Privacy Policy

Last updated 26 September 2026 This policy explains what personal data Sole e Solco collects, why, who receives it, how long it is kept, and the rights you have. It covers guests, people who sign in, the estates that offer stays on Sole e Solco and their staff, and anyone who visits solesolco.com. 1. Who is responsible for your data Sole e Solco decides how and why the personal data described here is used, and is responsible for it (the "controller"). For anything about your personal data, write to support@solesolco.com. When you book a stay, the estate that provides it receives your booking details and uses them to host you. For that use, the estate is responsible for your data in its own right. 2. What we collect, and why Booking a stay When you book, we collect your full name, your email address, your dates and the number of guests, and we record which version of the Traveler Terms you accepted, and when. We do not ask for your phone number, your address or the names of the people travelling with you. Why: to make and manage the booking you ask for (contract), and to keep the records the law requires (legal obligation). Your Journey Your confirmation and reminder emails contain a private link to your Journey, your stay's own page. Anyone who has the link can see your booking, so keep it private. Right after you book, a cookie keeps this link in your browser for 24 hours, so that you can return to your Journey. Why: to let you reach your booking without an account (contract). Payments You pay on Stripe's payment page, to the estate's own Stripe account. We give Stripe your email address. Stripe tells us about the payment, and we keep what it reports: its references, the amounts, whether the payment succeeded, was refunded or was disputed, and payment details that can include your name, your billing country or postcode, and your card's brand, last four digits and expiry date. We never receive your full card number or its security code. Why: to take your payment and handle refunds and disputes (contract), and to keep accounting records (legal obligation). Accounts and signing in Guests do not need an account. If you create one, we keep your email address and, if you sign in with Google, your name (see section 3). Sign-in links are sent to your email address. People who work for an estate sign in with an email address and a password, and are invited by email. Why: to give you the account you ask for, and to keep it secure (contract). Emails we send We send only emails about a booking or an account: your booking confirmation, with a calendar file; a reminder a week before you arrive; a request to review your stay after you leave; a link to find your stay again, if you ask for one; sign-in links; and, for estates, booking notifications, cancellation requests and invitations. We keep a copy of the emails we schedule in advance, such as your reminder, and the delivery reports our email provider sends us. If an email to an address bounces or is marked as spam, we stop sending to that address. We do not send marketing emails. Why: to carry out your booking or account (contract), and our legitimate interest in knowing that important messages arrive. The concierge If you ask an estate's concierge a question, we send your question, with the information the estate has approved, to our AI provider, which writes the answer. We do not send your name, your email address or your booking. We keep the question, the answer and the information it drew on, linked to the property and to a random code for your visit rather than to you, and the estate can read them. Please do not put personal details in your questions. Why: to answer the question you ask, and so that we and the estate can check the answers (legitimate interests). Reviews If you review a stay, we keep your rating, your comments and the email address of the booking, and share them with the estate. Reviews are not published at present. Why: our legitimate interest, and the estate's, in feedback about real stays. Estates and their staff For each estate, we collect its legal name, its national identification code (CIN), its contact email, which we give its guests before they arrive, its phone number, the city and province of its properties, its VAT number or codice fiscale, the name and tax identifier of its beneficial owner, and its declarations about insurance, safety and compliance. For people who work for an estate, we collect their name, email address, phone number and role. The estate's legal name and CIN are shown on its public page, and changes to them are recorded in our audit trail. When we create an estate's Stripe account, we give Stripe the owner's email address; Stripe then collects what it needs directly, under its own terms. Why: to provide our service to the estate (contract), to check that it may be listed, and to meet legal obligations, including reporting to tax authorities under the EU rules for digital platforms (DAC7) where they apply. Visiting the site Our hosting provider handles every request to the site, including your IP address and browser details. To stop abuse, some features count repeated requests using a code derived from your IP address. When something goes wrong, our error-reporting service records technical details of the error, such as the page and the browser, without linking them to your account. Why: our legitimate interest in running the site and keeping it secure. Analytics, only if you accept If you accept analytics in our banner, our analytics providers record how the site is used, such as the pages viewed and the steps taken to book. If you are signed in, this can be linked to your account's internal number, but never to your name or email address. If you decline, or do not choose, they do not run. Why: your consent. 