Privacy notice

Last updated: 18 settembre 2026

This page explains what personal data Kefamo collects, why it collects it, who it shares it with and what rights you have. It is deliberately written in plain language: if anything is unclear, write to us at privacy@kefamo.com.

Who processes your data

The data controller is Giovanni Nirta, Via Trieste 16, 57023 Cecina (LI) — C.F. NRTGNN90R01D976J.
Contact for personal data matters: privacy@kefamo.com.

What data we collect, and why

If you use Kefamo without signing up

• Approximate location, only if you grant it from your browser. It is used to show you events nearby. We do not store it on our servers: it stays on your device and is used at that moment to work out the search.
• Chosen area and appearance preferences (town, radius, light or dark theme), stored in your browser so the app reopens where you left it.
• Technical browsing data (IP address, browser type), processed by our hosting provider to run the site and protect it from abuse.

If you sign up

• Email address and, if you sign in with Google, the name and profile picture provided by Google. They are used to create and recognise your account.
• Your content: events saved to favourites, attendance and questions to organisers.
• If you are an organiser: business name, address, social profiles and the events you publish. This data is meant to be public, because its purpose is to make your events known.

What other people can see

Some of the things you do on Kefamo are public by nature, because being seen is the point of them:

• When you say «I'm going» to an event, your name and profile picture appear among the attendees, visible to anyone who opens that event, even without an account. That is what the feature is for: letting others know you'll be there. You can remove yourself at any time by pressing the button again.
• Questions to organisers that are made public, with your name.
• Photos you submit, if approved, with the credit you chose.
• If you are an organiser: name, address, contacts and published events. They are there to help people find you.

Everything else — your email, saved events, browsing history — is not visible to any other user.

If you buy or activate a paid service

Payments are handled by Stripe: card details never pass through our systems and we never see them. We only keep the outcome of the transaction and the identifier needed for invoicing and support.

On what legal basis

• Performance of a contract (Art. 6.1.b GDPR): managing your account, publishing events, paid services.
• Consent (Art. 6.1.a): geolocation and photo submissions. You can withdraw it at any time — for location, from your browser settings.
• Legitimate interest (Art. 6.1.f): security of the service, prevention of abuse, technical operation.
• Legal obligation (Art. 6.1.c): retention of tax documents.

Who else processes data on our behalf

We rely on providers who process data as processors, on our instructions:

• Supabase — database, authentication and image storage.
• Vercel — hosting and delivery of the site.
• Google — only if you choose to sign in with Google.
• Stripe — for payments only.
• Anthropic — used by our internal tools to improve the wording of imported event descriptions. It receives no personal data about users.

Some of these providers may also process data outside the European Union. In those cases the transfer takes place on the basis of the standard contractual clauses approved by the European Commission.

We do not sell your data to anyone and we do not pass it on for third-party advertising purposes.

How long we keep it

• Account data: as long as the account exists. If you delete it from your profile, the data is erased immediately — account, published events, submitted photos, saved items and questions — except for whatever the law requires us to keep. There is no grace period: deletion is final.
• Event photos: kept as long as the event they relate to is online, or until you ask for their removal.
• Tax documents: 10 years, as required by law.

The photos you upload

When you upload a photo for an event you declare that you have the right to it and you authorise us to publish it on that event's page. You can ask for it to be removed whenever you like, by writing to info@kefamo.com: we take it down without asking for explanations.

Events collected from public sources

Some of the content comes from public sources (for example the open data portals of local councils). In those cases we state the source on the page and link to the official website. If you are the organiser of an event published this way, you can claim it and manage it, or ask for it to be removed.

Your rights

At any time you can ask to access your data, correct it, erase it, restrict its processing, object to it and receive it in a machine-readable format (portability). Write to privacy@kefamo.com: we reply within one month.

If you believe your data is being handled improperly, you can contact the Italian data protection authority, the Garante per la protezione dei dati personali, or the supervisory authority of the EU country where you live.

Children

Kefamo is not aimed at children under 14 and does not knowingly collect their data. If you notice that a child has signed up, write to us and we will close the account.

Cookies

How we use cookies and browser storage is explained on the dedicated page.

Changes

If we change this notice we will update the date at the top of the page. For significant changes we will notify registered users by email.

Language of this text

This English version is provided for convenience. In the event of any discrepancy, the Italian text of this notice prevails.