Privacy notice

Notice under article 13 of Regulation (EU) 2016/679 (GDPR). Last updated: 20 September 2026.

1. Who processes your data

The data controller is:

Stormingweb S.r.l.s.
Via Monte Peloso 25, 00189 Roma (RM), Italia
Partita IVA e Codice Fiscale: 18576861001 · REA: RM-1793394
PEC: stormingweb@pec.it
Email: info@bahayitalia.it

We have not appointed a Data Protection Officer (DPO). If it becomes mandatory in the future, we will say so here.

2. What data we collect

Grouped by what you are doing: if you only read, we collect very little; if you use the personal features, we collect what is needed to make them work, and nothing else.

If you only read

The server records, as any website does: IP address, date and time, page requested, browser type. They are needed to run the site and to defend it from abuse.

We also count how many times a page is opened, which words are searched on the site, and which buttons lead outside (for example to the app store). These are daily counts: they contain no identifier of yours, no IP address, no session and no time of day. You cannot get back to a person from them because the information is not there. Searches that look like personal data — an email address, a tax code, six digits in a row — are not written down at all.

If you sign up

Email, first name, surname, a public name you choose, your preferred language and, if you want to give them, the community you belong to and the place where you live. The community is optional and the language is never inferred from it.

We also keep the date and IP address of your last sign-in and the number of failed attempts, so we can notice if someone is trying to get into your account.

If you write comments or forum posts

The text you write, the date, the IP address and the browser. The IP is used against spam and is deleted after six months: the comment stays, what identifies the connection goes. Under what you write, your public name appears — never your first name and surname.

If you use the guided forms

This is the most sensitive processing, so we put it first among the personal ones. Filling in an official form requires the data that form asks for: date and place of birth, nationality, tax code, address, and depending on the form marital status, education, occupation, driving licence, and the details of family members included in the same application.

• That data lives inside the application, encrypted, and goes away with it: an abandoned draft deletes itself after 90 days, a completed application after 30.
• In your personal-details store only your first name and surname remain — plus the family relationship, for a relative. Everything else is not kept: from the second application onwards, your date of birth and tax code are typed again. That is the price of not keeping a complete personal record of someone who has stopped using us.
• The PDF you download is not kept: it is generated on the spot and handed to your browser.

If you use «Your documents» and deadlines

You upload no files. For each document — identity card, residence permit, passport, driving licence and anything you add yourself — you note the type, the issuing authority, the expiry date and the number.

Type and expiry date stay in the clear, because that is what the reminder runs on; the number is encrypted. The same applies to your family members' documents, if you add them.

If you write to us from your personal area

The messages between you and support: the subject, the text, the dates. The text is encrypted, because people describe their own situation in it; the subject is not, because it is needed to build the list without opening every message.

If you subscribe to the newsletter

Your email address and the fact that you subscribed, with the date. For email, silence means no: without the tick in your preferences nothing is sent. Every email carries the unsubscribe link, and unsubscribing takes effect immediately.

If you take out a subscription

Which plan, how much you paid, when it starts and when it ends.

Card details never pass through our servers and we never see them: payment happens on Stripe's pages, to which we send your email address, the plan you chose and an internal reference to your account. Stripe collects the billing address.

If you ask for an invoice we also collect your Italian tax code — or VAT number — because without it the national exchange system rejects the invoice, and Stripe does not ask for it. It is encrypted like the rest. When an invoice is issued, the data is frozen into that invoice: moving house does not change an invoice already issued.

If you use the app

A random code the app generates the first time it opens, the platform (Android or iOS), the app version, the language and the date of the last visit. The code is not a phone identifier: we do not ask for those. It exists so the same device is not counted ten times.

If you sign in from the app we keep a token — a key that keeps the app signed in — with its creation date, the IP address at that moment and the date it was last used. A token can be revoked, and expires on its own.

We do not currently send push notifications and we do not collect the identifier they need. The notifications you see in the app are built by the app itself. If one day we send them from the server, this notice will say so first.

Activity log

Important operations — successful and failed sign-ins, content changes, moderation decisions, deletions on expiry — are recorded with the date, the user, the IP address and the browser. It exists so that we can reconstruct who did what if something goes wrong.

Consents

When you accept the terms, the privacy notice or cookies, we record what you accepted, when, and from which IP address. Article 7 of the GDPR requires us to be able to demonstrate it. If you withdraw a consent, the record does not disappear: it is dated as withdrawn.

3. What we do NOT collect

This list matters as much as the one above.

• No copies of your documents. You do not upload passports, residence permits or health cards. You can note their type, issuing authority, expiry date and number — not upload the scan. That is a deliberate decision, because those files are the most dangerous thing we could hold, and they are article 9 GDPR data about people in a fragile position.
• No health data and none of the other special categories of article 9. If you write one in the forum we remove it, even when it is about you.
• No phone identifiers and no geolocation. We record a place only if you choose it yourself, and we never infer it from your IP address.
• No advertising where you are filling in an application. No third-party script enters the guided forms, the deadlines or your personal area — not even the Meta pixel.
• We do not sell your data to anyone, in any form.

