Privacy policy

Your data, treated
with respect.

Last updated: 16 July 2026

This Privacy Policy explains how NarraTours S.r.l., Via Romante 13, 01000 Roma (RM), Italy, VAT/P.IVA IT 092387890 ("NarraTours", "we", "us") processes personal data as data controller under the EU General Data Protection Regulation (GDPR) and Italian privacy law, when you visit narra-tours.com, purchase a tour, use our experiences, or interact with us as a host or partner.

1.The data we process, and why

a) When you buy a tour

We process your name, email address, order details and payment confirmation to deliver your purchase, send your access link and provide support. Card data is handled directly by our payment processor through an encrypted checkout — we never see or store full card numbers. Legal basis: performance of a contract (Art. 6(1)(b) GDPR); invoicing data is kept to comply with tax law (Art. 6(1)(c) GDPR).

b) When you use your tour

We process technical access data (access link usage, device/browser information, progress within the experience) to make the tours work, keep them secure and improve them. Legal basis: performance of a contract and our legitimate interest in the security and improvement of the Service (Art. 6(1)(b) and (f) GDPR).

c) When you talk to the AI city guide

Your questions to the AI guide are processed to generate answers, using specialised AI technology providers acting on our behalf. Conversations are used to run and improve the assistant, not to build advertising profiles. Please don't share sensitive personal information (health, documents, payment details) in the chat — it's a city guide, not a vault. Legal basis: performance of a contract (Art. 6(1)(b) GDPR).

d) When you contact us

If you write to us, we process your email address and the content of your message to reply and keep track of the request. Legal basis: our legitimate interest in handling correspondence, or the contract if your request concerns a purchase (Art. 6(1)(f) and (b) GDPR).

e) Hosts and business contacts

If you operate an accommodation business, we may process your business contact details (name, business name, email, address) obtained from you directly, from public registers of accommodation operators (such as the open dataset of Roma Capitale) or from contact details you publish on your own business website, to propose our partner program and manage the partnership, including commission payouts. Legal basis: our legitimate interest in business-to-business communication (Art. 6(1)(f) GDPR) and, once you join, performance of the partner agreement (Art. 6(1)(b) GDPR). Every message includes a simple way to opt out, and you can object at any time (see Section 6) — we'll stop immediately.

f) When you browse the site

Cookies and similar technologies are described in our Cookie Policy, including how to give and withdraw consent for non-essential ones.

2.Who receives your data

We never sell personal data. We share it only with service providers acting under our instructions as processors, and only to the extent needed:

• HighLevel / LeadConnector — website, checkout, CRM and content-delivery platform
• Payment processors — to process your payment securely
• Vimeo — streaming of tour audio and video
• AI technology providers — to power the AI city guide
• Email and communication providers — to send order confirmations, access links and replies

Data may also be disclosed to authorities where the law requires it, or to professional advisors under confidentiality.

3.Transfers outside the EU

Some providers are based in the United States or other non-EU countries. Where personal data is transferred, we rely on safeguards recognised by the GDPR — an adequacy decision (such as the EU-U.S. Data Privacy Framework) or the EU Standard Contractual Clauses. You can request more details using the contact below.

4.How long we keep data

5.How we protect data

We use appropriate technical and organisational measures: encrypted connections (HTTPS), access on a need-to-know basis, reputable providers with their own GDPR commitments, and no storage of full payment card data on our systems.

6.Your rights

Under Articles 15–22 GDPR you can, at any time and free of charge:

• Access your data and get a copy
• Rectify inaccurate or incomplete data
• Erase data ("right to be forgotten"), within legal limits
• Restrict processing in the cases provided by law
• Receive your data in a portable format
• Object to processing based on legitimate interest — including host outreach, where your objection is always honoured
• Withdraw consent where processing is based on consent (e.g. non-essential cookies), without affecting past processing

To exercise any right, email [email protected] — we reply within the timelines set by the GDPR (normally one month). You also have the right to lodge a complaint with the Italian supervisory authority, the Garante per la Protezione dei Dati Personali, or with the authority of your country of residence.

7.Children

The Service is intended for adults: purchases may only be made by people aged 18 or over. We do not knowingly collect data from children; if you believe a child has provided us personal data, contact us and we will delete it.

8.No automated decisions

We do not carry out automated decision-making that produces legal or similarly significant effects on you (Art. 22 GDPR). The AI guide answers questions — it makes no decisions about you.

9.Updates to this policy

We may update this policy when our tools or the law change. The date at the top shows the current version; significant changes will be highlighted on the site or communicated by email to affected users.