Complete information on how CoFloor processes your personal data.
Riccardo Peter Corti
Lecco, Italy
Email: info@cofloor.it
Website: https://cofloor.it
The Data Controller determines the purposes and means of processing the personal data of users who access CoFloor's website and services.
Payment card details (card number, IBAN, etc.) are never stored on CoFloor servers. All payment processing is handled exclusively by Stripe, Inc., certified PCI DSS Level 1. CoFloor only receives confirmation of the transaction outcome.
| Purpose | Legal Basis | GDPR Article |
|---|---|---|
| Providing the CoFloor service (account management, AI Aria) | Performance of a contract | Art. 6(1)(b) |
| Payment processing via Stripe | Performance of a contract | Art. 6(1)(b) |
| Tax and accounting obligations | Legal obligation | Art. 6(1)(c) |
| Statistical usage analysis (Google Analytics, Hotjar) | Consent | Art. 6(1)(a) |
| Platform security and fraud prevention | Legitimate interest | Art. 6(1)(f) |
| Service communications and updates | Legitimate interest | Art. 6(1)(f) |
Where processing is based on consent, you have the right to withdraw it at any time without affecting the lawfulness of processing carried out before withdrawal.
| Data Category | Retention Period |
|---|---|
| Account data (name, email) | Duration of contractual relationship + 2 years after closure |
| Accommodation/property data | Duration of contractual relationship + 1 year |
| AI Aria conversations | 12 months from each session |
| Payment records (Stripe) | 10 years (Italian tax obligations) |
| Navigation and security logs | 90 days |
| Analytics data (Google Analytics) | 14 months (default GA4 configuration) |
| Session recordings (Hotjar) | 365 days |
At the end of the retention period, data is permanently deleted or irreversibly anonymised.
CoFloor does not sell or share your personal data with third parties for marketing purposes. Data is shared only with the following parties, to the strictly necessary extent:
| Party | Role | Purpose | Location |
|---|---|---|---|
| Supabase, Inc. | Data processor | Database, authentication, storage | USA (EU servers) |
| Stripe, Inc. | Data processor | Payment processing | USA |
| Google LLC (Analytics) | Data processor | Traffic analytics | USA |
| Hotjar Ltd. | Data processor | Behavioural analytics, heatmaps | Malta (EU) |
| Competent authorities | Independent controller | Legal obligations, authority orders | Italy / EU |
A Data Processing Agreement (DPA) pursuant to Art. 28 GDPR has been entered into with all data processors.
Some of our service providers (Google, Stripe, Supabase) are based in the United States. Data transfers are carried out in compliance with Arts. 45–49 GDPR, relying on:
You may request a copy of the transfer mechanisms in place by writing to info@cofloor.it.
CoFloor integrates an artificial intelligence assistant called Aria, designed to help hosts manage guest communication and create property content.
Conversations with Aria may contain property-related data (name, address, rules, guest messages). This data is used solely to generate in-session responses and improve the service. It is not used to train third-party AI models without explicit consent.
Aria messages are retained for 12 months from the session date, after which they are deleted. You may request early deletion at any time by writing to info@cofloor.it.
CoFloor's service is intended exclusively for individuals aged 18 or over. We do not knowingly collect personal data from minors. If you believe a minor has provided personal data, please contact us at info@cofloor.it and we will promptly delete it.
As a data subject, you have the following rights under Arts. 15–22 GDPR:
To exercise your rights, write to info@cofloor.it with subject line "GDPR Rights Request". We will respond within 30 days of receipt.
You may also file a complaint with the Italian Data Protection Authority (Garante Privacy):
Piazza Venezia 11, 00187 Rome, Italy — www.garanteprivacy.it
CoFloor reserves the right to update this Privacy Policy at any time. Material changes will be communicated by email to the registered address or via a prominent notice on the platform, with at least 14 days' advance notice. The date of the last update is always shown at the top of this page.
Riccardo Peter Corti
Lecco, Italy
Email: info@cofloor.it
Website: https://cofloor.it
For any questions about how we process your personal data, please don't hesitate to get in touch.