Privacy

In short: this map doesn’t ask for your name, doesn’t ask for your email, doesn’t make you sign up and doesn’t install tracking cookies on your phone. Usage statistics are off.

Who processes the data

Data controller: RUMBA S.r.l., Via Bonanno Pisano 50, 56126 Pisa, Italy. VAT and tax code 02560150506, REA PI-270603. Contact: mailrumbasrl@gmail.com. We have not appointed a Data Protection Officer. Please use the controller’s contact details above.

Usage measurement is off

Usage statistics collection is off. You can search, open the map, use SOS, navigate and manage Saved without accepting it. Enabling collection requires an approved notice, approved rules on purposes, data, access and retention, and your separate choice.

The prepared system accepts only events with fixed fields. It excludes text, contact details, location and health or SOS contexts, including point and service identifiers. Resolved searches mean answers found by the system, not usefulness declared by you. An opening attributed to a QR does not prove a physical scan.

New counts do not store IP addresses, browser types or session identifiers derived from them. To limit abuse, the server may hold a technical network key in memory for at most one minute; it never enters usage statistics. We do not measure people, unique visits or returns.

In the prepared path the server verifies an attributable placement. If an explicit code is invalid, unknown or non-attributable, the entire event is discarded. A request with no code at all remains an unattributed opening.

Local services and corrections

Local-service profiles use professional details read from official sources, with source and date shown; they are not part of the OpenStreetMap dataset. We publish a contact only when its source presents it for professional use. You can suggest a correction without giving a name, account, contact detail or free text: the server creates a daily pseudonymous HMAC code, deleted within 90 days. The report remains an operational fact until it is checked and never changes a profile automatically.

Your location

If you press “Find the closest to me”, your phone asks for permission and the coordinates stay inside your browser, used only to calculate the distance to the points on the map. They are never sent to our systems, never recorded and never shared.

Weather and official sources

MET Norway, CFR Toscana and INGV are candidate providers for the city situation. The providers are blocked: their licence and terms have not been verified, so the server makes no request to them. If they are verified, they will use fixed coordinates for the Lucca city centre, never your personal location. While they remain blocked, an unverifiable source is not turned into an absence of alerts.

AI switchboard on the Hotline

The local layers are always available: safety, shortcuts and deterministic search work without an external supplier. The model isoff by default; this configuration does not show that a supplier has been selected or approved.

The message and history remain in volatile page state and on our server only for the strictly necessary time needed to handle the request. We do not keep them in cookies, a database, localStorage orsessionStorage. If and only if the model is enabled after its supplier, terms and retention have been verified, the gateway will receive the current non-safety message and language—never the history, location, intent, source IDs or corridor IDs. Do not include names, contact details, health data or other sensitive information.

The Hotline emits no analytics events. Abuse controls use only an ephemeral HMAC token, separate from counts and never persisted. The future supplier’s terms and retention period remain to be verified; this notice and the legal basis must be reviewed by a privacy adviser before activation.

External questionnaire

The “Research” page does not embed the questionnaire and does not load Google content. Only if you choose to open it are you taken to Google Forms in a new tab. perdiqua Lucca does not receive or store answers on the “Research” page: read the information shown in the external form before submitting.

Before enabling counts

The legal basis, choice, retention period and minimum reporting threshold still need approval. Technical proposals are not approved decisions. There are no new counts to retain while collection is off.

Reports used to correct a point follow a separate process from usage statistics. That service does not authorize additional collection.

Who else sees them

Vercel provides hosting and server functions; Supabase provides the database, configured in the Frankfurt EU region. They operate under their respective data-processing terms. Vercel states that its primary processing facilities are in the United States and that processing may occur in other locations; for transfers covered by the GDPR, its addendum incorporates the 2021 EU Standard Contractual Clauses. We therefore limit what crosses the hosting layer to the data described on this page.

The map is ours too: the streets are drawn by our own code from OpenStreetMap data stored on our servers. Opening it contacts no external provider, and where you are never leaves your phone.

With collection off, we produce no new usage reports for businesses. Future reports require approved access rules and minimum thresholds. No data is sold.

What stays on your phone

Two things, and neither reaches us: they are kept in this browser’s local storage, on your device, and only the site reads them back, on your phone. They have no expiry: they stay until you delete them, by clearing the site data in your browser settings.

The first is your light or dark theme preference, and you write it by pressing the button. The site reads it back each time you open a page so you don’t start on the wrong theme. It holds nothing about you: it says only “light” or “dark”.

The second is the Saved list. The key mappe.salvati.v1.lucca stores references only — type, identifier and saved date — to the points, guides, events and routes you choose. It copies no titles, text, location or contact data. You can remove one item or use “Delete all saved items” on the Saved page.

These local data support the functions you choose and do not feed usage statistics.

Cookies

This site uses no cookies and no third-party analytics: no Google Analytics, no Meta pixel, no fonts from external servers, not even when you open the map. The two things kept on your device are the ones described above.

The exceptions are actions you choose: if the model is enabled, sending text will make our server contact the verified gateway as explained above; “Take me there” opens Google Maps — in the app if you have it on your phone, otherwise in the browser — with the coordinates of the point you are heading to, not yours; on the events and data pages the references point to the source websites, and a point’s card links to whoever runs it and to the source of its note. You open them; it isn’t something the site does on its own — and they open without telling the other side which page you came from.

Your rights

You can exercise your rights under Articles 15-22 GDPR by writing to mailrumbasrl@gmail.com. You may also lodge a complaint with the Italian Data Protection Authority.

Map data

OpenStreetMap points are distributed under the ODbL 1.0 licence. © OpenStreetMap contributors. Curated local services and partner businesses are proprietary data: they are neither attributed to OpenStreetMap nor included in the ODbL download. When we make field checks, they will go back to OpenStreetMap with their date.

Every point carries the date of the last known check: some are recent, some are many years old, and that is exactly why the date is printed next to the point. A point can change at any time — a fountain may be closed for maintenance. If you find an error, the “Is it working? No” button on the card is the fastest way to tell us.