Privacy Policy

Art. 13 EU Reg. 2016/679 – GDPR)

Last updated: April 25, 2026

1. DATA CONTROLLER

The Data Controller is:

Stayvolution is currently being tested in a limited private beta with selected hospitality partners. The service is operated by the project founder during the beta phase.
Email: [email protected]

2. PURPOSE OF THIS POLICY

This Privacy Policy explains how personal data is collected and processed when using the Stayvolution platform and related services.

Stayvolution is a SaaS platform for hospitality operators that enables the collection, management, and analysis of guest feedback and operational insights.

3. ROLE UNDER GDPR

Depending on the type of data processed, Stayvolution acts as:

3.1 Data Controller

for:

  • customer account management
  • billing and contractual relationships
  • website and platform usage data (for service operation, security, and improvement)
  • marketing and communication activities

3.2 Data Processor

for personal data relating to Guests processed through the platform by Customers.

In this case:

  • the Customer acts as Independent Data Controller
  • Stayvolution processes such data as Data Processor under Art. 28 GDPR

The terms governing this relationship are defined in a separate Data Processing Agreement (DPA).

4. PERSONAL DATA WE COLLECT

4.1 Data relating to Customers

We may collect:

  • name and surname
  • email address
  • phone number
  • business or residential address
  • company name
  • VAT number
  • account credentials
  • billing and payment data (via third-party payment providers)
  • communication history with support
  • technical data (IP address, device, browser information)
  • platform usage data (logs, actions performed, timestamps)

4.2 Data relating to Guests (processed on behalf of Customers)

Guests’ personal data may be processed when Customers use the platform, including:

  • name
  • email address
  • phone number
  • reservation or stay details
  • feedback, complaints, and messages

This data is provided and controlled by the Customer.

4.3 Data provided directly by Guests

Guests may submit:

  • feedback
  • complaints
  • messages directed to accommodation providers

No account is required for Guests.

5. PURPOSES OF PROCESSING

5.1 Customer data (Controller role)

We process Customer data to:

  • provide and operate the platform
  • manage accounts and authentication
  • provide customer support
  • handle billing and payments
  • comply with legal obligations
  • ensure security and fraud prevention
  • improve platform functionality and performance

5.2 Guest data (Processor role)

Guest data is processed exclusively to:

  • enable Customers to collect and manage feedback
  • support complaint handling workflows
  • provide analytics and reporting tools
  • display insights within the platform

5.3 Marketing and communications

Where permitted:

  • send service updates and communications
  • provide marketing content
  • run advertising campaigns (Google, Meta, YouTube, Other)
  • perform remarketing activities

5.4 Analytics

We use analytics tools (e.g. Google Analytics, Matomo or similar) to:

  • analyse platform usage
  • improve performance and user experience
  • generate aggregated statistics

6. LEGAL BASIS

Processing is based on:

  • performance of a contract (Art. 6(1)(b) GDPR)
  • legal obligations (Art. 6(1)(c) GDPR)
  • legitimate interests (Art. 6(1)(f) GDPR), including security and service improvement
  • consent (Art. 6(1)(a) GDPR), where required (e.g. marketing cookies or emails)

7. CUSTOMER RESPONSIBILITY FOR GUEST DATA

Customers are responsible for ensuring that any Guest data processed through the platform is:

  • collected in compliance with applicable data protection laws
  • based on a valid legal basis under GDPR
  • appropriately communicated to data subjects where required

Further obligations are governed by the Data Processing Agreement between the Customer and Stayvolution

8. DATA RETENTION

We retain personal data only for as long as necessary for the purposes described above:

  • Customer account data: duration of contract + legal retention period (up to 10 years in Italy for accounting purposes)
  • usage and technical logs: up to 24 months (unless required for security/legal reasons)
  • Guest data: retained according to Customer instructions and platform configuration

9. DATA SHARING

Personal data may be shared with third parties acting as processors or service providers, including:

  • hosting and cloud infrastructure providers (primarily EU-based)
  • payment processors (e.g. Stripe)
  • analytics providers (Google Analytics, Matomo, etc.)
  • advertising platforms (Google, Meta, YouTube)
  • CRM and marketing tools
  • customer support and communication tools
  • professional advisors (legal, accounting, tax, etc)

All providers are bound by appropriate contractual and GDPR-compliant safeguards.

10. INTERNATIONAL TRANSFERS

Some service providers may be located outside the European Economic Area (EEA).
In such cases, personal data may be transferred outside the EEA where necessary to provide the Service.

11. SECURITY MEASURES

We implement appropriate technical and organisational measures to protect data, including:

  • encrypted communications (HTTPS/TLS)
  • access control systems
  • authentication and authorisation mechanisms
  • logging and monitoring systems
  • secure EU-based infrastructure where applicable

12. DATA SUBJECT RIGHTS

Data subjects have the right to:

  • access their data
  • rectify inaccurate data
  • request deletion
  • restrict processing
  • object to processing
  • withdraw consent where applicable

Requests can be sent to: [email protected]

Where applicable, requests relating to Guest data may be redirected to the relevant Customer.

13. COOKIES

The platform uses cookies and similar technologies for:

  • essential functionality
  • analytics
  • marketing and advertising

Full details are provided in the Cookie Policy.

14. AUTOMATED PROCESSING

The platform may use automated systems to:

  • categorise feedback
  • analyse sentiment
  • generate operational insights

These tools support decision-making but do not produce legal or similarly significant effects without human intervention.

15. CHILDREN

The service is intended for professional use and is not directed to individuals under 18 years of age.

16. CHANGES TO THIS POLICY

We may update this Privacy Policy from time to time. The last update date is at the top of this page.

17. APPLICABLE LAW AND JURISDICTION

This Privacy Policy is governed by Italian law and EU GDPR regulations.

Any dispute shall be subject to the exclusive jurisdiction of the Court of Florence, Italy.