Privacy Policy

1. Introduction

Venuto ("we", "our", or "us") is committed to protecting your privacy. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our website (venuto.app) and mobile application (collectively, the "Service").

We comply with the General Data Protection Regulation (GDPR) and other applicable data protection laws. By using our Service, you agree to the collection and use of information in accordance with this policy.

2. Data Controller

The data controller responsible for your personal data is:

3. Information We Collect

3.1 Information You Provide

• Contact Information: Name and email address when you contact us or sign up for notifications
• Tour Preferences: Selected cities, interests, and route preferences
• Feedback: Reviews, suggestions, and support requests

3.2 Automatically Collected Information

• Device Information: Device type, operating system, browser type
• Usage Data: Pages visited, features used, time spent
• Location Data: Only with your explicit consent, for navigation features in the app
• IP Address: Used for security purposes and general geographic location (country/region level)

3.3 Cookies and Similar Technologies

We use essential cookies to make our website work. Analytics cookies are only used with your explicit consent. See our Cookie Policy below for full details.

4. Legal Basis for Processing (GDPR)

We process your data based on:

• Contract Performance (Art. 6(1)(b)): To provide our tour planning services
• Legitimate Interest (Art. 6(1)(f)): To improve our services, ensure security, and prevent fraud
• Consent (Art. 6(1)(a)): For marketing communications, analytics cookies, and newsletter subscriptions
• Legal Obligation (Art. 6(1)(c)): To comply with applicable laws

5. How We Use Your Information

• To provide and maintain our tour planning Service
• To personalize your experience and recommendations
• To respond to your inquiries and support requests
• To send service updates and notifications (you can opt out anytime)
• To send iOS app launch notifications (only if you subscribed)
• To analyze usage patterns and improve our Service (with anonymized data)
• To detect, prevent, and address technical issues and security threats

6. Service Providers & Data Sharing

We do not sell your personal data. We work with carefully selected service providers who process data on our behalf under Data Processing Agreements (DPAs) that ensure GDPR compliance.

6.1 Our Service Providers

6.2 Other Disclosures

• Legal Requirements: We may disclose data if required by law, court order, or to protect our legal rights
• Business Transfers: In case of merger, acquisition, or sale, your data may be transferred with prior notice

7. Data Retention

We retain your data only as long as necessary for the purposes described in this policy:

After the retention period, data is either deleted or anonymized so it can no longer be linked to you.

8. Your Rights (GDPR)

Under GDPR, you have the following rights regarding your personal data:

9. International Data Transfers

Your data may be processed on servers located outside the European Economic Area (EEA). When this occurs, we ensure appropriate safeguards are in place:

• Standard Contractual Clauses (SCCs): EU-approved contractual terms for data transfers
• Adequacy Decisions: Transfers to countries with adequate data protection (as determined by the EU Commission)
• Data Processing Agreements: With all service providers handling personal data

Our primary hosting and API servers are located in the EU (Cloudflare and Google Cloud europe-west1 region).

10. Data Security

We implement appropriate technical and organizational measures to protect your data:

• Encryption: SSL/TLS encryption for all data in transit (HTTPS)
• Infrastructure: Enterprise-grade hosting with Cloudflare and Google Cloud
• Access Control: Strict access controls and authentication for all systems
• Monitoring: Continuous security monitoring and regular assessments
• Incident Response: Procedures to detect, report, and investigate data breaches

In the event of a data breach that poses a risk to your rights, we will notify you and the relevant supervisory authority within 72 hours as required by GDPR.

11. Cookie Policy

Cookies are small text files stored on your device when you visit a website. We use cookies to ensure our website functions correctly and, with your consent, to understand how you use it.

11.1 Essential Cookies (Always Active)

These cookies are strictly necessary for the website to function. They cannot be disabled.

11.2 Analytics Cookies (Require Consent)

These cookies help us understand how visitors interact with our website. They are only activated after consent in EEA regions. Outside EEA, they may be active by default and can be changed in cookie settings.

11.3 Advertising Cookies (Require Consent)

These cookies are used to show you relevant advertisements. They are only enabled if you click "Accept All" in EEA regions. Outside EEA, they may be enabled by default. Without consent, you may still see ads, but they will not be personalized.

You can opt out of personalized advertising at Google Ad Settings.

11.4 Managing Cookies

You can manage your cookie preferences at any time:

• Our Website: Click "Manage Cookies" in the footer to update your preferences
• Browser Settings: Most browsers allow you to block or delete cookies through settings
• Opt-out Tools: Use browser extensions like uBlock Origin or Privacy Badger

Note: Blocking essential cookies may affect website functionality.

12. Children's Privacy

Our Service is not directed to children under 16 years of age. We do not knowingly collect personal data from children under 16. If you are a parent or guardian and believe your child has provided us with personal data, please contact us at privacy@venuto.app. We will take steps to delete such information.

13. Changes to This Policy

We may update this Privacy Policy from time to time to reflect changes in our practices or for legal, operational, or regulatory reasons. When we make significant changes:

• We will update the "Last updated" date at the top of this page
• For material changes, we will provide notice through our website or email
• Continued use of the Service after changes constitutes acceptance

14. Supervisory Authority

If you are located in the European Economic Area and believe we have not adequately addressed your privacy concerns, you have the right to lodge a complaint with your local Data Protection Authority (DPA). You can find your local DPA at: edpb.europa.eu/members

15. Contact Us

For privacy-related questions, concerns, or to exercise your GDPR rights:

We aim to respond to all privacy inquiries within 30 days.