Who we are (Data Controller)
Italy Vibe S.r.l. ("we", "us"), with registered office in Italy, operates the site www.italyvibe.it and the related concierge service. For any privacy matter you can write to privacy@italyvibe.it. We have not appointed a Data Protection Officer because we are below the EU threshold, but the privacy email reaches the team that handles every GDPR request.
What data we collect
- Account & profile data — name, email, password hash, language, optional avatar.
- Booking & fiscal data — experience(s) booked, dates, guests, total, currency, Codice Fiscale / VAT / billing address when you ask us to issue a fiscal document.
- Concierge conversations — messages you exchange with the AI concierge or a human concierge; "leads" you submit through the "Request your proposal" form (first/last name, email, phone, desired dates, party size, notes).
- Technical data — IP address (only ever stored as a daily-rotating SHA-256 hash, see Cookie Policy), user agent, device language, timestamps, error reports.
- Cookies — see the Cookie Policy for the complete list.
Why we process it (purposes and legal basis)
- Operating the platform and managing your account — contract (Art. 6(1)(b) GDPR).
- Processing your bookings and payments, issuing invoices, anti-fraud — contract + legal obligation (Art. 6(1)(b) and (c)).
- Concierge service (AI + human) and preparing tailored quotes — contract when you are signed in; consent when you submit a lead anonymously (you can withdraw at any time, see "Your rights" below).
- Service messages (booking confirmations, magic-link emails, payment receipts) — contract + legitimate interest in keeping you informed.
- Optional analytics and marketing — consent captured by the cookie banner; granular per category, withdrawable at any time from the "Cookie preferences" link in the footer.
- Security, fraud prevention and audit logs — legitimate interest.
Who receives your data (recipients & subprocessors)
We share strictly what is necessary with vetted providers, each bound by a Data Processing Agreement and only processing data on our instructions:
- Railway (hosting, EU region) — database and application servers.
- Resend (transactional email) — order confirmations, magic links, lead welcome.
- Stripe (payments) — card and SEPA processing.
- OpenAI / compatible providers — AI concierge inference. Messages sent to the model are minimised; we do not send fiscal data or passwords.
- Sentry (error tracking) — diagnostic stack traces; we strip PII when possible.
We never sell your personal data. We do not transfer data outside the EEA without standard contractual clauses.
How long we keep it
- Account — for as long as the account is active. We delete it on request.
- Bookings & invoices — 10 years (Italian fiscal-record retention).
- Concierge conversations and leads — 24 months from the last interaction.
- Cookie consent log — 24 months with identifiers, then identifier-stripped and kept as a bare compliance record (see Cookie Policy).
- Security and audit logs — 24 months.
Your rights (Art. 15–22 GDPR)
You can ask us at any time, free of charge, by writing to privacy@italyvibe.it, to:
- access your data and receive a copy (Art. 15);
- correct or update it (Art. 16);
- delete it (Art. 17), within the limits of legal-retention obligations;
- restrict processing (Art. 18);
- receive your data in a portable format (Art. 20);
- object to processing based on legitimate interest (Art. 21);
- withdraw any consent at any time, without affecting prior processing.
You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (www.garanteprivacy.it).
Cookies and consent
The cookie banner records your decision granularly (essential / analytics / marketing). Every decision is also logged server-side, with a daily-rotating IP hash, to demonstrate compliance with the Garante Provvedimento 10 June 2021. See the Cookie Policy for the full list of cookies and how to withdraw consent.
Changes to this policy
When the policy changes we bump the version string and the banner re-asks for cookie consent. This page always shows the current "Last updated" date.