Privacy Policy

Massimiliano Gallori (MAXORI Studio; "MAXORI", "we", "us"), who can be contacted at info@maxoristudio.com, is the controller of the personal data described in this policy. The full provider details are given in the Legal notice.

MAXORI publishes the website maxoristudio.com and provides MAXORI Booking Planner (the "Planner"), booking-management software offered to accommodation businesses as a subscription service (SaaS) at planner.maxoristudio.com.

For any question about your personal data, write to info@maxoristudio.com.

This policy explains how we process personal data of:

• visitors of our website;
• people who request the free demo or buy a subscription;
• our customers and the people who use a Planner account;
• representatives of accommodation businesses that we may contact to present our product;
• people who interact with our social media pages.

Data about the guests of our customers, entered by our customers in the Planner, is processed by MAXORI on behalf of each customer: see "Guest data entered by our customers" below.

Our services are intended for businesses and professionals, not for children.

Technical data. When you open a page, your browser sends technical data (IP address, browser type, requested page, date and time). Our hosting provider (Vercel) uses it to deliver the website and protect it against abuse. Legal basis: our legitimate interest in operating a secure website (art. 6(1)(f) GDPR).

Language preference. If you choose a language with the language selector, a cookie remembers your choice.

Campaign information. If you reach the website through a link that contains campaign parameters (for example utm_source, utm_campaign, pid or ref) or from another website, we keep these parameters and the name of the referring website (not the full address) in your browser for the current session only, and add them to the links that lead to the Planner's demo, purchase and contact pages. This lets us know which campaign or source led to a demo or a purchase. It does not use cookies and does not build a profile of you. Legal basis: our legitimate interest in measuring the effectiveness of our communication (art. 6(1)(f) GDPR).

Analytics and advertising measurement. Both are switched off by default. If we enable them, Google Analytics 4 and Google Ads conversion tracking (provided by Google Ireland Ltd) are loaded only after you accept optional cookies in the cookie banner. Analytics produces statistics on how the website is used, with IP anonymisation. Conversion tracking tells us whether a visit that started from one of our Google ads led to a click to start the free demo or to buy, using the ad-click identifier (gclid) that Google adds to the link. Legal basis: your consent (art. 6(1)(a) GDPR), which you can withdraw at any time.

Email. If you write to info@maxoristudio.com, we use your message and contact details to answer you. Legal basis: our legitimate interest in answering enquiries and, where applicable, steps taken at your request before entering into a contract (art. 6(1)(b) and (f) GDPR).

Details on cookies and similar technologies are in our Cookie Policy.

This site uses MAXORI AI Assistant, an automated assistant answering from approved information about our products. Replies are AI-generated and may contain errors. For confirmation or human assistance, email info@maxoristudio.com or use the chat contact form.

Loading the chat sends technical requests to consultant.maxoristudio.com (IP address and browser information). The widget uses no advertising cookies or persistent browser storage for conversations; chat state stays in the open page.

We process your messages and, if you complete the form and give consent, your name, contact details and request so we can reply. Do not enter sensitive data, passwords or payment details. The chat does not place orders, take payments or make automated decisions with legal effects.

Answering questions is based on our legitimate interest in handling enquiries and pre-contractual steps you request (art. 6(1)(b) and (f) GDPR). The form requires explicit consent to process contact details (art. 6(1)(a)). Chat conversations and requests are retained for 30 days; subsequent emails follow the periods below.

The service uses Vercel for hosting and AI Gateway, Neon for the database and Resend for email notifications. Messages needed for a reply are processed by an OpenAI model through Vercel AI Gateway. The provider, transfer and rights information in this policy applies.

Free demo. To start the free demo we ask for your name, email address, business name (optional) and language. We send you an email with an activation link; the demo lasts 14 days from activation. No payment card is required.

Purchase. To buy a subscription we ask for your name, email address, business name (optional), the chosen plan and billing period. You then pay on the secure payment page of Stripe, which collects your billing address and payment details. MAXORI never sees your card details. If you give an EU VAT number, it is checked against the EU VIES register before payment.

Abuse prevention. To allow one free demo per person and to limit repeated requests, we keep a one-way hash of your normalised email address and a one-way hash of your IP address, never the address itself in clear.

Campaign information. The campaign parameters described above (if any) are stored with your demo request or purchase and, for purchases, in the metadata of the Stripe payment and subscription.

Legal bases: performance of the contract and steps taken at your request before entering into it (art. 6(1)(b) GDPR); our legitimate interest in preventing abuse and in measuring the effectiveness of our communication (art. 6(1)(f) GDPR); compliance with tax and accounting obligations (art. 6(1)(c) GDPR).

To provide the Planner we process:

• account data: name and email address of the account owner and of the people the owner invites, their role (owner, manager, reception or basic), preferred language and invitation status;
• sign-in data: password (stored only in encrypted, hashed form by our authentication provider) and the technical data of your sessions;
• activity data: a history of changes to reservations (who changed what and when) and a log of subscription events;
• product usage data: which Planner functions are used and when (for example opening a page such as the calendar or the reservation list, changing the calendar view, opening a reservation, printing a report, or creating, changing or deleting a property, reservation, payment or expense), with the date and time, the user's role and the user and account concerned;
• subscription and billing data: plan, billing period, status, dates, payments, invoices and tax treatment;
• your communications with us (email, chat).

Account emails (activation, invitations, password reset) are sent from our dedicated domain through our email service provider.

Authorised MAXORI staff access this data only as needed to run the service, provide support, manage billing or comply with the law.

Legal bases: performance of the contract (art. 6(1)(b) GDPR); compliance with tax and accounting obligations (art. 6(1)(c) GDPR); our legitimate interest in keeping the service secure and in keeping a record of changes (art. 6(1)(f) GDPR).