3. Signing in with Google If you choose to continue with Google, Google shares with us your name, your email address, your profile picture and an identifier for your Google account. We ask only for this basic profile, and never for access to your Gmail, contacts, calendar, files or anything else in your Google account. We use it only to sign you in, and to recognise you when you come back, including when you sign in with an email link to the same address, so that your stays stay in one account. Our sign-in provider keeps it with your account, and we copy your name into your profile. We do not use your profile picture. We do not use information from Google for advertising, we do not sell it, and we share it with no one except the service providers that run our sign-in and host our site, or where the law requires it. Our use of information received from Google complies with the Google API Services User Data Policy. You can remove Sole e Solco's access to your Google account at any time at myaccount.google.com/permissions, and still sign in with an email link. If you delete your account, we remove your name and email address from your profile and close the account. 4. Who receives your data The estate you book with receives your name, your email address, your dates and number of guests, and your review if you write one. Service providers process data for us, only to provide their service to us: - hosting and running the site; - storing our database, accounts, sign-in details and photos, in the EU; - taking payments: Stripe, on the estate's own Stripe account; - sending our emails, including sign-in links; - writing the concierge's answers with AI; - analytics, only if you accept analytics; - error reports; - storing our backups, encrypted with a key the provider does not have. Stripe also uses payment data for its own purposes, such as preventing fraud and meeting its legal obligations, under its own privacy policy. If you sign in with Google, Google handles your Google account under its own privacy policy. We share data with public authorities when the law requires it. We do not sell personal data. 5. Transfers outside the European Economic Area Our database is in the EU. Some of our providers are based in the United States or process data there, and the site itself runs on servers in the United States. When personal data is transferred outside the European Economic Area, the transfer relies on a safeguard the GDPR allows, such as the European Commission's standard contractual clauses, or its adequacy decision for companies certified under the EU-U.S. Data Privacy Framework. 6. How long we keep your data - Your account: until you delete it. - Bookings, payments and the terms you accepted: for as long as accounting, tax and consumer law require. They are records of a contract and a payment, so they are kept even if you delete your account. - Emails, delivery records, reviews, concierge questions and security records: for as long as they are needed to run and protect the service. - Backups: 90 days. 7. Your rights You can ask us for a copy of your personal data, to correct it, to delete it, to restrict or object to how we use it, and to receive the data you gave us in a format you can reuse. Where we rely on your consent, you can withdraw it at any time. To do any of this, write to support@solesolco.com. We reply within one month. If you have a guest account, you can delete it yourself from your account page. We cannot delete records the law requires us to keep, such as bookings that were paid. If you think we have not handled your data properly, you can complain to the Italian data protection authority, the Garante per la protezione dei dati personali (garanteprivacy.it), or to the data protection authority of the EU country where you live. 8. Cookies We use these cookies without asking, because the site needs them: - a sign-in cookie, when you sign in, to complete the sign-in and keep you signed in; - a cookie that keeps the private link to your Journey for 24 hours after you book; - a cookie that remembers your choice in our analytics banner, for one year. Only if you accept analytics, our analytics providers set their own cookies and use your browser's storage. To change your choice, clear this site's cookies in your browser, and the banner will ask again. 9. Children You must be 18 or over to book or to create an account. A booking records the number of guests, not who they are, so we do not collect details of children who travel with you. 10. Security Our database is in the EU, and connections to the site are encrypted. Each estate sees only its own bookings and guests, Sole e Solco's staff see what their role requires, and actions on bookings, payments, refunds and legal acceptances are recorded in an audit trail that cannot be changed. Our backups are encrypted. Your Journey link works like a key, so keep it private. 11. Changes to this policy We may publish a new version of this policy. Each version has its own number and date, a published version is never changed, and the version in force is always the one at solesolco.com/privacy. 12. Contact Write to support@solesolco.com.