Skip to content
English
Publish your property
stay

Privacy notice of stay.roraima.io

This notice explains which personal data we process when you use stay.roraima.io (the "portal"), why we process them, how long we keep them and what your rights are. It also concerns the owners of the properties not listed on Roraima that appear on the portal (section 9). For everything you do on roraima.io, including booking on the owner's site, the Roraima Privacy Policy applies.

1. Who processes your data

The controller is Roraima — Startup di Dario Salaris, Via Firenze 16, 07039 Valledoria (SS), Italy. For any question about your data, write to privacy@roraima.io.

2. When you search and browse the portal

To show you the pages, our server receives the IP address of your connection, the type of browser, the page requested and the time. We use them to show you the portal, to protect it from abuse (for example by limiting the number of requests coming from the same connection) and to fix malfunctions. The legal basis is our legitimate interest in running the portal securely (Article 6(1)(f) GDPR). These data are kept for a maximum of 15 days.

Like the whole of roraima.io, the portal goes through the Cloudflare, Inc. network, which protects it from attacks and makes it load faster. To do so, Cloudflare receives the same request data and processes them on our behalf, as a processor.

What you search for (place, dates, number of guests, filters) is used to show you the results and is not linked to you. Every day we count, by country, place and category, how many searches found no Roraima offers: it is a count, with no IP addresses or other personal data.

The portal uses only technical cookies, needed for it to work, which do not require your consent. The language you choose is part of the page address. We do not use profiling cookies or third-party statistics tools.

3. The map

The portal map opens without asking for your consent, because it uses no cookies. The program that draws it is loaded from our server. The images of the area are provided by OpenFreeMap (openfreemap.org, a service run by Zsolt Ero), which distributes them through Cloudflare. To send them to you, OpenFreeMap receives from your browser the address of the page, the date and time and the operating system, and keeps them for 7 days. It receives the IP address of your connection only in its error logs, kept for 7 days, or during a cyber attack, for a maximum of 30 days. OpenFreeMap uses no cookies, requires no registration and processes these data as an independent controller, under its own privacy notice (https://openfreemap.org/privacy/). Our legal basis for having you download the map images is our legitimate interest in showing you where the offers are without using cookies (Article 6(1)(f) GDPR). The geographic data of the map come from OpenStreetMap, under the Open Database License, credited on the map.

4. Links to third-party sites

Some links lead to booking sites run by other companies, such as Booking.com, Expedia, Vrbo and Airbnb. They are ordinary links: we receive no payment from those sites. When you follow one of these links you leave the portal: the data you provide on those sites are processed by the companies that run them, under their own privacy notices. We do not pass your name, your email address or other data that identify you to those sites.

5. Protecting the forms from bots

The portal forms ("Ask about availability", with the guest list box, "Notify me when there are offers here" and "Ask us to remove it") are protected by Cloudflare Turnstile, a service of Cloudflare, Inc. that tells people apart from automated programs without asking you to solve a test. Turnstile works invisibly and is triggered only at the moment you submit a form: if you submit nothing, your browser does not connect to Cloudflare for this purpose. To check the request, Cloudflare receives the IP address of your connection, some technical features of the connection and of the browser, and the reference to our portal.

Cloudflare processes these data on our behalf, to protect the forms, and as an independent controller to improve its detection of automated programs, on the basis of its own legitimate interest, as explained in Cloudflare's "Turnstile Privacy Addendum" (https://www.cloudflare.com/turnstile-privacy-policy/). Our legal basis is our legitimate interest in protecting the owners, the visitors and the portal from automated submissions and abuse (Article 6(1)(f) GDPR). Turnstile does not use cookies to follow your browsing. Cloudflare may process the data in the United States, on the basis of the EU-U.S. Data Privacy Framework and of the standard contractual clauses approved by the European Commission.

Alongside Turnstile, the forms use two checks that process no personal data: a hidden field, which people do not see and automated programs fill in, and a minimum time to fill in the form. If your browser cannot load Turnstile, for example because an extension blocks it, the form cannot be submitted. For any request about your data you can always write to us at privacy@roraima.io.

6. "Ask about availability"

With this form you send a question to a property not listed on Roraima. We process your name, your email address, the property chosen, the dates, the number of guests, the text you write and whether you chose to ask for a better price by booking directly.

