YOUR DATA

Privacy policy

Effective and last updated: 24 August 2026

This notice explains how Pisa, No Traps handles personal data when you use the guide or buy access. The service operator acts as the data controller. Privacy requests can be sent to support@pisanotraps.com.

What we handle

• Your entry zone. A QR route such as Ponte di Mezzo or Pisa Centrale selects the relevant guide. The route itself is not used to identify you.
• Optional device location. If you tap the location button and approve the browser prompt, your coordinates are used only inside your browser to choose the nearest supported zone. We do not send, retain or build a history from the coordinates.
• Purchase and access data. Stripe processes your payment details and may collect your email and billing information. We receive a Checkout Session identifier and payment status so we can issue a signed access token. We never receive or store your complete card number.
• Anonymous usage totals. We count QR-route opens and a small set of actions such as opening price guidance, requesting location, starting checkout or using the paid guide. Our analytics database stores only the UTC day, broad route, action type and an aggregate count. It does not store IP addresses, precise location, device identifiers, cookies or individual visit records.
• Technical data. The hosting and payment providers may process IP address, device/browser details and security logs to deliver and protect the service.
• Device storage. The access token, copies of paid routes you have opened and items you save are kept locally in your browser so access works on this device and a previously opened route can be recovered after a temporary request failure.

Why we use it

Purchase and access information is processed to perform the digital-content contract (GDPR Article 6(1)(b)). Anonymous aggregate usage totals and security data are processed for our legitimate interests in understanding whether the guide works and operating it safely (Article 6(1)(f)). Records required for accounting, consumer or tax compliance are processed to meet legal obligations (Article 6(1)(c)). Optional geolocation is activated only after your browser permission and remains on your device.

Recipients and international transfers

Payments are handled by Stripe. Technical hosting providers process the minimum network and security data needed to deliver and protect the service. Where a provider processes data outside the EEA, the relevant contractual safeguards and lawful transfer mechanisms apply.

Retention

The access token, saved route copies and saved items remain on your device until you clear this site’s storage. Daily aggregate analytics are kept for up to 13 months, then deleted or further aggregated. Payment records are retained by Stripe and the controller for the periods required by financial, tax, fraud-prevention and consumer law. Hosting security logs are retained only for the period needed by the relevant provider to operate and protect the service.

Your rights

Depending on the processing, you may request access, correction, deletion, restriction, portability or object to processing. You may also lodge a complaint with the Italian Data Protection Authority or the authority where you live. We may need enough information to verify that a request relates to you.

No advertising profiles

We do not use advertising cookies, cross-site tracking, fingerprinting, visitor profiles or behavioural advertising. We do not sell personal data.