Privacy Policy
Last updated: October 1, 2026
This page is also available in Italian, French, Spanish and German. In the event of any discrepancy, the Italian version prevails.
1. Data controller
Davide Bertolino — Italian VAT no. 04011280049
Email: hello@museoguida.com
Website: www.museoguida.com
2. Scope
This policy describes how MuseoGuida collects, uses and protects the personal data of users of www.museoguida.com and of the MuseoGuida platform, under Regulation (EU) 2016/679 (GDPR) and the Italian data protection legislation applicable to the controller.
3. Categories of data collected
3.1 Data you provide
Website contact form: full name, email address, museum name, plan of interest, message. This data is sent by email to the controller and is not stored in any database.
Platform registration: full name of the contact person, email address, museum name, museum address, billing details (for paid plans).
Activating the Free plan from the website: in addition to the registration data, who owns the guide (an organisation or a private individual) and its name, the tax code or VAT number (for a private individual, their tax code), the town and province of the venue, the role of the person signing up on behalf of an organisation, an optional website or certified email address, and the date and time when the Terms and the statement on content rights were accepted. They tell us who the other party to the contract is and who is responsible for the published content. Until the email address is confirmed this data is not stored: it travels encrypted inside the confirmation link, which expires after 24 hours. The IP address is not linked to the registration.
Content uploaded by the museum: texts, images and audio files relating to the works. This content belongs to the museum and is processed by the controller solely in order to provide the service. If the museum uses the artificial intelligence features, the texts it submits are sent to the providers listed in section 5 solely to be processed.
3.2 Data collected automatically
Server logs: IP address, date and time of the request, page visited, browser user agent. This data is collected automatically by the server for security and diagnostic purposes and is kept for a maximum of 30 days.
Museum visitor browsing data: when a visitor scans a QR code and opens the guide for a work, the following are recorded: date and time, language selected, work or route viewed, event type (opening, start and end of playback) and listening duration in seconds. A random session identifier is also generated, stored in the browser's sessionStorage and erased when the tab is closed: it stops the same visit being counted more than once and does not allow the visitor to be recognised on a later visit or on any other site. Neither the visitor's IP address nor their device type is recorded. No data identifying the visitor is collected. No profiling cookies are used.
Data saved on the visitor's device: the guide saves in the visitor's browser storage (localStorage) the language they chose (museoguida_lang); if they follow a tour, which tour, the stop they have reached, the stops already visited, the name and number of stops of the tour and whether they have completed it (museoguida_path); whether they have closed the invitation to install the guide on their phone (museoguida_install_dismissed). This saves them making the same choices again and lets them resume the tour where they left off. This information stays on the device, is not sent to the server and is deleted by clearing the site data in the browser settings. The browser also keeps a copy of the texts, photos and audio already opened, so that they load faster and are available without a network: this is the venue's content, not visitor data. As this information is strictly necessary for a function requested by the visitor, saving it does not require their consent (Article 122 of the Italian Personal Data Protection Code).
3.3 Data NOT collected
MuseoGuida does not collect:
- Profiling or third-party cookies for advertising purposes
- Biometric data
- Location data of museum visitors. The guide can show visitors where they are on the venue map, but only if they tap “You are here” and allow the browser to do so: the position stays on the phone, is never sent to MuseoGuida's servers, is not stored and appears in no statistics.
- Personal data of museum visitors (no registration is required)
MuseoGuida's pages load no resources from external content delivery networks: typefaces and JavaScript libraries are served from MuseoGuida's own server. The photos and audio of the guides also come from MuseoGuida's server, which fetches them from the storage (section 5) on the visitor's behalf: the storage receives the server's requests, not the visitor's. A visitor's IP address is therefore not disclosed to any third party merely by opening a page or a guide. One thing alone leads out of MuseoGuida, and only if the visitor taps it: the “Get directions” button on the information page, which opens the maps application chosen on the phone (on a computer, OpenStreetMap). From that moment on, that application's own privacy policy applies.
4. Purposes and legal bases
| Processing | Purpose | Legal basis |
|---|---|---|
| Contact form | Responding to commercial enquiries | Legitimate interest (Art. 6(1)(f) GDPR) |
| Platform registration | Providing the service | Performance of a contract (Art. 6(1)(b) GDPR) |
| Billing data | Tax and accounting obligations | Legal obligation (Art. 6(1)(c) GDPR) |
| Uploaded content (works) | Providing the audio guide service | Performance of a contract (Art. 6(1)(b) GDPR) |
| Server logs | Security and diagnostics | Legitimate interest (Art. 6(1)(f) GDPR) |
| Artificial intelligence features (at the museum's request) | Rewriting, translating and speech synthesis of the museum's content | Performance of a contract (Art. 6(1)(b) GDPR) |
| Visit statistics (anonymous) | Providing analytics to the museum | Performance of a contract (Art. 6(1)(b) GDPR) |
5. Recipients of the data
Personal data may be disclosed to:
- Contabo GmbH (Aschauer Straße 32a, 81549 Munich, Germany) — server hosting. The data resides on servers located in the European Union.
