Privacy and cookie policy

This notice (the “Privacy Policy”) describes the processing of personal data carried out by the controllers indicated in section 1 — Alessandro Giumelli for the tellkì application for iPhone and iPad, I-Web srl for the tellkì application for Android and for the tellki.it website — in connection with:

• use of the website tellki.it (the “Site”), including landing pages reached from marketing and social media campaigns;
• use of the mobile application “tellkì” (the “App”).

In this text, “Controller”, “we” and “us” refer to the controller of the service the User is using: Alessandro Giumelli for those using tellkì on iPhone or iPad, I-Web srl for those using tellkì on Android or the Site.

This notice is provided pursuant to Article 13 of Regulation (EU) 2016/679 (the “GDPR”) and to the applicable national legislation on the protection of personal data and on cookies.

1. Data controller

The data controller is:

• for the tellkì application for iPhone and iPad:
  Alessandro Giumelli
  Via Durini 23, 20122 Milano (MI)
  Email: hello@tellki.it
• for the tellkì application for Android and for the tellki.it website:
  I-Web srl
  Registered office: Viale Sarca 89, 20125 Milano (MI)
  VAT no. 03555600968
  Email: hello@tellki.it

2. Scope and architecture of the service

2.1. This Privacy & Cookie Policy applies to:

• visitors to the Site;
• users who use the tellkì App as consumers;
• users who land on pages of the Site from online advertising campaigns (e.g. Meta Ads, Google Ads, TikTok Ads).

2.2. The App as a webview of the Site. The tellkì App uses webview technology, which allows the mobile version of the Site to be displayed and used within the application. Consequently:

• the data processed while using the App may partly coincide with the data processed while browsing the Site;
• the cookie and consent settings shown on the Site also apply to browsing within the App, to the extent technically compatible;
• any analytics and marketing tools are configured to respect the choices expressed by the User through the cookie banner.

Where necessary, the following sections distinguish between processing relating to the Site and processing specific to the App.

3. Categories of data processed

3.1. Data processed through the Site

• Browsing data: IP address, date and time of requests, URLs visited, information about the browser and device, system logs and other technical data necessary for the operation and security of the Site.
• Data collected through cookies and similar technologies: technical, preference and statistics/analytics cookies and, subject to consent, marketing and profiling cookies, including third-party cookies (see section 5).
• Data provided voluntarily: data entered in contact or information request forms (e.g. first name, surname, email, content of the message) and in any newsletter sign-up forms.
• Data relating to marketing campaigns: anonymous or pseudonymised information about the source of traffic (e.g. UTM parameters, arrival from social or advertising campaigns, landing page visited).

