Privacy Policy

Sokufy is a Sicilian business-discovery and tourism platform, operated by [COMPANY LEGAL NAME], a company registered in Italy at [REGISTERED ADDRESS], VAT / P.IVA [VAT/P.IVA](“Sokufy”, “we”, “us”). We are the data controller for the personal data described in this policy.

Questions about this policy or your data can be sent to [CONTACT EMAIL].

We collect the following categories of personal data:

• Account data — the email address, username, and any first name, last name, bio, website, or profile photo you choose to add when you create a Sokufy account.
• Authentication data — your password is hashed and stored by our authentication provider, Supabase; we never see or store it in plain text.
• Content you submit — experiences, events, places, photos, videos, reviews, and any contact details (email, phone, booking links) you publish when listing a business or activity on Sokufy. This content may be visible to other users and, where noted in this policy, to search engines.
• Usage data — technical information such as your IP address, browser and device type, pages visited, and timestamps, collected automatically to keep the service secure and working. See our Cookie Policy for the specific cookies involved.
• Approximate location— if you grant permission in your browser, the map may use your device’s approximate location to show experiences near you. You can decline this and browse the map manually at any time.
• Booking and transaction data — if and when Sokufy launches paid bookings, ticketing, or reservations, we will collect the data needed to process that transaction (e.g. names, contact details, booking references). Payment card details are handled directly by our payment processor and are never stored on our servers. We will update this policy before that feature goes live.

• Performance of a contract (Art. 6(1)(b) GDPR) — to create and run your account, show you the experiences you save, and let you publish listings.
• Legitimate interest (Art. 6(1)(f) GDPR) — to keep Sokufy secure, diagnose and fix bugs, and understand how the platform is used so we can improve it.
• Consent (Art. 6(1)(a) GDPR) — for anything non-essential, such as future analytics or marketing cookies. You can withdraw consent at any time — see our Cookie Policy.
• Legal obligation (Art. 6(1)(c) GDPR) — where we are required to keep certain records, for example for tax or accounting purposes once bookings/payments are live.

We do not sell your personal data. We share data only with:

• Supabase (our database, authentication, and file-storage provider), with data stored on infrastructure located in the European Union.
• Error-monitoring and diagnostics tools (e.g. Sentry), which may receive technical data such as your IP address, device/browser type, and the page you were on when an error occurred, so we can find and fix bugs.
• Payment processors, once paid features launch, solely to process the transaction you initiate.
• Authorities, where required by Italian or EU law.

All of the providers above are bound by data processing agreements and, where they sit outside the EU/EEA, appropriate safeguards (such as Standard Contractual Clauses).

We keep account data for as long as your account is active. If you delete your account, we delete or anonymise your personal data within a reasonable period, except where we are legally required to retain it for longer (e.g. tax or accounting records). Content you have published (such as an experience listing) may be retained if it has been shared, reused, or attributed to other users, unless you request its removal.

Under the GDPR, you have the right to:

• Access the personal data we hold about you;
• Correct inaccurate or incomplete data (rectification);
• Request deletion of your data (erasure);
• Restrict or object to certain processing;
• Receive your data in a portable format (data portability);
• Withdraw consent at any time, where processing is based on consent.

To exercise any of these rights, contact us at [CONTACT EMAIL]. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la Protezione dei Dati Personali) at garanteprivacy.it, or with your local supervisory authority if you are based elsewhere in the EU/EEA.

Sokufy is not directed at children under 16, and we do not knowingly collect personal data from them. If you believe a child has provided us with personal data, contact us at [CONTACT EMAIL] and we will delete it.

We use industry-standard technical and organisational measures — including encryption in transit, access controls, and row-level security on our database — to protect your data. No system is completely secure, but we work to keep your data as safe as possible.

We may update this policy as Sokufy evolves (for example, when we launch paid bookings). We will post the revised version here with an updated “Last updated” date, and where changes are material we will make reasonable efforts to notify you directly.

For any question about this Privacy Policy or your personal data, write to [CONTACT EMAIL].