Privacy Policy

Travel Clever Kit (travelcleverkit.com) is a project operated by Dania Rapone, an individual residing in Italy (Via Cellerano n. 10, Alatri 03011, Frosinone, Italy). The operator is the data controller responsible for your personal data. The operator does not currently have a VAT number (Partita IVA) and is not a registered business; no VAT number or company registration applies at the time of writing. If the operator registers a business in the future, this policy will be updated accordingly.

For any privacy question or request, contact us at daniarapone7@gmail.com.

You can browse Travel Clever Kit without creating an account. The free-guide signup uses the existing Brevo form to collect information you choose to provide, while essential technical information is processed automatically when you browse:

• Email address, when you request the free Italy Travel Survival Guide.
• Your marketing preference, i.e. whether you agreed to receive marketing emails. How evidence of that choice is recorded and retained still needs to be verified before launch.
• Technical data automatically processed by our hosting and font providers to deliver the website, such as your IP address and browser type.

Essential technical processing — legal basis: Our legitimate interests in delivering, maintaining and securing the website (Article 6(1)(f) GDPR), balanced against visitors’ rights and freedoms. This does not authorize optional marketing or nonessential tracking. Necessary hosting logs and technical cookies are described separately from optional visitor analytics in Section 9.

We do not currently offer any payment or checkout system. Premium guide content is locked, and no purchase processing is operational, so no payment or purchase data is collected by Travel Clever Kit. If we introduce purchases in the future, this policy will be updated.

Visitors submit their email address through the existing Brevo signup form and are then redirected to /guide-download, where they download the Italy Travel Survival Guide PDF directly. The guide is not delivered by email. This describes the intended launch flow; the draft pages have not yet been published and a successful full-browser redirect has not yet been verified end to end.

Proposed legal basis: Article 6(1)(b) GDPR (performance of a service at your request). Because the PDF is downloaded directly rather than emailed, whether collecting an email address is necessary for that service must be reviewed before launch; this draft does not treat that assessment as confirmed.

Separately, and only if you tick a separate, initially unchecked box, we will send you travel tips, product updates and promotional offers. This consent is optional: you will receive access to the free guide whether or not you agree. Storage of marketing-consent evidence has not yet been verified.

Legal basis: your consent (Article 6(1)(a) GDPR).

Withdrawing consent: You can withdraw your marketing consent at any time by clicking the “unsubscribe” link in any of our emails or by writing to daniarapone7@gmail.com. Withdrawal does not affect the lawfulness of processing carried out before it.

The following providers support the website and its draft free-guide signup:

• Brevo (Sendinblue SAS, France) provides the existing signup form and email/contact management. The form collects email addresses for guide requests and redirects visitors to /guide-download for a direct PDF download; Brevo does not email the guide. Marketing emails require separate optional consent. Anonymous email measurement is enabled, as described in Section 9. Practical consent-record and deletion arrangements still need verification. See Brevo’s privacy policy.
• Website hosting: this website is hosted through Lovable. According to information supplied by Lovable support, request logs include the requested URL and query string, HTTP method, caller IP address, response status and timing, and approximate country/city. They are used for hosting operations and security, not advertising or user tracking. Lovable does not publish a specific retention period for these request logs; we do not assign one.
• Google Fonts (Google LLC): our website loads the Cormorant Garamond, Inter and Montserrat fonts from Google’s servers. When you visit, your browser contacts Google’s servers, which receive technical information such as your IP address.
• Affiliate partners (Omio and Holafly): if you click an affiliate link, you leave our site and the partner’s own privacy policy applies. These links may include tracking parameters so the partner can credit the referral, and the partner may use its own tracking after you click.

Account-specific provider agreements and processing arrangements remain subject to the checks listed separately below.

We do not sell your personal data.

Planned retention rules: The rules below describe our intended handling at launch. They are not a statement that automatic deletion or inactivity-review mechanisms have been configured or implemented.