3.2. Data processed through the App

• User identification data: phone number, display name, first name and surname, any profile photo and the other data the User chooses to enter in the profile (for example email, province, date of birth), internal account identifier and technical identifiers of the device, including those needed to deliver notifications. Solely for the grammatical form of automatic messages (for example «è stata da», “she has been to”), gender may be inferred from the first name: it is not asked of the User nor used for any other purpose.
• Data relating to use of the App: saved Places and the ratings (“stamps”) given to Places, lists created, Recommendations sent and received, connections with other Users (“friends”), personal notes associated with Places, recent searches, preferences (notifications, theme, alerts) and the history of certain actions relevant to the operation of the service.
• Internal usage statistics: which pages of the App are opened, how long they stay in the foreground while the User is using them (the count stops after a few minutes without interaction) and how many times a day the App is opened, together with a count of the actions performed (for example Places saved and Recommendations sent). They are collected by our servers, without third-party tools, are linked to the account and serve only to understand how the App is used in order to improve it. They are not visible to other Users or to merchants and are not used for advertising or commercial profiling.
• Data shared with other Users: tellkì is a service between friends. Name, profile photo, stamps, lists, photos, comments and reactions may be visible to Users connected as friends in the social features of the App (for example the friends’ feed and shared lists), according to the visibility settings that the User can change at any time from the profile. Recommendations sent from the App are visible to those who receive them. The friend connection arises when two Users interact in the App: an invitation or a Recommendation opened by someone who signs up, a shared list, the address book or an accepted friend request; each User may remove or block a friend at any time. To help people find those they know, the App may suggest to a User the friends of their friends and the people in their address book who have already signed up (“People you may know”), with their name, profile photo and friends in common. A User’s profile (name, profile photo, level, stamped Places and lists visible to friends) may be seen, in addition to their friends, by those who may already know them: anyone who has at least two friends in common with them, anyone who has their number in their address book, or anyone who has a pending friend request with them. The User’s choices always apply: with “Show what you stamp” switched off, stamped Places are not shown, and private lists remain private. The friend connection arises only if the other User accepts the request. Anyone who has blocked or been blocked is never suggested and cannot see the profile. None of this data is public.
• Content uploaded by the User: photos of venues or Places, any descriptions, comments and other content linked to Recommendations and to the social features. Photos may undergo automated analysis through third-party services, for example so as not to show images containing recognisable people or inappropriate content; the analysis does not produce decisions with legal effects on the User. The User is responsible for not uploading content that is unlawful or that infringes the rights of third parties.
• Account security: any App lock PIN, stored in the form of a non-reversible hash, and the list of connected devices (model and operating system), which the User can view and disconnect from the profile. Face or fingerprint recognition is handled by the device and is never transmitted.
• Technical and diagnostic data: device model, operating system, IP, language setting, App version, crash logs and data needed to improve stability and performance.
• In-app analytics: usage events (e.g. screens visited, features used) collected through analytics tools (e.g. Google Analytics / Firebase), configured to limit personal data and to respect consent choices.
• Location data: the device’s location, processed to show nearby Places and sort them by distance. If the User turns on proximity alerts — an optional feature that is switched off by default — the location may also be used when the App is not in the foreground, for the sole purpose of signalling proximity to a Place that the User has marked. The proximity check is carried out by the device’s operating system and the notification is generated locally. To keep the list of monitored Places up to date, when the User moves a significant distance the App sends the server only the current coordinates and receives the list of nearby Places; on iPhone this may also happen when the App is closed. Of these coordinates we keep only the last point sent, which is overwritten at each update and serves to determine when the list needs to be rebuilt; like any request, they may also appear in the server’s technical logs, which are kept for the periods indicated below. We do not keep a history of the User’s movements.
• Address book data (optional feature): if the User chooses to use the feature that identifies which of their contacts are already signed up to tellkì, the App accesses the device’s address book. Phone numbers are not transmitted: the App converts them on the device into irreversible cryptographic hashes (salted SHA-256) and sends only these hashes, which are compared with those of signed-up Users and are neither stored nor recorded; hashes without a match are discarded immediately. Contact names remain on the device and are not transmitted to us. To invite a contact who is not signed up, the App opens the system message composer already addressed: the number is not communicated to our systems.
• Voice (voice search, optional feature): if the User taps the microphone in the search field, the App records a few seconds of audio and sends it to our servers, which have it transcribed into text by Google Cloud Speech-to-Text for the sole purpose of carrying out the search. The App accesses the microphone only after the button is tapped. The audio is not stored either by us or by Google, is not used for other purposes and is deleted as soon as the text has been obtained; the text is treated like other searches.

Access to the address book, location, camera, photo gallery and microphone is always subject to the permission granted by the User through the operating system and can be revoked at any time from the device settings. The features that use them are optional: revoking permission only results in the relevant feature being disabled.

4. Purposes and legal bases of processing

4.1. Processing relating to the Site

• Operation and security of the Site – ensuring the correct technical operation of the Site, the use of its pages and its security.
  Legal basis: legitimate interest of the Controller (Art. 6(1)(f) GDPR).
• Handling of requests sent through forms – responding to requests for contact, information, quotes or partnerships.
  Legal basis: performance of pre-contractual measures or of a contract (Art. 6(1)(b) GDPR).
• Newsletter sign-up and sending (where available) – sending informational and/or promotional communications by email.
  Legal basis: consent (Art. 6(1)(a) GDPR), which may be withdrawn at any time.
• Statistical analysis of traffic (e.g. Google Analytics 4) – measuring use of the Site in aggregate form in order to improve content and performance.
  Legal basis: legitimate interest for minimised/anonymised configurations; consent for more invasive solutions or those integrated with marketing.
• Marketing and remarketing activities through third-party cookies/pixels (e.g. Meta, Google Ads, TikTok Ads) – measuring campaign conversions and showing targeted advertisements.
  Legal basis: consent (Art. 6(1)(a) GDPR), collected through the cookie banner.

