Privacy Policy

This Privacy Policy explains how Flavors and Tales ("we", "us") collects and uses personal information when you visit flavorsandtales.com, contact us, or book a tour or cooking class. We process personal data in accordance with the EU General Data Protection Regulation (Regulation (EU) 2016/679, "GDPR").

1. Who we are

Flavors and Tales is a small, family-run tour operator based in Rome, Italy. For any privacy-related question you can reach us at flavorsandtalescontact@gmail.com or by phone at +39 344 7413392.

2. What we collect

Depending on how you interact with us, we may collect:

• Contact details — your name, email address, phone number, and country of residence, when you submit a contact or custom experience request.
• Booking details — the experience you booked, date, number of guests, and any notes you share with us.
• Payment details — payments are processed by Stripe. We do not see or store your full card number; we only receive a confirmation, the amount, and a transaction reference.
• Communications — the content of emails, form submissions, and messages you send us.
• Technical data — basic information your browser sends when you visit the site (IP address, browser type, pages visited) for security and troubleshooting purposes.

3. Why we use it (legal bases)

• To fulfil your booking (Art. 6(1)(b) GDPR — performance of a contract): to confirm your reservation, send you practical information, take payment, and provide the experience.
• To answer your enquiry (Art. 6(1)(b) and 6(1)(f) GDPR): to reply to messages and design custom itineraries.
• To send you a post-experience follow-up email (Art. 6(1)(f) GDPR — legitimate interest): a short thank-you and feedback message after your tour. You can opt out at any time by replying to the email or writing to us.
• To comply with legal obligations (Art. 6(1)(c) GDPR): e.g. tax, accounting, and consumer-protection rules.

4. Who we share it with

We only share personal data with trusted service providers who help us run the website and the booking experience, and only to the extent necessary:

• Stripe Payments Europe, Ltd. — payment processing. See stripe.com/privacy.
• Lovable — website hosting, database, and managed email delivery. See lovable.dev.

Some of these providers may process data outside the European Economic Area. When they do, they rely on the safeguards recognised under GDPR (such as Standard Contractual Clauses).

We do not sell your personal data, and we do not share it with advertisers.

5. How long we keep it

• Booking and payment records: for as long as required by Italian tax and accounting law (typically 10 years).
• Contact-form and custom-request messages: up to 24 months from the last exchange, unless they lead to a booking.
• Server and security logs: a short technical window, typically not more than 12 months.

6. Your rights

Under GDPR you have the right to access your data, correct it, ask us to delete it, restrict or object to certain uses, and request a copy in a portable format. To exercise any of these rights, write to flavorsandtalescontact@gmail.com. You also have the right to lodge a complaint with the Italian data protection authority (Garante per la protezione dei dati personali — garanteprivacy.it).

7. Cookies

The site uses a small number of cookies and similar technologies. See the Cookie Policy for details.

8. Changes to this policy

We may update this policy from time to time. When we do, we will change the "Last updated" date at the top of the page.