR);
• receive, moderate and publish user-submitted events and business listings — performance of the contract and legitimate interest (Art. 6.1.b/f GDPR);
• manage support communications and contact requests — performance of the contract and legitimate interest (Art. 6.1.b/f GDPR);
• send push notifications — consent (Art. 6.1.a GDPR), withdrawable at any time;
• publish the local business directory — performance of the contract and legitimate interest (Art. 6.1.b/f GDPR);
• aggregate and display informational content from external sources — legitimate interest of the Controller (Art. 6.1.f GDPR), in compliance with applicable licences;
• manage premium services or featured listings voluntarily requested by owners, hosts or local business owners, including checkout, receipts, activation, renewal, support and administrative traceability — performance of the contract, legal obligations and legitimate interest (Art. 6.1.b/c/f GDPR);
• manage any contact fee, including payment, unlocking of contact details, confirmation email, support and administrative traceability — performance of the contract, legal obligations and legitimate interest (Art. 6.1.b/c/f GDPR);

4. Data processors and third parties

To deliver the service we rely on providers that process data on our behalf or as independent controllers, each with its own policy and only when the related feature is used or configured:
• Google — sign-in with Google account;
• Google (Google Analytics) — aggregate site usage statistics, only with your prior consent;
• Apple — sign-in with Apple account;
• Stripe — management of payments relating to premium services or featured listings voluntarily chosen and to any contact fee, only when such features are active and used;
• Resend — sending transactional emails and contact-form messages;
• Aruba S.p.A. (Italy) — sending emails as a backup channel to Resend, and the welcome email after registration;
• Google (Gmail) — sending emails as the last backup channel, only when configured;
• Vercel — application hosting;
• MongoDB — database;
• a cache and rate-limiting service (Redis);
• Esri/ArcGIS and MapTiler — provision of map tiles for maps (transmit IP and User-Agent);
• Nominatim/OpenStreetMap Foundation — address geocoding for business listings (transmits IP, User-Agent and address string at entry time);
• Ticketmaster — events API, if active (transmits API key and User-Agent);
• browser push services (Google FCM, Mozilla autopush, Apple APNs) — push notification delivery.
• Google (YouTube) — playback of embedded videos, only after you press the play button;
• Vimeo — playback of embedded videos, only after you press the play button;
Some of these providers may process data outside the European Union under their respective adequate safeguards.

5. Retention

We retain data for periods consistent with the purposes of processing and applicable obligations. In particular:
• account and profile data: until the account is deleted, except for data that must be kept longer for legal obligations or rights protection;
• refresh tokens: 7 days from last use — the period is renewed each time the session is renewed — or until revocation;
• publication, modification or removal requests and their outcome: for the time needed for handling and administrative traceability;
• images, descriptions, contact details and identification codes of accommodations or businesses: until the content is removed or the authorisation is withdrawn, save further retention needs;
• technical logs and security data: for the time strictly necessary;
• reviews: for the duration of the service or until account deletion, with anonymisation where appropriate;
• push subscription: until consent is withdrawn or account is deleted;
• record of contacts with accommodations: for as long as the account exists, with no automatic expiry; it is deleted when the account is deleted and, for each accommodation, when its listing is deleted;
• support tickets: for the time necessary for management and legal defence;
• local content aggregated from external sources: news up to 75 days from publication, past events removed periodically;
• Terms and Privacy acceptance records: retained for the duration of the GDPR accountability obligation.
• data relating to premium purchases, featured listings, contact fees, payments and receipts: for the time necessary for administrative, accounting and tax management and rights protection;

When an account is deleted, personal data no longer needed is removed or anonymised, leaving only what is indispensable for legal obligations or rights protection.

6. Security

We adopt appropriate technical and organizational measures: encrypted connections (HTTPS), password hashing (bcrypt), authentication via JWT tokens with rotating refresh tokens, rate limiting, security headers and role-based access control. The refresh token is stored in an httpOnly cookie that scripts on the page cannot read, and the access token is not stored on the device.

7. Transfers outside the EU

Where providers such as Google (including Google Analytics and the Gmail mail service), Apple, MongoDB, Vercel, Resend or the Redis service used for technical functions process data outside the European Economic Area, the transfer takes place on the basis of appropriate safeguards provided for by the GDPR (e.g. standard contractual clauses, the EU-US Data Privacy Framework or other permitted mechanisms). Esri/ArcGIS, MapTiler, Nominatim/OpenStreetMap Foundation, Ticketmaster and browser push services (Google FCM, Mozilla autopush, Apple APNs) may similarly process data outside the EEA under their own adequate safeguards. Aruba S.p.A., by contrast, processes data in Italy.

8. Your rights

You may exercise the rights of access, rectification, erasure, restriction, portability and objection by writing to the controller. You also have the right to lodge a complaint with the data protection supervisory authority.

If you have an account, you can also export your personal data from your account area and request deletion of your account. In that case personal data is removed or anonymized within the limits allowed by legal, accounting and rights-protection obligations.

9. Changes to this notice

This notice may be updated over time. Material changes will be made available on this page together with the relevant update date.

10. Contact requests and data published in listings

When a user uses a contact form or views contact details published in a listing, we process the data necessary to show the information, forward the request or manage support. These contact features do not constitute a booking and do not require payment to the platform for the stay. Any payments managed by the platform relate only to premium services or featured listings voluntarily chosen by owners, hosts or local business owners and, if active, to the contact fee that unlocks the contact details of a single listing (section 4c of the Terms). When a user unlocks the contact details of a listing, the owner or host receives a notice and, in their reserved area, sees only the user's first name, without surname, email, phone number or amount paid. Owners and hosts remain responsible for the accuracy of the contact details and information they authorise for publication. Legal basis: performance of the contract or pre-contractual measures (Art. 6.1.b GDPR) and legitimate interest (Art. 6.1.f GDPR).

11. Content aggregated from external sources

The platform aggregates news, events and points of interest from external sources (RSS feeds, open data, APIs). Such content may include personal data of third parties (e.g. the name of an event organiser) processed for purely informational purposes on the basis of the Controller's legitimate interest, in compliance with applicable licences. Anyone who believes that aggregated content contains their own inaccurate or outdated personal data may contact the Controller at the details indicated in the Contacts section.

12. Minors

The service is intended for adults. We do not knowingly collect personal data of individuals under 18 years of age. Should we become aware of having processed data of a minor, we will proceed with immediate deletion. Anyone who notices this circumstance is invited to contact us at the details indicated in the Contacts section.

13. Contact

To exercise your rights or for any request, write to info@civediamoincalabria.it.

14. Providing data

Providing the data required to create an account, send requests, propose content or use reserved features is optional, but necessary to provide the requested feature. Registration is free and does not require purchasing services, publishing premium listings, concluding bookings or taking on economic commitments. Premium or featured services are optional and are processed only if the interested user voluntarily chooses them. Consent for analytics, advertising or push notifications is always optional and withdrawable; refusal does not prevent browsing of essential features.

15. Automated decision-making

We do not use automated decision-making processes that produce legal effects or similarly significantly affect users. Any statistics, security systems, rate limiting, content moderation or ranking are used to protect and organize the service and may be subject to human review when they affect content or accounts.