4.2. Processing relating to the App

• Creation and management of the account – User registration, access to the App, profile management.
  Legal basis: performance of the contract (Art. 6(1)(b) GDPR).
• Provision of the App’s features – saving Places, lists (including shared lists), Recommendations sent and received, features between friends (feed, reactions, comments), in-App notifications, uploading of photos and content, voice search, and any discounts or rewards at participating merchants.
  Legal basis: performance of the contract.
• Phone notifications and proximity alerts – sending notifications and, if turned on by the User, alerts linked to proximity to a Place.
  Legal basis: performance of the contract, within the limits of the permissions granted through the operating system, which the User can revoke at any time.
• Technical support, maintenance and security – preventing abuse and unlawful or fraudulent use of the App, diagnostics and improving stability.
  Legal basis: legitimate interest of the Controller.
• Internal usage statistics – measuring which features and pages of the App are used, for how long and how often, including on a per-User basis, in order to understand how the service is used (for example to save Places or to recommend them) and decide how to improve it.
  Legal basis: legitimate interest of the Controller in improving the service. The User may object at any time by writing to the contacts indicated in section 13.
• In-app analytics – anonymous or pseudonymised analysis of App usage in order to improve the product and understand its overall use.
  Legal basis: legitimate interest, without prejudice to any consent required for specific configurations or for integration with marketing systems.
• Aggregate use of data for statistical and commercial purposes – aggregate and anonymous analysis of data relating to Places, Recommendations and use of the App (e.g. trends, overall reports, insights into the service).
  Legal basis: legitimate interest, since the data processed in this way cannot be traced back to individual Users.

Under no circumstances does the Controller use Users’ personal data for solely automated decisions producing significant legal effects within the meaning of Article 22 GDPR.

5. Cookies and similar technologies

5.1. What cookies are
Cookies are small text files that the sites visited by the user send to their device, where they are stored and then sent back to the same sites on the next visit. Similar technologies (e.g. pixels, SDKs, local storage) may perform similar functions.

5.2. Types of cookies used on the Site

• Technical cookies – necessary for the operation of the Site, the management of the cookie banner, security and the use of content. They do not require consent.
• Analytics cookies – used to collect aggregate information on the use of the Site (e.g. Google Analytics 4). They may be configured in minimised mode (truncated IP address, no cross-referencing with other data), in which case the impact on privacy is reduced.
• Marketing and profiling cookies – third-party cookies or pixels (e.g. Meta, Google Ads, TikTok) that make it possible to track campaign conversions and create custom audiences. They are used only with the User’s prior consent.

5.3. Cookies and technologies in the App
Since the App is based on a webview, it may use:

• cookies and local storage generated by the Site loaded in the webview;
• in-app analytics tools (e.g. Firebase Analytics, Crashlytics), which collect technical and usage events;
• any technical identifiers of the device, within the permitted limits and configured to minimise personal data.

5.4. Consent and preference management
The User may:

• accept all cookies;
• refuse non-technical cookies;
• customise their choices through the banner or the available settings;
• withdraw or change the preferences expressed at any time.

6. Recipients of personal data

Personal data may be disclosed to:

• providers of IT, hosting, cloud and platform maintenance services;
• providers of analytics services (e.g. Google) and, where activated subject to consent, advertising platforms (e.g. Meta, Google Ads, TikTok);
• providers of data and maps about places, of automated image analysis services and of speech-to-text transcription (e.g. Google, Foursquare, Esri);
• providers of the SMS services for the access code and of phone notifications (e.g. Apple, Google);
• participating merchants, solely in aggregate or anonymous form; when a discount is redeemed, the merchant receives only confirmation of the redemption, without the User’s name;
• legal, tax or compliance advisers, to the extent necessary for their activities;
• supervisory authorities, law enforcement agencies or public bodies, where required by law.

