Privacy Policy

1. Who we are (Data Controller)

QualeSpiaggia is a service of CAPITA S.R.L., registered office at Piazza Lodovico Cerva 43, 00143 Roma (RM), Italy, VAT no. IT17385951003. For privacy questions, write to privacy@qualespiaggia.com.

Updated: October 14, 2026.

2. Data we collect

We collect only the data strictly necessary for the service. We don't build advertising profiles: ads are handled by Google, and personalised ones only with your consent (section 3).

• Email. When you subscribe to the newsletter, log in via magic link (e.g. for favourites in the apps) or, if we enable paid features in the future, start a Pro trial. Saved in Supabase DB (EU server).
• Google Identity (optional). If you log in with "Continue with Google", we receive email + name from your Google account. No other data.
• Payment data. Today the site and the apps have no paid features. If we enable them in the future, name, email, address and VAT number (for invoices) will be processed directly by Stripe: we will not see or store card data, only the Stripe customer ID and the subscription status.
• Location (optional). If you authorize it in the browser/app, to show you nearby beaches. Remains on your device, never sent to our servers.
• Beach favorites. Saved locally on your device (localStorage). Never sent to our servers.
• Visit statistics. Google Analytics 4 with Consent Mode v2: analytics_storage: denied by default, so no cookies and no user ID. Analytics cookies are only enabled if you consent in the consent message. We only measure aggregate metrics (page views, duration).
• Anonymous beach view counts. For the badge "X people viewed it today" we only save the aggregate number of views per slug per day. No IP, no cookies, no identifiers.

3. Advertising (Google AdSense)

To support a free service, some pages (beach pages, guides, region, province and area pages, "sea today") show Google AdSense ads, provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). The home page and the information and legal pages show no ads.

Google and its partners may use cookies and device identifiers to show ads, measure their results and prevent fraud. Personalised ads and advertising cookies are enabled only with your consent, which we ask for with Google's consent message (an IAB TCF certified platform) on your first visit. If you don't consent you can still use the whole site: Google will at most show non-personalised or limited ads, chosen based on the page content.

You can change or withdraw your choices at any time from the "Cookie settings" link at the bottom of every page. How Google uses data collected on partner sites: policies.google.com/technologies/partner-sites. To manage ad personalisation linked to your Google account: Google Ad Settings.

For the data it collects with its own cookies Google acts as an independent controller, under its own privacy policy; Google may transfer data to the United States under the EU-U.S. Data Privacy Framework. We receive no data from Google that identifies you: only aggregate reports on ads and earnings.

4. Affiliate links (GetYourGuide)

Some pages show a "Things to do" box with affiliate links to GetYourGuide: if you book an experience we earn a commission, at no extra cost to you. They are plain links, marked as sponsored: they load no GetYourGuide scripts or cookies on our pages. If you open them, GetYourGuide's privacy policy applies on its site. Details in Method and sources.

5. External data processors

To provide the service, we use these processors (all GDPR-compliant):

• Hetzner Online GmbH — website hosting (Germany, EU), since October 13, 2026.
• Vercel Inc. — site APIs (favourites, newsletter sign-up), reached through our server (USA, GDPR coverage via SCC).
• Supabase Inc. — email subscriber database (EU server Frankfurt).
• Resend Inc. — transactional email delivery (USA, GDPR coverage).
• Stripe, Inc. / Stripe Payments Europe Ltd. — payments, only if we enable paid features in the future (Ireland, direct GDPR).
• Google Ireland Limited — Analytics 4 (analytics cookies only with consent) and optional OAuth login. For AdSense ads Google is the provider and an independent controller of the data it collects with its own cookies (section 3).
• OpenStreetMap Foundation — map tiles (UK).

6. Cookies and storage

Name	Purpose	Duration
qs_session	Authenticated session (signed JWT)	30 days
FCCDCF, FCNEC	Memory of your choices in Google's consent message	up to 13 months
__gads, __gpi, IDE and other Google cookies	AdSense ads: serving, measurement, fraud prevention (personalisation only with consent)	up to 13 months
_ga, _ga_*	Google Analytics visit statistics (only with consent)	up to 2 years
qs_oauth_state	CSRF token Google OAuth	10 minutes
salento_lang	Preferred language	1 year (localStorage)
salento_favorites	Beach favorites	persistent (localStorage)

7. Legal basis and purposes

• Contract execution (art. 6.1.b GDPR) — to manage sign-ups and, if we enable paid features in the future, Pro trials and subscriptions.
• Consent (art. 6.1.a GDPR) — for the newsletter (single/double opt-in with email confirmation), for visit statistics and for Google's personalised ads and advertising cookies. You can withdraw it at any time, with no consequences on your use of the site.
• Legitimate interest and technical necessity (art. 6.1.f GDPR) — for the technical cookies needed to run the site and remember your choices, for anonymous aggregate measures (beach view counts) and for abuse and fraud prevention.

8. Data retention

• Email subscribers: until unsubscribed (link in every email) or deletion request.
• Stripe events (idempotency), if we enable paid features: 12 months.
• Anonymous view counts: 30 days (automatically deleted).
• Magic link tokens: 15 minutes (deleted after use or expiration).

9. Your rights (GDPR)

You have the right to: access, rectification, deletion, portability, objection, restriction of processing. To exercise them, write to privacy@qualespiaggia.com — we respond within 30 days. You have the right to complain to the Italian Privacy Authority (www.garanteprivacy.it).

Self-service deletion (right to be forgotten): every QualeSpiaggia email contains a "Delete my data" link that leads to /api/v1/erase — immediately anonymizes the account without needing to write to us. For more complex requests (data portability, rectification, objection), continue to write to privacy@qualespiaggia.com.

If we enable Pro subscriptions in the future, you will be able to cancel them from the Stripe Customer Portal accessible from Stripe emails or by writing to us at privacy@qualespiaggia.com.

10. Changes

If we change something significant, we will notify you with a banner on the homepage for 30 days and via email to those subscribed to the newsletter.