Privacy

In short: this map doesn’t ask for your name, doesn’t ask for your email, doesn’t make you sign up and doesn’t install tracking cookies on your phone. That’s why there’s no banner to accept.

Who processes the data

Data controller: RUMBA S.r.l., Via Bonanno Pisano 50, 56126 Pisa, Italy. VAT and tax code 02560150506, REA PI-270603. Contact: mailrumbasrl@gmail.com. We have not appointed a Data Protection Officer: none of the cases required under Article 37 GDPR applies.

What we collect

Operational counts, and nothing else: which QR sheet was scanned (including when the code does not exist or belongs to a withdrawn card), which category and which sub-category of points were opened, when a search was widened to the whole map, whether the drawn map was opened, whether the introduction was opened, which single point was opened and whether it is a public point or a partner business, how many times “Take me there” was pressed and on which point, whether a point was reported as working or broken, whether a point was shared, whether the Instagram link was pressed, whether location permission was granted, or that the location could not be obtained — distinguishing only the case where the browser does not offer that feature at all — and the page language.

None of these counts carries who you are: the point you open is recorded alongside a session code that changes every twenty-four hours, not alongside you.

We do not store your IP address. At request time we turn it, together with your browser type, into a non-reversible code that changes every twenty-four hours, used only to avoid counting the same visit twice in the same day.

Your location

If you press “Find the closest to me”, your phone asks for permission and the coordinates stay inside your browser, used only to calculate the distance to the points on the map. They are never sent to our systems, never recorded and never shared.

AI switchboard on the Hotline

The Hotline is optional and sends nothing until you press send. At that point, the text, selected language and no more than the last six messages in the current call pass through our server to the OpenAI API to generate the answer. We do not send your location. Do not include names, contact details, health data or other sensitive information.

We do not save the conversation in our database or in browser storage: it stays in the page and disappears when you hang up or reload it. The API request does not create application state, but OpenAI may keep prompts and responses in abuse-monitoring logs for up to 30 days; it also states that API data is not used to train models unless the customer opts in. See the OpenAI API data controls.

Why and for how long

Legal basis: legitimate interest (Art. 6(1)(f) GDPR) in understanding whether the service works and which distribution points make sense. Counts are kept for 90 days, then deleted.

You can object to this processing at any time, without having to give a reason, by writing to the address above.

A report on a point — “works” or “broken” — is kept until we have closed it, because it is what tells us what to fix: but without the session code, which disappears within 90 days like everything else.

Who else sees them

Our hosting and database providers, as data processors (Art. 28 GDPR), with servers in the European Union.

The map is ours too: the streets are drawn by our own code from OpenStreetMap data stored on our servers. Opening it contacts no external provider, and where you are never leaves your phone.

To partner businesses we disclose only aggregate counts about their own point, never anything traceable to a person. No data is sold.

What stays on your phone

Two things, and neither reaches us: they are kept in this browser’s local storage, on your device, and only the site reads them back, on your phone. They have no expiry: they stay until you delete them, by clearing the site data in your browser settings.

The first is your light or dark theme preference, and you write it by pressing the button. The site reads it back each time you open a page so you don’t start on the wrong theme. It holds nothing about you: it says only “light” or “dark”.

The second records that you have already seen the opening introduction. It writes itself the first time you open the site, when that panel appears, and it exists so you never see it again. It holds a single character and says nothing about you — not even whether you read it or closed it straight away.

Both exist to make the thing you asked for work, so no consent is required under Article 122 of the Italian Privacy Code and there is no banner.

Cookies

This site uses no cookies and no third-party analytics: no Google Analytics, no Meta pixel, no fonts from external servers, not even when you open the map. The two things kept on your device are the ones described above.

The exceptions are actions you choose: sending text to the Hotline makes our server contact the OpenAI API as explained above; “Take me there” opens Google Maps — in the app if you have it on your phone, otherwise in the browser — with the coordinates of the point you are heading to, not yours; “Follow @tappapisa” opens Instagram; on the events and data pages the references point to the source websites, and a point’s card links to whoever runs it and to the source of its note. You open them; it isn’t something the site does on its own — and they open without telling the other side which page you came from.

Your rights

You can exercise your rights under Articles 15-22 GDPR by writing to mailrumbasrl@gmail.com. Note: since we do not collect data that identifies you, in most cases we cannot link a count back to you — and that is by design. You may also lodge a complaint with the Italian Data Protection Authority.

Map data

Points come from OpenStreetMap and are distributed under the ODbL 1.0 licence. © OpenStreetMap contributors. When we make field checks, they will go back to OpenStreetMap with their date.

Every point carries the date of the last known check: some are recent, some are many years old, and that is exactly why the date is printed next to the point. A point can change at any time — a fountain may be closed for maintenance. If you find an error, the “Is it working? No” button on the card is the fastest way to tell us.