Privacy notice
Version 0.1, 26 September 2026 · under Articles 13 and 14 of Regulation (EU) 2016/679 (GDPR)
- Properties only see your first name. Your surname, email and phone reach a property only when you accept its offer.
- We do not sell your personal data. We only email you about deals (member-only offers from properties, events) if you ask for it with the optional box in the form, and you can unsubscribe with one click.
- We also use requests and quotes for aggregated, anonymous statistics (for example: the median price of an area in a given period). No person and no single property can be identified.
- No profiling or tracking cookies.
- You can ask at any time to see, correct or delete your data: info@direvya.com.
1. Who is the data controller
[titolare da indicare: nome e cognome o ragione sociale], [indirizzo da indicare] (“Direvya”, “we”). For any privacy question: info@direvya.com.
2. What data we process
If you make a request (traveller)
- first and last name, email, phone (optional);
- trip details: area, dates, number of adults and children’s ages, rooms, meal plan, flexibility, notes, budget (the budget is never shown to properties);
- if you give them: the link to the property on a travel site, and the price and terms you saw there;
- if you upload a screenshot of the travel site: the image is read to pre-fill the form and is not stored;
- offers received, the offer you accepted, your answers to our questions (why you chose an offer, how the stay went);
- technical data: an encrypted fingerprint of your IP address (not the IP itself), date and time of consent, data needed for the anti-bot check.
If you run a property
- property name, location, email, phone, website, links to travel sites, national identification code (CIN);
- replies to requests: availability, prices, terms, uploaded photos, confirmations;
- the emails you send us.
We collect properties’ contact details from public sources (the property’s website, public directories and travel sites) or from a traveller who wants a quote from that property. We only use business contact details.
3. Why we process data and on what legal basis
| Purpose | Legal basis | Retention |
|---|---|---|
| Forwarding your request to properties, showing you the offers, handling acceptance and confirmation, sending you service emails | Performance of the service you ask for (Art. 6(1)(b) GDPR) | Up to 24 months after the departure date |
| Verifying your email, preventing abuse and spam, keeping the service secure | Legitimate interest (Art. 6(1)(f)) | As above; requests never confirmed: 30 days |
| Asking after the stay whether it took place and how it went; measuring service quality | Legitimate interest (Art. 6(1)(f)) | As above |
| Writing to a property to ask for a quote for a real guest | The property’s and our legitimate interest in offering it direct guests (Art. 6(1)(f)); it can object at any time | Until the property objects |
| Aggregated, anonymous statistics (section 4) | Legitimate interest (Art. 6(1)(f)), compatible purpose (Art. 89) | Personal data follows the periods above; anonymous aggregates are not personal data |
| Sending you Direvya deals (member-only offers, events), only if you ticked the optional box and confirmed your email. We pick what to send based on the area and group of your requests (for example: with children) | Consent (Art. 6(1)(a)), which you can withdraw at any time with the link in every email | Until you unsubscribe; afterwards we only keep the address and date to respect your choice |
| Telling you on WhatsApp when the first offer arrives, only if you tick the optional box in the form (the message goes through Meta’s WhatsApp Business and contains your first name, request code, area and link) | Consent (Art. 6(1)(a)), which you can withdraw by writing to us | Same as the request data |
| Reminding you once a year that you can send the same request again with the dates already moved: only if you accepted an offer or subscribed to deals | Legitimate interest for customers (Art. 130(4) Italian Privacy Code) or consent for subscribers; you can opt out with one click from the link in every reminder | Same as the request data; after you opt out we keep only the address and the date |
| Legal obligations (tax, accounting, requests from authorities) | Legal obligation (Art. 6(1)(c)) | As long as the law requires (usually 10 years for accounting records) |
4. Aggregated, anonymous statistics
Every request produces information nobody else has: several properties, for the same dates and guests, make a real offer. Direvya uses this data, after aggregating it and making it anonymous, for statistics on prices and demand (for example median prices, response times, average difference from travel sites, reasons for choosing) and for analytics services it may also offer to third parties, in particular to accommodation providers.
- Aggregates never contain names, contact details or any data that could identify a traveller.
- An aggregate is shown only if it combines data from at least 5 different properties; no data about a single competing property and no real-time data.
- Travellers’ personal data is never sold or transferred, not even in derived form.
- A property sees its own data (requests received, replies, outcomes) in its private area.
You can object to this processing by writing to info@direvya.com.
5. Who we share data with
- Properties we forward your request to: they receive your first name, dates, guests, meal plan and notes (without contact details). Only when you accept an offer does that property receive your full name, email and phone to handle the booking: from then on it processes them as an independent controller.
- Providers working for us (processors, Art. 28): hosting and database (Railway); sending and receiving email (Resend); DNS, anti-bot protection, backups and some AI models (Cloudflare); email address verification (MailValid); automatic reading of screenshots and of properties’ emails with AI models (depending on availability: Google Gemini, Groq, OpenRouter, Mistral, xAI, Cloudflare Workers AI); error reporting (Sentry, if enabled).
- Map and photo services (Google Maps Platform, OpenStreetMap/Nominatim): they only receive property and place names, never traveller data.
- AI assistants (for example ChatGPT or Claude): if you make the request through an assistant, that service processes data under its own privacy notice, as an independent controller.
- Authorities, when required by law.
6. Transfers outside the European Union
Some providers are based, or have servers, outside the EU (in particular in the United States). In those cases the transfer relies on an adequacy decision (EU-US Data Privacy Framework, for participating providers) or on the standard contractual clauses approved by the European Commission.
7. How long we keep data
- Requests never confirmed by email: deleted after 30 days.
- Travellers’ personal data (name, email, phone, notes, messages): anonymised 24 months after the departure date. Only the trip details remain, with no link to the person, and are used for statistics.
- Travel-site screenshots: never stored.
- Database backups: overwritten on rotation, after 30 days at most.
- Addresses of those who asked not to receive emails: kept so we can respect the request.
8. Automated decisions
We do not make decisions based solely on automated processing that produce legal effects on you, and we do not profile. AI models are only used to pre-fill fields (which you or the property check) and to read properties’ email replies.
9. Your rights
You can ask for access, rectification, erasure, restriction, portability of your data and object to processing based on legitimate interest (Articles 15–22 GDPR) by writing to info@direvya.com. We reply within one month. You also have the right to lodge a complaint with the Italian data protection authority (garanteprivacy.it) or the authority of your country.
Properties can stop receiving requests at any time with the link in every email or by replying “STOP”.
10. Minors
The service is for adults only. Children’s ages are only used to ask for a correct quote.
11. Cookies
The site uses no profiling, advertising or third-party analytics cookies. We only use strictly necessary technical tools: Cloudflare Turnstile anti-bot protection on the request form and a technical cookie for the admin area. A first-party technical cookie (dv_da, 30 days) only remembers the name of the channel you came from (for example a tourism board’s website), with no personal data. Visit statistics are our own and aggregated: we do not store your IP address and each visitor is an anonymous fingerprint that changes every day, so we cannot recognise you from one day to the next; the data is deleted after 400 days.
12. Changes
If we change this notice we publish the new version here with its date. If the changes are significant, we tell people who have requests in progress.
See also the terms of use.