  • What they are used for. We send you an email to confirm that the address is yours; after the confirmation we forward the question to the property, at the email address that appears in the public lists it comes from (section 9). The property sees your name, your email address and the text of the question, and replies to you directly: from that moment it processes your data as an independent controller. Without your email address we cannot forward the question or get the reply to you.
  • Legal basis. The performance of the service you ask us for (Article 6(1)(b) GDPR) and, for the checks against abuse, our legitimate interest in protecting the owners and the portal (Article 6(1)(f) GDPR).
  • Limits against abuse. To prevent repeated or automated submissions we apply limits to the number of requests per email address, per connection and per property. A request over the limits is rejected automatically, with a message that explains it; if you think it is a mistake, write to us.
  • Addresses that do not receive our emails. If an email we send you comes back undelivered or is reported as unwanted, for 12 months we send no further confirmation emails to that address, neither for questions nor for the guest list or the alerts (sections 7 and 8), and the address leaves the list and the alerts. Of that address we keep only a code, with the reason and the date. The legal basis is our legitimate interest in delivering the portal's emails correctly (Article 6(1)(f) GDPR).
  • Who sends the emails. All the portal's emails, including those of the list and the alerts, are sent from the address [email protected] on our behalf by Brevo SAS, based in Paris (France), which acts as a processor and processes the data in the European Union.
  • How long.
    • If you do not confirm the address within 24 hours, the question is not sent and your email address is deleted.
    • After sending, we delete your email address within one day: from then on only the property has it, to reply to you.
    • Your name and the text of the question are deleted 30 days after the request: we keep them for that time only to examine any report from the property.
    • For each request we keep for 12 months a log with the date, the property, the outcome and a code derived from your email address (pseudonymous data: it is not the address in clear text, but anyone who knows the address can recalculate it), which is used to enforce the limits.
    • For the limits per connection we use a code derived from the IP address, which we keep for a maximum of 7 days.

Sending a question does not sign you up to any list and does not lead to promotional communications.

Roraima does not verify the identity of the property or its replies: before paying a deposit, check who the recipient is and use a traceable means of payment.

7. The guest list

In the "Ask about availability" form you will find a separate box, not ticked and not compulsory, to receive from Roraima the news of the portal and the offers of the listed properties. Your question to the property is sent in any case, whether you tick the box or not. If you tick it, we send you an email to confirm the subscription: without your confirmation within 24 hours the address does not join the list and the request is deleted.

  • Data. Your email address, the date of the request and of the confirmation, the page you subscribed from and the text of the box, in the language you read it in, as proof of consent. For the limits against abuse we also use a code derived from the IP address, which we keep for a maximum of 7 days.
  • Legal basis. Your consent (Article 6(1)(a) GDPR and Article 130 of the Italian Personal Data Protection Code, Legislative Decree 196/2003).
  • Who writes to you. The list's emails are sent only by Roraima. We do not pass the list to the listed properties or to anyone else.
  • How to unsubscribe. At any time, with the link at the bottom of every email, with the unsubscribe button that some email programs show next to the sender, or by writing to privacy@roraima.io. When you unsubscribe you leave the list and the alerts requested with the same address are also deleted (section 8). Unsubscribing has no effect on your questions to the properties.
  • How long. As long as you remain subscribed. After you unsubscribe your email address is deleted; for two years we keep only the proof of the consent and of the unsubscription (a code derived from the address, the dates, the page of origin and the text of the box), to show that we respected your choice.

8. "Notify me when there are offers here"

In places without Roraima offers you can ask us for an alert. We process your email address, the place and the section chosen (Stays or Experiences), the date, the page you made the request from and the text of the request as you read it. For the limits against abuse we also use a code derived from the IP address, which we keep for a maximum of 7 days.

We send you an email to confirm the request: without your confirmation within 24 hours the request is deleted. When the first Roraima offer appears within 30 kilometres of the place chosen, we send you a single alert; after the alert the request closes and the data are deleted. If no offer appears within 12 months, the request expires and the data are deleted.

The legal basis is your consent (Article 6(1)(a) GDPR). You can withdraw it at any time with the link at the bottom of the alert or by writing to privacy@roraima.io; when you withdraw it, all the alerts requested with your address are deleted and, if you are subscribed, you also leave the guest list (section 7).

9. Properties not listed on Roraima

This section is addressed to the holders and managers of the accommodation properties that appear on the portal as "not listed on Roraima".

