Privacy Policy
Draft to complete and have reviewed by an adviser before taking real payments. Highlighted parts are placeholders.
1. Data controller
[COMPANY / FULL NAME], [ADDRESS], VAT number [VAT NUMBER], email [PRIVACY EMAIL].
2. What data we collect
| Data | When |
|---|---|
| Email address | When you sign in or buy a lot (we send you the sign-in code) |
| Brand name, slogan, colours, website, chosen building and accessories | When you buy or change a lot: these are public, visible to anyone visiting the city |
| Payment details (name, billing address, last digits of the card) | At checkout: handled by Stripe, we only receive the outcome and what is needed for the invoice |
| Technical data (IP address, browser type, access times) | When you visit the site, in the logs of the providers hosting it |
| Data stored in your browser (sign-in session, preferences) | On your device, through local storage: only to make the site work |
3. Why we use it and on what basis
- Providing the service (account, purchase, showing your lot): performance of the contract.
- Payments, invoices and tax duties: legal obligation.
- Security and preventing abuse (e.g. handling reports about published content): legitimate interest.
- Service messages (sign-in codes, purchase confirmations, important notices): performance of the contract.
- [NEWSLETTER / MARKETING: ONLY WITH CONSENT, IF ANY].
4. Providers processing data for us
| Provider | What it does | Where |
|---|---|---|
| Supabase | Database, accounts and sign-in codes | European Union ([REGION]) |
| Resend | Sending the sign-in emails | [REGION / STANDARD CONTRACTUAL CLAUSES] |
| Stripe | Payments | [REGION / STANDARD CONTRACTUAL CLAUSES] |
| [SITE HOSTING] | Serving the website | [REGION] |
A data processing agreement is in place with each of them. When data leaves the European Union, it does so with the safeguards required by the GDPR.
5. How long we keep it
- Account and lot data: while the lot is active and for [12] months after the account is closed.
- Payment records and invoices: [10] years, as tax law requires.
- Technical logs: [30] days.
6. Cookies and browser storage
The site only uses technical tools needed to work (sign-in session and preferences stored in your browser). We use no profiling cookies and no third-party advertising. [UPDATE IF ANALYTICS OR OTHER SERVICES ARE ADDED].
7. Your rights
You can ask at any time to access, correct or delete your data, restrict or object to its use, or receive it in a portable format, by writing to [PRIVACY EMAIL]. We reply within one month. You can also complain to your data protection authority (in Italy, the Garante per la protezione dei dati personali).
When an account is deleted, the brand name and the other public content of its lots are removed from the city.
8. Children
The service is not meant for anyone under [18].
9. Changes
This policy may be updated: the date at the top shows the latest version. Significant changes will be announced by email.