4. How we protect it

The data that concerns your personal situation — your details, your family members' records, the contents of your applications, document numbers, the text of messages, billing data — is stored encrypted in the database, with AES-256-GCM. It is not a safe against everything, and it is right to say so: it is the guarantee that a copy of the database, on its own, is not enough to read it.

Traffic between your browser and the site travels over HTTPS. Passwords are not stored: we keep only a one-way fingerprint of each.

5. Statistics, advertising and social

If you consent on the cookie banner, third-party tools are activated. The two categories are accepted separately: you can say yes to statistics and no to advertising.

• Google Analytics (Google Ireland Ltd.) — statistics: counts visits and tells us which pages are useful. It collects pages viewed, referrer, device and an identifier of your browser. Your IP address is truncated before it is sent.
• Google AdSense (Google Ireland Ltd.) — advertising: shows and measures ads. It appears in the blog and forum only.
• Meta pixel (Meta Platforms Ireland Ltd.) — advertising: tells Meta that you visited a page of the site, and if you have a Facebook or Instagram account, Meta can link that visit to your profile. It never enters the restricted pages: personal area, forms, documents, sign-in and sign-up.

The legal basis is your consent (art. 6.1.a GDPR), which you can withdraw whenever you like from the Cookie preferences link at the bottom of every page. The Cookies page explains it in full.

In these processing operations Google and Meta act for their own purposes and as independent controllers: what they do with the data is explained in their own notices, linked from the Cookies page.

6. Transfers outside the European Union

Your account, your applications, your deadlines and the content you write are on servers in the European Union.

The tools in point 5, on the other hand, may transfer data to the United States, to companies that adhere to the EU-US Data Privacy Framework or that apply the European Commission's standard contractual clauses. The same applies to Stripe, if you subscribe.

Worth knowing plainly: if you refuse cookie consent, none of your data leaves the European Union for statistics or advertising purposes.

7. Why we process it, and on what legal basis

• Letting you use the service — account, guided forms, deadlines, reminders, messages with support: performance of the contract, art. 6.1.b.
• Security, anti-abuse, activity log, moderation: our legitimate interest in keeping the service intact and the public spaces liveable, art. 6.1.f.
• Counts and statistics we keep in-house (pages opened, words searched, clicks leading outside): legitimate interest in understanding what people need, art. 6.1.f — made possible by the fact that they are daily counts with no identifier at all.
• Newsletter, non-essential notifications, statistics and advertising cookies: only with your consent, art. 6.1.a, and you can withdraw it whenever you like.
• Invoices and tax obligations: legal obligation, art. 6.1.c.

8. How long we keep it

What	How long
Account data	As long as the account exists. If you delete it, the data is erased or anonymised within 30 days.
Guided forms — drafts	90 days from the last change, then they delete themselves.
Guided forms — completed applications	30 days, then they delete themselves.
First name and surname in your personal-details store	As long as the account exists. You can correct and remove them whenever you like from your personal area.
Document deadlines	Until you delete them, or as long as the account exists.
Messages with support	As long as the account exists.
IP address on comments	6 months. The comment stays, the IP goes.
Activity log	24 months. It survives account deletion without your name: what remains is that an operation happened, not who you were.
App tokens	They expire on their own; the rows are deleted 30 days after expiry or revocation.
Invoices and tax data	For as long as Italian tax law requires. These are not deleted on request: it is an obligation, not a choice of ours.
Comments and forum posts	They stay published, but detached from your name if you delete your account.
Counts (pages opened, searches, clicks)	Indefinitely: they are numbers per day, and contain no personal data.

9. Who else sees it

Only those who must. Inside Bahay Italia, authorised people and only for the part that concerns them: the people who write the articles have no access to user data.

Outside, the technical suppliers needed to run the service, appointed as processors under article 28 of the GDPR:

• Aruba S.p.A. — hosting of the site and the database, and sending of emails. Servers in the European Union.
• Stripe — only if you subscribe: it takes the payment and collects the card details and the billing address. We never see the card.

And, only if you have given consent, Google and Meta for the purposes in point 5. There they are not our suppliers: they are independent controllers.

Beyond these, only a judicial authority or a supervisory authority that requests it in the manner provided by law.

10. Your rights

You can ask us at any time to:

• tell you what data we hold about you and give you a copy in a reusable format (arts. 15 and 20);
• correct it, if it is wrong (art. 16);
• delete it (art. 17);
• restrict its use or object to a processing operation (arts. 18 and 21);
• withdraw a consent you had given, without making what we did before unlawful.

Many of these you can do yourself, right away, from your personal area: correct your details, remove a record, delete an application, unsubscribe from the newsletter, change your cookie preferences.

For the rest, write to info@bahayitalia.it with the subject Privacy. We reply within 30 days.

If you think we are getting it wrong you can contact the Italian data protection authority, Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Rome — garanteprivacy.it.

11. Minors

Accounts are for adults only. If we find that one was opened by a minor we close it and delete the data.

12. If something changes

When we change this notice we change the date at the top and, if the change is significant, we tell you before it takes effect. If the change concerns a new tool that requires your consent, the cookie banner reappears and we ask the question again.