Privacy notice
Pursuant to Article 13 of Regulation (EU) 2016/679 (GDPR) and Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018.
Last updated: 9 November 2026 (service name updated to Yoory; the rest of the notice is unchanged from the 23 October 2026 version).
This is a translation of the Italian privacy notice. If the two versions differ, the Italian one prevails.
1. Data controller
The controller of your personal data is Yoory, which you can reach at [email protected].
The controller has not appointed a Data Protection Officer (DPO), as the conditions of Article 37 GDPR do not apply. For any request about your personal data, write to the email address above.
2. Personal data we collect
Through the waitlist sign-up form on yory.app, in Italian and English (including the short version shown at the end of the survey), we collect:
- Email address (required) – needed to contact you when the app launches.
- Name (optional) – to personalize our messages.
- City (optional) – to understand where interested people are.
- Your answer to “How do you plan trips today?” (optional) – for statistics and product development.
- Consent to this privacy notice (required) and consent to receive updates (optional) – recorded with the date and time of sign-up.
- Language of the page you sign up from (Italian or English) – so we can write to you in your language.
- UTM parameters (utm_source, utm_medium, utm_campaign), if present in the link you used – for aggregate statistics on our communication campaigns.
Through the survey “How do you plan your nights out and your trips?” (a section of the home page), open only to people aged 18 or over, we collect:
- Survey answers (age range, planning habits, tools used, preferences and an optional free-text story) – anonymously: the survey asks for neither name nor email, and the answers are not linked to your waitlist sign-up. Please do not include personal data about yourself or others in the free-text story.
- Date and time of completion, rounded to the hour, and the language of the page.
- UTM parameters, if present in the link you used.
At the end of the survey you can join the waitlist: the sign-up is sent separately from your answers and handled like the one from the main form.
We do not collect or store your IP address. To protect the forms from spam we use Cloudflare Turnstile, which briefly processes some technical browser data and your IP address only to check that the request comes from a human. Cloudflare processes this data as a processor, and Yoory does not keep it. For more information, see Cloudflare's Privacy Policy.
3. Purposes and legal basis
We process your personal data for the following purposes:
| Purpose | Legal basis |
|---|---|
| Managing the waitlist: recording your sign-up and contacting you when the app and early access to the beta launch. | Your consent (Article 6(1)(a) GDPR), given at sign-up through the required checkbox. |
| Sending updates on Yoory's development (only if you ticked the optional checkbox). | Your consent (Article 6(1)(a) GDPR), which you can withdraw at any time. |
| Aggregate statistics on campaigns (UTM parameters) and survey answers, to understand which channels work and how people plan their trips. | The controller's legitimate interest (Article 6(1)(f) GDPR) in improving the product and its communication, balanced by the minimal intrusiveness of the processing (non-identifying data, aggregate analysis). |
| Market research: aggregate analysis of survey answers to design the app. | The controller's legitimate interest (Article 6(1)(f) GDPR) in building the product around users' real needs, with anonymous and optional answers. |
| Security and spam prevention through Cloudflare Turnstile. | The controller's legitimate interest (Article 6(1)(f) GDPR) in protecting the service from abuse. |
4. Cookies and tracking technologies
This site does not use profiling cookies or advertising trackers. For visit statistics we use Cloudflare Web Analytics, a privacy-first service that uses no cookies, collects no identifying personal data and does not track you across sites. The fonts (Inter) are hosted on our own servers, so no data or IP address is sent to third-party font providers (such as Google).
5. Recipients and data transfers
Your personal data is not sold, transferred or disclosed to third parties for marketing purposes. It may be processed only by the following technical provider, acting as a processor under Article 28 GDPR:
- Cloudflare, Inc. (San Francisco, USA) – site hosting on Cloudflare Pages, D1 database, Turnstile anti-spam and Web Analytics. Cloudflare participates in the EU-US Data Privacy Framework, which provides adequate safeguards for transfers to the United States under Article 45 GDPR (European Commission adequacy decision of 10 July 2023).
No other transfers of personal data to countries outside the European Economic Area are planned.
6. How long we keep your data
We keep your data only as long as needed for the purposes above, and in any case:
- Waitlist data: until the app's public launch and for no more than 24 months from sign-up, unless you ask us to delete it sooner.
- Survey answers: for no more than 24 months from completion; aggregate results, which contain no personal data, may be kept longer.
- Consent to updates: until you withdraw it. Withdrawal does not affect the lawfulness of processing carried out before it.
After the retention period, the data is permanently deleted from the database.
7. Your rights
As a data subject, under Articles 15–22 GDPR you have the right to:
- Access (Article 15): find out whether we process data about you and, if so, get a copy.
- Rectification (Article 16): have inaccurate data corrected or incomplete data completed.
- Erasure (Article 17, “right to be forgotten”): have your data deleted when it is no longer needed for the purposes it was collected for or when you withdraw your consent.
- Restriction of processing (Article 18): have processing restricted in the cases provided by law.
- Portability (Article 20): receive your data in a structured, commonly used and machine-readable format.
- Objection (Article 21): object to the processing of your data on grounds relating to your particular situation.
- Withdrawal of consent (Article 7(3)): withdraw your consent at any time, without affecting the lawfulness of processing based on consent before its withdrawal.
To exercise your rights, write to [email protected]. We will reply within 30 days of receiving your request, as required by Article 12 GDPR.
8. Right to lodge a complaint
If you believe that the processing of your personal data infringes the GDPR, you have the right to lodge a complaint with the competent supervisory authority. In Italy, this is the Garante per la protezione dei dati personali:
- Website: garanteprivacy.it
- Email: [email protected]
- PEC (certified email): [email protected]
9. Changes to this notice
The controller may change this notice at any time by publishing the updated version on this page with the date of the last update. Please check this page from time to time.