Smart Tour Builder

English · 2026-07-22-v1

Review status. Translation · the Italian source controls · advanced non-final draft. I segnaposto visibili devono essere compilati prima del rilascio.

Smart Tour Builder — public legal package

Status: advanced draft subject to legal and linguistic review Version: 2026-07-22-v1 Effective date: [[DATA_EFFICACIA]]

1. Traveller terms

Smart Tour Builder is supplied by [[TITOLARE]], registered at [[SEDE]], registration/VAT [[REGISTRO/P.IVA]]; legal contact [[EMAIL_LEGALE]], privacy contact [[EMAIL_PRIVACY]]. Accounts are for adults aged 18 or over. The adult self-declares this before Google or Telegram authentication; no birth date or identity document is collected for this purpose. Provider accounts are never silently merged by email.

The platform converts the traveller's story into an editable AI-assisted proposal, suggests reasoned matches and supports a direct agreement. It is not a travel agency, tour operator, insurer, employer or payment intermediary. An AI proposal may be inaccurate; matching is not certification, cannot be purchased and makes no final decision. Guide availability and all practical claims require manual confirmation.

A request is not a booking. A tour is confirmed only when traveller and guide separately approve the same version, including date, place, participants, price, payment, cancellation, inclusions, accessibility, safety and contacts. Payment, invoices, refunds and performance remain directly between the parties. Mandatory consumer rights remain unaffected.

Users retain their content and grant only the limited technical licence required to operate, secure and defend the service. Authentic reviews may follow a recorded interaction. Fraud, harassment, discrimination, impersonation and disclosure of private data are prohibited. Proportionate warnings, restrictions, suspensions or removals must state the rule, essential facts, scope, duration and appeal route, unless law or safety requires a limitation. This is not an emergency service.

Applicable law: [[LEGGE_APPLICABILE]]; forum: [[FORO]], without removing mandatory protection in the consumer's country. Material changes are notified and require fresh acceptance when the contractual relationship changes.

2. Guide pact

The guide acts independently and declares professional/trader status, public identity, local qualifications, insurance where required, tax-inclusive price information and cancellation terms. “Declared” never means “verified”. The guide manually evaluates each request, supplies legally required pre-contract information, communicates only with the adult account holder and may not reuse traveller data for marketing or unrelated archives. Ranking follows compatibility, never payment. Moderation and termination are reasoned and appealable.

3. Guide–traveller agreement

The final summary identifies version and parties, the guide's trader status, date/time, meeting point, duration, participants, language, service, price/currency/tax, payment and deposit, cancellation/refund, inclusions/exclusions, accessibility and safety matters, contacts, complaints and applicable law. Every change creates a new version and clears prior confirmations. The platform preserves evidence of the process but is not a party or guarantor.

4. Privacy notice

Controller: [[TITOLARE]], [[SEDE]], [[EMAIL_PRIVACY]]; lead authority: [[AUTORITÀ_CAPOFILA]]. We process identity/provider identifiers, security session data, profiles and optional preferences, tour stories and versions, requests/messages/agreements, guide professional data and managed photos, reviews/reports/appeals, typed product analytics and minimised technical logs.

Proposed legal bases are contract/pre-contract for core service; explicit consent for optional information that may reveal health or accessibility; documented legitimate interests for first-party analytics, security and trust, with objection where applicable; and legal obligation/defence of claims. Optional consent can be withdrawn and saved accessibility data removed. No advertising, fingerprinting or session replay is used.

Recipients include the selected guide and [[HOST_E_PAESE]], Google, Telegram, OpenRouter, [[MODEL_PROVIDER]], OSM/Nominatim and [[MONITORING_TOOL]]. Before OpenRouter, internal IDs, email, phone, URLs and tokens are redacted; ZDR, no-training and an approved provider/model allowlist are required. Some identity and AI providers may process outside the EEA under [[MECCANISMO_TRASFERIMENTO]]; if no approved endpoint exists, a local fallback is used.

Initial retention: sessions 30 days; incomplete verification 24 hours; unused proposals 12 months; closed requests without agreement 24 months; confirmed agreements and relevant messages 5 years; reports/decisions/appeals 5 years; raw product analytics 180 days; AI audit without prompt/output 12 months; raw monitoring 30 days; security logs 90 days; read notifications 180 days (maximum 12 months); public links 30 days plus seven for deletion; encrypted EU backups rotate at 30 days. A reasoned legal hold pauses deletion only for involved records.

Data subjects may use account tools or [[EMAIL_PRIVACY]] for access, correction, erasure, restriction, portability, objection and consent withdrawal, and may complain to the competent authority. Matching is descriptive profiling without legal or similarly significant automatic effects; both people remain in control. No minor may hold an account.

5. Cookies and monitoring

Only strictly necessary Better Auth session, security and OAuth-state cookies are used. Product analytics stay in platform PostgreSQL and can be opposed in settings. The EU self-hosted monitor receives only a normalised route, duration band, error code and rounded hour—never user, tour or request IDs, query strings or user text.

6. Community, reports and appeals

Reports receive a reference and ordinary/urgent triage. Decisions are human-readable and proportional. Appeals may be filed within six months, are acknowledged immediately, triaged within two working days (24 hours for urgent risk), and decided within 14 calendar days or 30 with reasons. Human review should use a different reviewer where practicable. Outcomes are uphold, modify or revoke; revoked measures are restored promptly. Courts, authorities and applicable ADR remain available.

7. Children

Only adults create accounts, contact guides and confirm agreements. The adult may provide only the number/age band and strictly necessary practical needs of minor participants—never unnecessary names, contacts, documents or school details. The guide communicates with the adult and does not reuse those data.

8. Version history

  • 2026-07-22-v1: advanced integrated draft covering adult access, Better Auth, AI transfers and safeguards, retention, direct agreements, moderation and appeals.