Privacy policy
Last updated: 1 August 2026
This notice explains what personal data we collect on ischiami.com and the related domains host.ischiami.com and admin.ischiami.com, why we collect it, who we share it with and what rights you have. It is provided under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR).
1. Data controller
The controller is [DA COMPILARE], [DA COMPILARE] — VAT/Tax ID [DA COMPILARE].
For anything concerning personal data write to
info@ischiami.com.
No Data Protection Officer has been appointed.
2. What data we process
If you browse without an account
- technical data: IP address, browser and device type, pages visited, date and time;
- whatever you enter in a contact request form: name, phone, email, dates and number of guests, message.
If you create an account
- first and last name, email address, phone number, password (stored only as a hash);
- messages you exchange through the platform chat.
If you are a host
- tax code and certified email address;
- a copy of an identity document (type, number and image);
- IBAN and account holder for payouts;
- property data: address, land registry details, survey, CIN and CIR codes.
Identity documents are held in restricted storage, never published, and visible only to you and to the staff carrying out the verification.
If you book
- stay dates, number of guests, amounts;
- card details never reach us: they are handled by Stripe. We only receive the payment outcome and a transaction reference.
3. Why we process it, and on what legal basis
| Purpose | Legal basis |
|---|---|
| Creating and running your account and the platform | Performance of a contract (Art. 6.1.b) |
| Handling bookings, payments and communication between the parties | Performance of a contract (Art. 6.1.b) |
| Forwarding your contact request to the property owner | Pre-contractual steps at your request (Art. 6.1.b) |
| Verifying host identity and preventing fraud | Legitimate interest in a trustworthy marketplace (Art. 6.1.f) and legal obligations (Art. 6.1.c) |
| Tax and accounting obligations | Legal obligation (Art. 6.1.c) |
| Service security and technical logs | Legitimate interest in security (Art. 6.1.f) |
We send no marketing messages and carry out no profiling.
4. Who we share it with
We never sell your data. It is processed on our behalf by providers appointed as processors (Art. 28 GDPR):
| Provider | Role | Where |
|---|---|---|
| Cloudflare | Website hosting, CDN, file storage | EU / non-EU |
| Neon | Database | EU (Frankfurt) |
| Stripe | Card payments | EU / United States |
| Resend | Transactional email | United States |
| Google Fonts | Web font delivery (your IP address is disclosed) | United States |
When you send a contact request or book, the necessary data is shared with the property owner, who acts as an independent controller in replying to you.
Transfers to the United States rely on the European Commission's standard contractual clauses and/or the provider's Data Privacy Framework certification.
5. How long we keep it
- Account: while it is active. On deletion data is removed, except what the law requires us to keep.
- Identity documents: until the verification is completed; afterwards we keep only type, number and outcome.
- Bookings and accounting records: 10 years, as required by tax law.
- Contact requests: 24 months.
- Messages: while the account is active, or until the conversation is deleted.
- Technical logs: 12 months.
6. Cookies
We only use strictly necessary technical tools: an authentication cookie (access_token)
and browser local storage for the same purpose. No profiling cookies, no third-party analytics —
which is why you see no consent banner.
7. Your rights
You may ask us to access, rectify, erase or restrict your data, to receive it in a portable format, and you may object to processing based on legitimate interest.
Write to info@ischiami.com; we reply within one month. You may also lodge a complaint with the Italian Data Protection Authority or the authority of your country of residence.
8. Children
The service is not intended for people under 18 and we do not knowingly collect their data.
9. Changes
If we change this notice we update the date at the top. Registered users are informed by email of significant changes.