Free guide requests: We plan to retain email addresses for up to 90 days after the guide request, unless you have separately opted into marketing. If you opt into marketing, the marketing-contact retention rule applies instead.

Marketing contacts: We plan to retain your email address until you unsubscribe or request deletion, with an inactivity review after 24 months. An inactivity review is not a promise of automatic deletion at 24 months.

Consent records: We plan to retain consent records only as long as reasonably necessary to demonstrate compliance or handle legal claims, if such records are held. Their collection and storage have not yet been verified. Any records retained for these purposes will not be used to continue marketing after withdrawal.

To request deletion, email daniarapone7@gmail.com. We will assess requests for data held in our records and in Brevo, subject to applicable legal requirements and the limited consent-record purposes above. Practical deletion, retention and inactivity-review procedures must be implemented and verified before launch; this draft does not claim they are operational.

Under the GDPR, you have the right to:

• access the personal data we hold about you;
• correct inaccurate data;
• request deletion of your data;
• restrict or object to certain processing;
• receive your data in a portable format;
• withdraw consent at any time.

To exercise any of these rights, contact daniarapone7@gmail.com. We will respond within one month, as required by the GDPR.

We use reputable service providers and limit access to personal data to what is needed to provide our services. No method of transmission over the internet is completely secure, but we take reasonable steps to protect your data.

International transfers may occur when service providers process personal data outside the European Economic Area. Account-specific processing locations and applicable arrangements for Lovable, Brevo and Google still require verification.

Lovable’s official Privacy Policy says Lovable and its service providers process personal data in multiple countries, including the United States. It describes legally recognized transfer safeguards, including the EU Standard Contractual Clauses (Decision (EU) 2021/914) for EEA transfers and transfer impact assessments where required. Its official subprocessor page directs readers to the Trust Center for the full provider list. These are Lovable’s general public statements, not confirmation that a particular agreement, provider location or transfer mechanism applies to this operator’s account.

Optional visitor analytics: The operator has manually switched off Lovable Visitor Analytics in project settings. No Google Analytics or Meta Pixel is currently active, and we do not currently use advertising cookies or tracking pixels on the website. If optional analytics or tracking is introduced, we will update this policy and request consent where required.

Necessary hosting operations: Turning off optional visitor analytics does not turn off the request logs described in Section 5 or necessary technical cookies. Lovable support identified Cloudflare bot-management cookies and deployment-routing cookies used for security and routing to the appropriate deployment. These are distinct from optional analytics or advertising. We have not independently audited every cookie, including those that may be used by the embedded Brevo form, and do not claim this is an exhaustive cookie inventory.

Brevo email measurement: Anonymous email tracking has been enabled in Brevo. Email opens and clicks may still be measured in aggregate, without linking those metrics to individual contacts. This concerns separately authorized marketing emails, not PDF delivery: the guide is downloaded directly. This setting does not establish that consent evidence is stored or deletion procedures are operational.

For privacy questions, write to daniarapone7@gmail.com.

You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali), www.garanteprivacy.it, or with the supervisory authority in your country of residence.

We may update this policy from time to time. The “Last updated” date above shows when it was last changed.

• Verify a successful Brevo submission redirects the entire browser to /guide-download, not only the iframe; the draft does not establish this.
• Review the necessity and legal basis of collecting an email address when the PDF is downloaded directly, separately from optional marketing consent.
• Confirm applicable provider roles, account-specific data processing agreements, processing locations, transfer arrangements and how visitors can obtain information about applicable safeguards.
• Verify how Brevo records the separate marketing choice and any consent evidence, how long necessary evidence is retained and how withdrawals are handled.
• Implement and verify practical guide-request deletion after the intended retention period, marketing inactivity reviews, deletion requests and any limited consent-record retention before launch; none is claimed to be automated.
• Complete a practical cookie review, including the embedded Brevo form. The support-identified technical cookies are not an independently audited full list.
• Lovable has not published a specific request-log retention period. Any further account-specific information remains unconfirmed; no period is invented here.