Product usage data is recorded by the Planner itself: it contains only the name of the function used and the time, never the content of reservations or guest data. We do not record keystrokes, what is shown on screen or the course of a session (no session replay), we do not use cookies, advertising identifiers or third-party analytics tools for it, and only authorised MAXORI staff can see it. We use it to understand whether and how the Planner is being adopted during demos and subscriptions, to support our customers and to improve the service. Legal basis: our legitimate interest in understanding how our service is used, in order to support customers and improve it (art. 6(1)(f) GDPR); you can object to it at any time (see the section on your rights).

Our customers use the Planner to record their reservations, including data about their guests (for example name, contact details, nationality, stay dates and payments received). For this data the customer (the accommodation business) is the controller and MAXORI acts as processor on the customer's behalf, under the data-processing terms included in our Terms and Conditions.

If you are a guest, please contact the accommodation business to exercise your rights. If you contact us, we will forward your request to the business concerned.

The Planner does not process guest card payments: payments are only recorded by the customer.

To present MAXORI Booking Planner to accommodation businesses for which it may be useful, we collect publicly available business information from OpenStreetMap (© OpenStreetMap contributors, Open Database License): business name, type of accommodation, location, website, business phone number and generic business email addresses (such as info@ or booking@). We do not collect the personal email addresses of named individuals or free-mail addresses.

Legal basis: our legitimate interest in promoting our product to businesses (art. 6(1)(f) GDPR). We send commercial electronic communications only where the applicable law allows it (for example with prior consent where required).

Every message we send identifies MAXORI, states where we obtained the contact details and offers a simple way to object. If you object, we stop immediately, erase the contact details and keep only a one-way hash in a suppression list so that we never contact you again.

You can object at any time, without giving reasons, by replying to our message or by writing to info@maxoristudio.com.

We have pages on Instagram and Facebook. When you follow, like, comment on or send a message to our pages, we see your public profile and your interaction, and we use them to reply and to understand which content works.

Meta provides us with aggregated statistics about our pages (Page Insights). For these statistics Meta Platforms Ireland Ltd and MAXORI are joint controllers; Meta is responsible for the processing on its platforms under its own privacy policy.

Links in our posts may contain campaign parameters, so that we know which post led to a visit, a demo or a purchase (see "Visiting our website").

Legal basis: our legitimate interest in communicating about our products (art. 6(1)(f) GDPR).

We use the following providers, bound by data-processing agreements or acting under their own terms as indicated:

• Vercel Inc. — hosting of the website and of the Planner application;
• Supabase — database, authentication and server functions of the Planner, hosted in the European Union (Frankfurt, Germany);
• Stripe — payment page, subscriptions, invoices and tax calculation; for certain purposes (such as fraud prevention and its legal obligations) Stripe acts as an independent controller;
• Resend — sending of account emails (activation, invitations, password reset);
• MAXORI AI Consultant: Vercel (hosting and AI Gateway), OpenAI (AI model), Neon (database), Resend (email notifications) — automated website assistant;
• Google Ireland Ltd — website analytics (Google Analytics 4) and conversion measurement for our Google Ads campaigns, only if enabled and only with your consent;
• Meta Platforms Ireland Ltd — our Instagram and Facebook pages;
• GitHub and n8n — internal tools that store and process our list of business contacts and run our publishing and prospecting workflows;
• our email hosting provider — our mailboxes.

We may also disclose data to public authorities, courts and professional advisers when required by law or to defend our rights. We do not sell personal data.

The Planner database is hosted in the European Union. Some of our providers (for example Vercel, Stripe, GitHub, Google and Meta) belong to groups based in the United States or may access data from outside the European Economic Area.

In these cases transfers are based on an adequacy decision of the European Commission (such as the EU-U.S. Data Privacy Framework, for certified companies) or on the Standard Contractual Clauses approved by the European Commission.

• Planner account and customer data: for the duration of the demo or subscription. After it ends, we keep the data so that the customer can reactivate the account, until the customer asks us to delete it and in any case for no longer than 12 months after the end of the last demo or subscription; then we delete it.
• Product usage data in the Planner: kept together with the Planner account data and deleted with it, within the periods above.
• Invoices and billing records: for the periods required by tax and commercial law.
• Abuse-prevention hashes: as long as needed to apply the one-free-demo rule and the request limits.
• Chat conversations and emails: as long as needed to handle your request and any follow-up, and no longer than 24 months after the last message.
• Business contacts (prospecting): no longer than 24 months after the last interaction; after an objection, only the one-way hash in the suppression list.
• Backups: the Planner database is backed up for disaster recovery (daily backups kept for 7 days; encrypted independent backups kept for up to 12 months). Deleted data disappears from the backups when they expire.

We protect personal data with appropriate technical and organisational measures, including encrypted connections (HTTPS), hosting of the Planner database in the European Union, separation of each customer's data from the data of other customers, access by role, a history of changes, and encrypted backups. Payment card data is handled only by Stripe.

You can ask for access to your personal data, rectification, erasure, restriction of processing and data portability, and you can object to processing based on our legitimate interest. You can always object to direct marketing. Where processing is based on consent, you can withdraw it at any time without affecting earlier processing.

We do not take decisions based solely on automated processing that produce legal or similarly significant effects on you.

To exercise your rights, write to info@maxoristudio.com. We may ask you to confirm your identity and we answer within one month.

You also have the right to lodge a complaint with a data protection authority, in particular the Spanish Data Protection Agency (Agencia Española de Protección de Datos, www.aepd.es) or the authority of the country where you live or work.

We may update this policy when our services or the law change. The date of the last update is shown at the top of this page. If a change significantly affects our customers, we inform them by email or in the Planner.