- Cloudflare, Inc. — domain DNS management and TLS certificate issuance; storage of images, audio files and database backups on Cloudflare R2, in buckets with EU jurisdiction, which Cloudflare keeps in data centres in the European Union. Backups are encrypted and kept in storage separate from the images and audio files, not reachable from the Internet. Cloudflare is certified under the EU-U.S. Data Privacy Framework. MuseoGuida does not use Cloudflare as a CDN or for DDoS protection: the site and the guides point directly to MuseoGuida's server, and only the server talks to the storage.
- Plus Five Five, Inc., trading as Resend (2261 Market Street #5039, San Francisco, CA 94114, United States) — delivery of service email: panel notifications, password resets, Event package expiry warnings. Resend's servers are located in the United States. Resend is certified under the EU-U.S. Data Privacy Framework.
- Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) — the mailbox that receives messages sent through the contact form is hosted on Gmail.
- Mistral AI SAS (15 rue des Halles, 75001 Paris, France) — processor for rewriting, translating and English and French speech synthesis of the texts submitted by the museum. Processing takes place on European infrastructure with zero data retention: texts are not retained after processing.
- Microsoft Ireland Operations Limited (One Microsoft Place, South County Business Park, Leopardstown, Dublin 18, Ireland) — processor for speech synthesis in Italian, German and Spanish (Azure Speech). Processing takes place in the West Europe region of the European Union and texts are not logged.
Personal data is never sold, transferred or shared with third parties for their own purposes.
6. Transfers to third countries
Personal data resides on Contabo servers located in the European Union (Germany).
The Cloudflare and Resend services may involve a transfer of data to the United States, on the basis of the following safeguards:
- EU-U.S. Data Privacy Framework — adequacy decision of the European Commission of 10 July 2023 (Decision 2023/1795). Both Cloudflare and Resend are certified on the DPF list.
- Standard Contractual Clauses (SCCs) — incorporated into the contracts with both providers.
Since 29 September 2026 images, audio files and backups are stored on Cloudflare R2 under EU jurisdiction: Cloudflare keeps them in data centres in the European Union. Cloudflare, Inc. remains a U.S. company: the safeguards above apply to the management of the service. Until 29 October 2026 a copy of the images and audio files uploaded before 29 September also remains in the previous storage, located in Eastern Europe without a jurisdiction guarantee and no longer reachable from the Internet; it is deleted after that date.
Mistral AI and Microsoft Azure Speech process data in the European Union. The parent company Microsoft Corporation is in any case certified under the EU-U.S. Data Privacy Framework. Google Ireland Limited processes data in the European Union; the parent company Google LLC is certified under the EU-U.S. Data Privacy Framework.
7. Data retention
| Category | Retention period |
|---|---|
| Contact form data | Not stored (email only). The email is kept for as long as is needed to handle the enquiry. |
| Registration data | For the duration of the contract. Deleted within 30 days of the account being closed. |
| Billing data | 10 years from the invoice date (Italian statutory bookkeeping obligation). |
| Uploaded content (works) | For the duration of the contract. Deleted within 30 days of the account being closed, after notice to the customer so the data can be exported. |
| Server logs | 30 days maximum. |
| Database backup copies | Automatic rotation: every copy for 7 days, then one per day for 16 days, one per week for 8 weeks, one per month for 4 months, one per year for 2 years. Data deleted from the panel therefore remains in a backup copy until those periods expire. |
| Texts sent to artificial intelligence services | Not retained by the providers after processing. MuseoGuida keeps the proposals and the text history for the duration of the contract. |
| Visit statistics | For the duration of the contract. Exportable as CSV from the dashboard on the Pro, Full and Event plans. |
8. Cookies
The www.museoguida.com website and the MuseoGuida platform use only technical cookies necessary for the service to work (session, authentication). No profiling cookies, no third-party advertising cookies and no tracking tools such as Google Analytics or Facebook Pixel are used.
No consent is required for strictly necessary technical cookies under Directive 2002/58/EC (ePrivacy) as transposed into national law.
9. Your rights
Under Articles 15 to 22 GDPR you have the right to:
- Access (Art. 15): obtain confirmation that processing is taking place and access your data.
- Rectification (Art. 16): have inaccurate data corrected.
- Erasure (Art. 17): have your data deleted.
- Restriction (Art. 18): have the processing restricted.
- Portability (Art. 20): receive your data in a structured format.
- Objection (Art. 21): object to processing based on legitimate interest.
To exercise these rights, write to: hello@museoguida.com
We respond within 30 days of receiving the request.
10. Lodging a complaint
You have the right to lodge a complaint with the supervisory authority of the EU Member State where you live, work, or where the alleged infringement took place.
As the controller is established in Italy, the lead supervisory authority is:
Garante per la Protezione dei Dati Personali
Piazza Venezia 11 — 00187 Rome, Italy
www.garanteprivacy.it — garante@gpdp.it
11. Changes
This policy may be updated. You are invited to check this page from time to time. The date of the last update is shown at the top.