Privacy notice

Who the controller is

The data controller is Cristian Cosenza, VAT IT06821690820.

For any question about your data: hello@bionicgecko.com. Data protection officer: not appointed, as none is required for this processing.

Your location

We ask for it only when you press the button, never when a page opens. If you say no, the site works all the same: pick the city or your starting point by hand.

We ask the browser for an approximate position, not the high-accuracy one. We keep it in memory in the open tab and send it to our server with your search, to work out walking minutes and plan the walk. We do not save it in a database, and the logs we write record the page address without the parameters that carry the coordinates.

If you share a walk that starts from your location, your hotel or an address, the link stores that point rounded to about 100 metres, so it does not point at a particular room.

The planner remembers your last request in the tab's own storage (sessionStorage), so a reload does not lose it. It goes away when you close the tab.

Itineraries and shared links

When you share a walk we save a copy of the request, the plan and the text that describes it, tied to a random code in the link. Anyone with the link can open it. The copy deletes itself after 30 days.

Itineraries the site saves for you also expire after 30 days, and they do not contain the point you started from. We delete expired ones within the following week.

What you write to the agent

What you write to the travel agent (for example "I have four hours and I like food") goes to a language model on Cloudflare Workers AI, which turns it into the settings for your walk. We do not save that text. Please leave personal details out: they are not needed.

Claims and corrections

• To claim a listing you give us your name and email and, if you like, a phone number, your role, a message and a link that shows you run the business.
• To suggest a correction you tell us which detail is wrong and the right one and, if you like, a note and your email.

We use these details only to handle the request: to understand who you are, update the listing and reply to you. A person reads them. We never open the link you send as evidence automatically: whoever reviews the request checks it.

The legal basis is your request for claims (Art. 6(1)(b) GDPR) and our legitimate interest in accurate data for corrections (Art. 6(1)(f) GDPR). We keep them for 12 months after the request is closed; after that we delete the name, email, phone and message.

Protection from abuse

The forms use Cloudflare Turnstile to tell people from automated programs. The check runs in your browser and is served by Cloudflare, which also receives your IP address from us for the verification.

To limit abuse we count how many requests come from each IP address within a time window. Each counter deletes itself shortly after its window ends, after one hour and one minute at most.

Statistics

We do not use Google Analytics or any other analytics or advertising tool. We only keep daily totals: how many walks are requested, planned, adjusted and shared, how the "Useful?" question is answered, how often a stop turns out to be closed, and how many clicks each place's directions, website, booking and phone links get. None of these counts holds anything that identifies you.

Cookies

We use one cookie, nowvisit_locale, which remembers the site language and lasts a year. It is a technical cookie, so it needs no consent. We use no profiling cookies.

Who else processes data

• Cloudflare: hosts the site, the database, the language model and Turnstile. Every request to the site goes through its servers. Where data passes through Cloudflare servers outside the European Union, the transfer is covered by Cloudflare's data processing addendum, which includes the European Commission's Standard Contractual Clauses.
• OpenFreeMap: your browser downloads the map tiles from it, so OpenFreeMap sees your IP address.
• Photon (komoot), the OpenStreetMap-based address search: when you look up a hotel or an address, our server sends it the text you searched, so it does not see your IP address.

Images and fonts are served from our own domains: no requests to Google Fonts or other services.

Your rights

You can ask us to see, correct or delete your data, to restrict or object to its processing, and to receive it in a readable format (Arts. 15–22 GDPR). Write to hello@bionicgecko.com.

You can also complain to the Italian data protection authority, the Garante per la protezione dei dati personali.

Changes

If we change this notice we update the date at the top of the page. The terms of use are on the Terms page.