Privacy notice

Mattia Fato, Bari (Italy) – Marang project.
Contact: ciao@marang.it

• Contact and sign-up forms (hosts, restaurant owners, other businesses): full name, email, phone number, business name and city, number of seats, type of business and the message you choose to send us.
• Concierge management page (hosts only): the information about your property that you enter yourself, for example Wi-Fi, check-in, access, parking, house rules, FAQs and recommended restaurants.
• Technical data: IP address, used only to protect the forms from spam and abuse.

We do not use profiling cookies, or analytics or advertising tools.

• To reply to your requests and assess your joining Marang (legal basis: pre-contractual measures taken at your request, Art. 6(1)(b) GDPR).
• To provide the digital concierge to your guests with the information you enter (performance of the service, Art. 6(1)(b) GDPR).
• To protect the site from spam and abuse (legitimate interest, Art. 6(1)(f) GDPR).

We do not sell your data and we do not use it for newsletters or marketing without your consent.

• Supabase – database (servers in the European Union, Ireland).
• Vercel – website hosting.
• Resend – sending emails: request confirmations, access links to the reserved area, internal notifications. Emails are sent from Resend's servers in Japan, a country recognised by the European Commission as providing adequate data protection.
• Aruba – the ciao@marang.it mailbox (Italy).
• Anthropic – for the concierge only: the property's information and the questions the guest types in the chat are sent to the AI assistant to answer. Marang does not store the conversations.

Some of these providers are based in the United States. Transfers take place with the safeguards required by the GDPR (EU-U.S. Data Privacy Framework or Standard Contractual Clauses).

• Contact requests not followed by a collaboration: up to 24 months, then deleted.
• Data of hosts and partner businesses: for the whole duration of the collaboration, and deleted on request when it ends.

When a guest uses the Marang guide or concierge we collect technical and usage data, including pages visited, businesses viewed, clicks on contact details and maps, and the NFC or QR source the guide was opened from, where present. The source is stored in the browser to link visits to the same session. We do not ask for personal details for normal browsing and we do not use this data for promotional communications.

This data is used to run the service and to measure how well the tags at properties work (legitimate interest, Art. 6(1)(f) GDPR), and is kept for up to 12 months, after which it is deleted or anonymised.

Marang Perk: when a guest requests it we store the pass code, the venue, the property it came from, the request and validation dates and a random device identifier in hashed form (not the IP address), so that the same guest does not get several passes.

Partner restaurants only see aggregated numbers (openings, visits, clicks, passes), also broken down by the property they came from; never data that identifies an individual guest.

We only use first-party technical cookies and the browser's local storage, which are needed for the site to work: no consent is required and we show no banner (Italian DPA guidelines of 10 June 2021). No third-party, analytics or profiling cookies.

• stayio_visit – remembers which tag or QR the guide was opened from, for the Marang Perk and to attribute restaurant visits (14 days).
• stayio_seen – counts one guide opening per device per day (24 hours).
• stayio_device – random device identifier, created only when a Marang Perk is requested (12 months).
• stayio_lang – language chosen (Italian or English) for the guide and the concierge (12 months).
• sb-…-auth-token, stayio_next – reserved area for hosts and restaurants only: login session (until you log out or the session expires) and the page to open after login (1 hour).
• Local storage – last opening per tag (24 hours), a copy of the chosen language, unsaved drafts in the host area.

At any time you can ask to access, correct or delete your data, restrict its use, receive a copy of it or object to its processing, by writing to ciao@marang.it. You also have the right to lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it).

We may update this notice. The date at the top shows the latest version.