Depending on the case, these parties act as independent controllers or as processors (Art. 28 GDPR), on the basis of written agreements governing their activities.

7. Transfer of data to countries outside the EU

Some providers (e.g. Google, Meta, cloud platforms) may have offices or servers located outside the European Economic Area. In such cases, the Controller ensures that the transfer takes place in compliance with the GDPR, for example on the basis of:

• adequacy decisions of the European Commission; or
• Standard Contractual Clauses (SCCs) approved by the European Commission and, where necessary, supplementary security measures.

8. Data retention period

Personal data are kept for no longer than is strictly necessary for the purposes for which they were collected. In particular:

• data relating to the App account: for the entire life of the account and, thereafter, for the time necessary to comply with legal obligations or to protect the Controller’s rights;
• uploaded content (e.g. photos, lists, Recommendations): until deleted by the User or until the account is deleted;
• data collected through forms on the Site: as a rule, up to 12–24 months from the last significant interaction;
• newsletter data: until consent is withdrawn or removal from the mailing list is requested;
• current-use data (for example recent searches, approximate location for proximity alerts): a few items, replaced over time or deleted when the feature is turned off;
• voice search audio: not stored, deleted immediately after transcription;
• technical and security logs: IP address and browser data for up to 12 months, then deleted; only the date of access remains, linked to the account and deleted with it;
• technical data on the operation of the App (communication between the App and pages): 30 days;
• feedback, ratings, reports and requests for access to the App: for the entire life of the account, deleted with the account;
• internal usage statistics (pages opened, time of use, App openings): linked to the account for 12 months, then converted into anonymous monthly totals; deleted together with the account;
• analytics data: according to the providers’ settings (e.g. 14–26 months for Google Analytics) and in any case in aggregate or anonymised form in the long term.

Data processed in aggregate or anonymous form may be kept without a specific time limit, since they cannot be traced back to an identified or identifiable data subject.

9. Users’ rights

As a data subject, the User may at any time exercise the rights provided for by Articles 15–22 of the GDPR, including:

• right of access to personal data;
• right to rectification of inaccurate or incomplete data;
• right to erasure (“right to be forgotten”) in the cases provided for by law;
• right to restriction of processing;
• right to portability of the data provided, where technically feasible;
• right to object to processing based on legitimate interest, including any related profiling;
• right to withdraw consent, where processing is based on consent, without affecting the lawfulness of processing carried out before its withdrawal.

To exercise these rights, please write to: hello@tellki.it.

The User also has the right to lodge a complaint with the competent supervisory authority (in Italy, the Garante per la Protezione dei Dati Personali – the Italian Data Protection Authority).

10. Security measures

The Controller adopts appropriate technical and organisational measures to protect personal data against loss, misuse, unauthorised access, disclosure or alteration. The User is encouraged to use up-to-date devices that are not “jailbroken” or “rooted” and to keep their credentials confidential.

11. Minors

The Controller’s services are intended exclusively for persons aged 18 or over. The registration of minors is not knowingly handled; should the Controller become aware that a minor has provided personal data without an appropriate legal basis, such data will be deleted.

12. Changes to this Privacy & Cookie Policy

The Controller reserves the right to update this Privacy & Cookie Policy at any time, for example in the event of changes in legislation or developments in the services offered. Changes will be made available on the Site and/or in the App. In the event of significant changes, a specific notice may be provided (e.g. by means of a banner or notification).

13. Contacts

For any questions about the processing of personal data or to exercise your rights, you may contact:

the controller indicated in section 1 for the service being used (Alessandro Giumelli for tellkì on iPhone and iPad, I-Web srl for tellkì on Android and for the tellki.it website)
Email: hello@tellki.it

Last updated: 30 October 2026