Your data, plainly

The data controller is LA BRACERIA S.R.L. (La braceriA), Via Lauretana 957, 52044 Camucia di Cortona (AR), VAT 02495820512. For any question about this policy or your data: labraceriacortona@gmail.com.

The booking form asks for your name, phone number, email, party size, date and time: all of them are needed, without one of these we cannot register the request. Notes are optional. We use this data only to manage the booking and reply to you (legal basis: pre-contractual measures at your request, art. 6.1.b GDPR). To your email we immediately send a receipt of the request and then the confirmation or refusal in writing (see “The emails we send you”); the phone number is for when we need to talk, WhatsApp included. Requests are stored on the systems listed under “Where the data lives” and are seen only by those who handle them (see “Who sees the data”); they are deleted automatically 30 days after the booking date. You can ask for deletion earlier, at any time.

Notes are not meant to collect health data: tell us about allergies and intolerances by phone or at the table, not in writing — the site does not ask for them, and if you write them anyway we use them for that service only and keep them no longer. Do not put other people’s data (names, phone numbers) in the notes: yours is enough for the table.

The events form asks for your name and a contact (needed: without them we cannot call you back) and the details of your event — guests, date, place, message — which you may leave blank. We use them only to prepare a proposal and get back to you, by email, phone or WhatsApp (art. 6.1.b GDPR). If the contact is an email address, you receive a receipt of the request right away. The same rule as for notes applies: tell us about guests’ allergies and intolerances when we call you back, and the message needs no other people’s data. The request is deleted automatically 180 days after it is sent; you can ask for deletion earlier.

If you buy a gift card, payment happens on Stripe’s page: card data travels to Stripe only and never touches our systems. We keep the value, sender and recipient names, the optional dedication, your email and the card’s status: we store them to manage the voucher, which we email you with its code as soon as the payment is confirmed (see “The emails we send you”); 12 months after it expires, names, dedication and email are removed, while the amount stays in our accounts for tax obligations. Staff receive an internal issue notification without your personal data.

The site is hosted on Cloudflare (Cloudflare Pages and the D1 database), acting as a processor under its Data Processing Addendum; the infrastructure is distributed and data may also be processed outside the European Union with the safeguards provided by that agreement (standard contractual clauses and the Data Privacy Framework). Like any web service, Cloudflare produces technical request logs (including IP addresses) for security and operation, under its own retention rules.

To defend the forms from automated submissions we count requests per origin: what reaches our database is not the IP address but a fingerprint of it, encrypted with a key of ours, valid for at most twenty minutes (one hour for the panel’s email test) and deleted every night. That is pseudonymisation, not anonymity: which is why it lasts so briefly.

Before a booking is deleted, the day it refers to is reduced to counts only — how many requests, how many covers, at what time, in which language — which remain so we can keep the restaurant’s statistics. Those counts contain nobody’s name, phone, email or note, cannot be traced back to a person, and for that reason have no expiry: they are no longer personal data.

The deletions described on this page happen automatically every night and the site checks them itself: if a row survives past its term, the site’s health status reports it to those who maintain it. Cloudflare keeps backup copies of the database for up to 30 days, so it can be restored after a failure: if a restore brought back data already deleted, the next run deletes it again.

Requests are read by the restaurant staff who handle them, from a private panel with personal access and expiring sessions; and, only when needed to keep the site working, by those who maintain it on our behalf, bound by an agreement. After the first contact we may keep writing to each other from the restaurant’s mailbox or on WhatsApp: those conversations live on those services, under their rules, and we keep them only for the duration of the relationship.

Staff receive internal alerts on Telegram when a request arrives: they contain date, time, party size and internal references, never name, phone, email or notes. They are working alerts, not anonymous in an absolute sense (an internal reference points to the record in the panel): which is why they stay in the staff group and nowhere else.

We only write to you in reply to a request of yours: the receipt of a booking or event request, the confirmation or refusal of a booking, a gift card voucher, the confirmation and updates of an order. No newsletters, no promotions. The emails contain no tracking images or links: we do not know whether you open them.

To send them we use Resend (Resend Inc., United States), acting as a processor under its Data Processing Addendum. Resend receives the address, subject and text of every email: sending starts from servers in the European Union, but Resend stores the email logs — content included — in the United States for 30 days, with backups for another 7; the transfer is covered by the standard contractual clauses in its agreement and by its participation in the Data Privacy Framework. Open and click tracking is turned off in our account. We keep a log of the emails (address, type, outcome — never the content), deleted automatically 30 days after sending, or after the last attempt if it never left.

Until you make a choice yourself, this site writes no cookies and contacts no third-party service to follow you: no profiling cookies, no pixels, no analytics. That is why there is no banner: the only choice we ask of you is the map’s, and we ask it there. Fonts and flags are served from our own domain. What the browser keeps is listed in the table at the end of this section.

The forms (booking, event request, gift, shop, panel login) load Cloudflare’s Turnstile anti-spam check at their last step — the same provider that hosts the site. Its only job is to tell a person from an automated program before the form is sent: it does not profile you, sets no advertising cookies and does not follow you across sites. To do so Cloudflare receives the IP address, the TLS connection fingerprint, the browser type, our site key and the page the check runs on. Under the Turnstile Privacy Addendum, Cloudflare processes this data as our processor to protect the site and, separately, as an independent controller to improve its own bot detection; we do not use the “pre-clearance” feature, which would write a cookie. The legal basis is our legitimate interest in protecting the service from automated submissions: the check appears only when you are about to send something, not before.

The exception is the Google Maps map in the “See you at La braceriA” section, which writes its own cookies: that is why it stays off until you press “Show the map”. Until then, Google receives nothing; if you load it, Google (Google Ireland Ltd) receives the map request and your IP address — not the address of the page you view it from — and may write its cookies, with names and durations decided by Google (see its policy), and process data outside the European Union too, under the Data Privacy Framework safeguards. Your choice is remembered on your device for 6 months, together with the date and the version of this text: if we change it, we ask you again. You can withdraw it at any time with “Hide the map” or with the control below: the map disappears and is no longer loaded, but the cookies Google has already written can only be deleted by your browser (from its site-data settings). Directions (“Open navigation”) are a plain link: they open only if you press them.

In rare cases, for a country flag not available on our servers, the browser may load the image from flagcdn.com (Flagpedia): that service receives only the image request, with the IP address, and no cookie. The images in the emails we send you (our logo) live on our domain and are the same for everyone: they do not tell us who opens them.

Cookies and browser storage, in full

Links to Instagram, Google Maps and WhatsApp (for information and bookings) lead to third-party services: their policies apply when you open them. Apart from the map you load yourself, no content from those services is embedded in our pages.

You can request access to your data, rectification, erasure, restriction of processing, portability and object at any time (arts. 15–21 GDPR) by writing to labraceriacortona@gmail.com: it is the restaurant’s mailbox, read by the owner. We reply within one month; if the request is complex we may take up to two more months, letting you know. When we delete, we do so in the copies we control too (panel, email log, conversations with you); we cannot delete what the law requires us to keep, such as the accounting records of a payment. We make no automated decisions about you and do no profiling. We have no data protection officer: for a business like ours it is not required. If you believe processing violates the law, you can lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali (gpdp.it).

If the site changes (new features, new providers), this page will be updated first. Version in force since 21 September 2026. The Italian text prevails in case of discrepancy.