Privacy policy
Plain-English summary of what we collect, why, and how to have it removed.
Last updated: 21 August 2026.
Who we are
Siena & Toscana is an independent editorial guide to Siena and Tuscany, published by the editor of sienatoscana.it. For all data-protection matters the publisher acts as data controller and can be reached at privacy@sienatoscana.it.
What we collect
- Newsletter email address — when you subscribe, we store your email, the page you subscribed from, and whether and when you confirmed. Stored in our Lovable Cloud database. Subscriptions are double opt-in: we email you a single-use link and you are not on the list until you click it. Addresses that are never confirmed are deleted after 30 days and are never sent anything but that one confirmation request.
- Contact form submissions — name, email address and the content of your message, stored in the same database and read only by our editors.
- Event submissions — if you submit an event to our notice board, your name and email are stored with the submission for moderation.
- Account data — if you create an account to submit events, we store your email address and your submissions.
- Analytics — Google — if (and only if) you accept cookies, Google Analytics 4 collects standard usage data such as pages viewed, approximate location, device type and referring URL. Nothing is loaded before you accept.
- Analytics — Microsoft Clarity — Clarity produces heatmaps and session recordings, which replay a visit as a reconstruction of the page with the pointer moving over it, so we can find pages that are broken rather than merely unpopular. It derives an approximate location from your IP address. Content typed into form fields is masked by Clarity in all modes and is not readable in a recording. Unlike Google Analytics, Clarity begins before you answer the cookie notice, in a reduced state in which it sets none of its own identifying cookies; declining on the notice stops it completely. The cookie policy sets out all three states in full.
Cookies
We store a single strictly-necessary preference to remember your consent choice and, only after you accept, Google Analytics and Microsoft Clarity cookies. Running the Clarity tag also causes Microsoft to set its own cookies on its clarity.ms and bing.com domains, one of which lasts about thirteen months. See the cookie policy for the full list, the durations, and what happens before you have chosen.
Affiliate outbound links
Some links on Siena & Toscana take you to third-party booking partners (hotels, tours, wine experiences). Those partners set their own cookies once you land on their site. See our affiliate disclosure.
Legal basis
We rely on your consent (Art. 6(1)(a) GDPR) for the newsletter and for analytics cookies; on our legitimate interests (Art. 6(1)(f)) in responding to correspondence, moderating public submissions, keeping the site secure (including spam prevention via Cloudflare Turnstile), and in the cookieless measurement Microsoft Clarity performs before you answer the notice — balanced against the fact that it stores no identifier of ours on your device and does not capture what you type; and, where you create an account, on the performance of that arrangement (Art. 6(1)(b)). You may withdraw consent, or object to that measurement, at any time — via the unsubscribe link in any newsletter, or the Cookie settings link in the footer for analytics. Declining on the notice stops Clarity entirely.
How long we keep it
Confirmed newsletter subscriptions are retained until you unsubscribe; unconfirmed ones are deleted after 30 days. Contact messages are retained for up to 24 months, then deleted. Event submissions are retained while the listing is current and for up to 12 months afterwards. Account data is retained until you ask us to delete your account.
Your rights
You have the right of access, rectification, erasure, restriction of processing, data portability, and objection, and the right to withdraw consent at any time without affecting prior processing. You also have the right to lodge a complaint with a supervisory authority — in Italy, the Garante per la Protezione dei Dati Personali (gpdp.it); if you are in the UK, the ICO (ico.org.uk); or the authority of your EU member state.
Deletion requests
To have your data removed, please write to us via the contact form or email privacy@sienatoscana.it. We action requests within 30 days.
International transfers
Our service providers are Lovable Cloud / Supabase (hosting and database), Google (Analytics, only after consent), Microsoft (Clarity — see its privacy statement), Cloudflare (Turnstile spam prevention) and Proton (email). Some providers process data outside the UK/EEA, in particular in the United States; where they do, transfers rely on the EU–US Data Privacy Framework and/or Standard Contractual Clauses.
Changes
We will update this page whenever our practices change and note the revision date at the top.