Privacy Policy

The data controller is Capital AI Srl, Via Giuseppe Ripamonti 19, 20135 Milan, Italy (VAT and tax number 13856590966). Data protection contact: vincent@capital-ai.eu. No Data Protection Officer is currently appointed; if one is designated we will name them here.

If you are in the EU or UK you may complain to your national supervisory authority. In Italy that is the Garante per la protezione dei dati personali; in the UK, the Information Commissioner’s Office.

Everything below is tied to a specific lawful basis under GDPR Article 6.

Dietary information can reveal health or religious belief, which is special-category data under Article 9. We pass it to your host only so they can cook for you safely, and we rely on your explicit consent, given when you provide it at booking. You may leave it blank.

Your host receives your name, party size, and any dietary notes — what they need to receive you.

Stripe processes payments and, for hosts, identity verification and payouts. Stripe is an independent controller for those purposes and holds host bank details; we do not.

Google (Firebase) hosts our infrastructure, database and sign-in, as our processor.

Google also sends our transactional email (booking confirmations) over Gmail SMTP.

Tax authorities, where DAC7 or equivalent law requires us to report host earnings.

Google Analytics and Microsoft Clarity receive usage data — but only if you accepted analytics cookies. Decline and neither is loaded.

We do not sell your personal data.

Our infrastructure runs in the EU (europe-west4, Netherlands). Some processors may transfer data outside the EEA; where they do, it is covered by the European Commission’s Standard Contractual Clauses or an adequacy decision.

Account data: while your account is open, then deleted or anonymised within 30 days of closure.

Transaction and tax records: retained for up to 10 years after the transaction, because tax and accounting law requires it. This obligation overrides a deletion request for those specific records — we will delete everything else and explain what we had to keep.

Reviews: retained while the listing exists, so they stay useful.

You can ask us to give you a copy of your data, correct it, delete it, restrict or object to how we use it, or send it to another provider. Where we rely on consent, you can withdraw it at any time — that does not affect what we did before you withdrew it.

To delete your account, use the option in Dashboard → Settings, or write to vincent@capital-ai.eu. We respond within one month.

Access to personal data is restricted, transport is encrypted, and payment card details never touch our servers — they go directly to Stripe. No system is perfectly secure; if a breach affects your rights and freedoms we will notify you and the relevant authority as the law requires.

Squiszi is not for under-18s and we do not knowingly collect their data. Children may of course attend a dinner accompanied by an adult who made the booking.

If we make a material change we will tell you before it takes effect. The date at the top always reflects the current version.