  • Where the data come from. From the public lists of accommodation properties released by public administrations as open data. We use only lists of accommodation properties published for the public, with a licence that allows their reuse, in the most recent version published by the body. The sources are:

    • Puglia: Agenzia Regionale del Turismo Pugliapromozione (CC BY 4.0); Comune di Palagianello and Comune di Candela (CC0 1.0), Comune di Zollino (CC BY 4.0);
    • Veneto: Regione del Veneto (CC BY 4.0);
    • Umbria: Regione Umbria (CC BY);
    • Piemonte: Regione Piemonte (CC BY 4.0);
    • Lazio: Roma Capitale (CC BY);
    • Lombardia: Comune di Milano and Provincia di Cremona (CC0 1.0), Provincia di Monza e della Brianza (CC0 1.0 and CC BY 4.0), published on the portal of Regione Lombardia;
    • Liguria: Comune di Genova (CC BY 4.0);
    • Friuli Venezia Giulia: Regione Friuli Venezia Giulia and ERSA, Agenzia regionale per lo sviluppo rurale (IODL 2.0);
    • Emilia-Romagna: Comune di Modena (CC BY 4.0);
    • Basilicata: Regione Basilicata (CC BY);
    • Marche: Comune di Camerino (CC BY 4.0) and Comune di Castelfidardo (IODL 2.0).

    The page of each property states the body, the list and the licence it comes from, with the words "Data reorganised by Roraima", and the date on which the data were collected.

    We do not write to each property to tell it about this notice: the addresses are tens of thousands, and an email to all of them would itself be an unsolicited communication. For this reason the notice is public here, and we repeat it at the bottom of the first email we forward (Article 14(5)(b) GDPR).

  • Which data. The name of the property, the address, the position on the map, the type of property, the identification code (for example the CIN) and the email address published in the source. If the property is run by a natural person, these data may concern that person. The portal shows only the name, the type of property, the municipality and an approximate position, within an area of about one kilometre: the address and the exact position are never shown.

  • What they are used for. To show the property on the portal, marked "not listed on Roraima", to forward to the email address the availability questions of visitors who have confirmed their own address (section 6), and to send the confirmation when someone asks for the page to be removed. The email address is never shown on the portal or given to visitors: only our forwarding system uses it, and it sends the emails through Brevo (section 6). If you reply to a question, the reply leaves from your mailbox and the guest sees your address, as with any email. We do not use the address to present Roraima, to propose that you list your property or to send promotional communications.

  • Legal basis. The legitimate interest of visitors in contacting accommodation properties, and of the property in receiving availability questions at the address it has made public for this purpose (Article 6(1)(f) GDPR).

  • Objection. You can object at any time (Article 21 GDPR), in three ways:

    • with the link "I do not want to receive further requests" at the bottom of every forwarded email: a page opens with a single button, "I do not want to receive further requests", and pressing it is enough, with no further confirmation. The button prevents an antivirus program that opens the link to check it from excluding you without your having decided so. If your email program shows the unsubscribe button next to the sender, that is enough too;
    • with "Ask us to remove it" on the property's page: in this case the request is confirmed with a link valid for 24 hours, sent to the email address in the source, so that nobody else can remove your property;
    • by writing to privacy@roraima.io.

    From that moment the property's page is removed, the copy of the email address taken from the source is deleted, and a code derived from the address is added to an exclusion list, which we keep to prevent new forwarding even when we update the data from the sources. We do the same if an email we forward to you comes back undelivered or is reported as unwanted.

  • Managing the page. With "Manage this page" you can list the property on Roraima: the page of the unlisted property is replaced by the offer you publish, and the copy of the email address taken from the source is deleted.

  • How long. The data remain on the portal as long as the property appears in the source; if at an update it no longer appears, they are deleted. The exclusion list is kept with no time limit and contains only a code derived from the email address, the reason and the date.

10. Transfers outside the European Union

Cloudflare may process data in the United States, with the safeguards set out in section 5. Brevo processes the data in the European Union. OpenFreeMap processes the data as an independent controller, under its own privacy notice (section 3).

11. Your rights

You can ask us at any time to access your data, to correct them, to delete them, to restrict their processing and to receive them in a readable format, and you can object to processing based on legitimate interest (Articles 15 to 21 GDPR). If the processing is based on consent, you can withdraw it at any time; withdrawal does not affect the processing already carried out. To exercise your rights write to privacy@roraima.io: we reply within one month.

You can also lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the supervisory authority of the country where you live or work.

12. Automated decisions

We do not take decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you. The order of the results does not depend on a profile of you (see "How we rank the results").

13. Changes

If we change this notice, we publish the new version here with the date of the last update.

Last updated: 6 October 2026