Privacy Policy.
Last updated: October 15, 2026
This notice explains how personal data of users of ilcartaista.com and of the Il Cartaista app for iOS and Android (together “Il Cartaista” or the “Site”; references to the Site also include the app) is processed under Regulation (EU) 2016/679 (“GDPR”), Italian Legislative Decree 196/2003 as amended by Legislative Decree 101/2018 (the “Privacy Code”), decisions of the Italian Data Protection Authority and, for users in Switzerland, the Federal Act on Data Protection of September 25, 2020 (“FADP”) and its Ordinance (“DPO”).
Il Cartaista is an independent information portal. It is not affiliated with, sponsored or endorsed by American Express. “American Express” and “Membership Rewards” are trademarks of their respective owners and are mentioned for descriptive purposes only.
1. Data controller
Nexa Media Group S.r.l.
Registered office: Via dei Normanni 30/1, 84085 Mercato San Severino (SA), Italy
Tax code and VAT no.: 06390400650
Certified email (PEC): nexamediagroup@pec.it — Email: info@nexamediagroup.it
Legal representative: Carmine Rosamilia
Privacy contact: privacy@nexamediagroup.it
The controller has not appointed a Data Protection Officer (DPO), as the conditions under Article 37 GDPR are not met. For questions about personal data, contact privacy@nexamediagroup.it.
Users in Switzerland. The controller is established in the European Union. It has not appointed a representative in Switzerland because the conditions in Article 14 FADP (regular, large-scale processing that entails a high risk to data subjects) are not cumulatively met. Users in Switzerland may contact the controller directly using the details above.
2. Personal data we process
2.1 Registration data (all users). Email address, password (stored only in encrypted form using scrypt hashing and a random salt, never in plain text), account type (private user or merchant), nickname or display name, optional profile photo and any referral code used.
2.1-bis Sign-in with Google. If you choose “Continue with Google”, Google provides your Google account identifier, email address (confirmed as verified), name and profile image. We use these data only to create or link your account and let you sign in: the name may prefill your nickname and the image is not stored. We do not receive your Google password or access other Google data or services. You can unlink sign-in in your Google account settings; deleting your Il Cartaista account also removes the link.
2.1-ter Sign-in with Apple. If you choose “Continue with Apple”, Apple provides an Apple ID identifier, email address (which may be a private relay address if you choose “Hide My Email”) and, on first sign-in only, your name. We use these data only to create or link your account and let you sign in. You can stop using Sign in with Apple in your Apple ID settings.
2.2 Date of birth. Requested solely to verify that the user is an adult. It is not retained after verification.
2.3 Declared card data. Cards selected from our catalogue (or a declaration that you do not hold any) and the user-declared Membership Rewards balance. The Site never asks for or stores a card number, CVV, expiry date, PIN, OTP codes, account balances or American Express credentials. The Site is not connected to the user’s American Express account.
2.4 Merchant data. Business name, VAT number and business email; listing content (category, description, address, telephone, website, offers and photographs); billing details (recipient code or PEC, tax code/VAT number, address, city, postcode and province); merchant points purchase history; and data provided in a SumUp × Fluent partnership request (first and last name, business name, business email, customer type and estimated monthly transaction-volume band).
2.5 Loyalty program data. Loyalty code, member number (e.g. CT-000123), personal referral code, points balance and transactions, spending amounts declared by merchants to credit points, bookings and promotion redemptions, and account status (active/frozen).
2.6 User-submitted content and Community. Article comments; reports of businesses that accept American Express (business name, city, address and coordinates); in the Community: posts, travel reports with up to 8 photos, polls, city tags and place tips with coordinates, comments, likes and reactions, chat messages including photos and voice messages, events, Community listings, reviews of merchants and reports of scams or phishing. If you select “Also visible on the website”, your post and display name are published on the public Community page and on the relevant city guide. Messages may be translated automatically on request.
2.9 App data. Push notification token and device platform; notification preferences and quiet hours; data shown in widgets, Live Activities (Dynamic Island) and the Apple Wallet or Google Wallet pass (member number, points, level, stamp cards and recent transactions). With your permission, the app uses: location to show nearby businesses and, only if you enable “Nearby businesses”, in the background to alert you near a listing (coordinates are sent to the server only to search nearby businesses and are not stored; coordinates you deliberately add to a report or tip are stored with it); camera (merchants scanning a loyalty QR code); photo library (images you choose to upload); microphone (only to record voice messages you send); Face ID/Touch ID (handled entirely by the device; we receive no biometric data). Each permission can be revoked in your device settings.
2.10 Personal tools. Data you enter in Carte+ and Strumenti: card benefit calendar and reminders, Membership Rewards balance history, goals, saved trips and Miles searches, favourite places, family sharing (linked accounts see only the balance and goals you choose to share), stamp cards earned at merchants and merchant bookings.
2.11 Support. Messages exchanged with the virtual assistant and with our operators, the rating of the conversation and, for guests, the email address provided.
2.12 Newsletter. Email address and subscription status, only if you subscribe.
2.13 In-app purchases. For Premium or merchant purchases made in the app, Apple or Google process the payment; from RevenueCat we receive only an app user identifier, the product, and the status and expiry of the subscription, never your payment card.
2.7 Technical and security data. IP address, session data, logs of sign-in attempts and abuse (rate limiting), technical server logs, logs of transactional emails sent, email verification tokens and password reset tokens.
2.8 Usage, analytics and advertising data. Through cookies and similar technologies, only with consent where required: online identifiers, Site usage data, device and browser information, and approximate location. See the Cookie Policy for details.
The Site does not request special categories of data (Article 9 GDPR) or data relating to criminal convictions or offences. Users are asked not to include such information in free-text fields (comments or descriptions).
2.14 Miles points and plans bought on the Site. When you buy points or a Miles plan on the Site we process your full name (or company name), Italian tax code, VAT number if any, billing address, invoice email, product, amount, date, payment status, Stripe payment identifiers, the time you accepted the Terms and asked for the service to start immediately, the invoice number and PDF, and any refunds (amount, points removed, date). Card details are collected and processed only by Stripe: we never receive or store them. For purchases made in the app, Apple or Google issue the receipt and we receive from RevenueCat only the product, transaction ID, price, status and any refunds.
2.15 Miles Calculator live search. We process the route, dates, cabin, passengers, chosen programmes, how the search was paid (points, included search or free) and any refunds. Our search service, which checks airline websites, receives only the trip details, never your name, email or other account data. Results are kept in a route archive with no link to your identity, so the same route is free for all members for a few hours. Billing data and invoices are kept for 10 years for tax purposes (legal obligation, art. 6.1.c GDPR); the anonymous route archive is kept without time limit. Admin notifications on Telegram include billing data for purchases to be invoiced and only a shortened user ID for live searches.
3. Purposes and legal bases
| # | Purpose | Data | Legal basis (GDPR) |
|---|---|---|---|
| a | Registration, account management, authentication, email verification and password reset | 2.1, 2.2, 2.7 | Performance of a contract (Art. 6(1)(b)) |
| b | Age verification | 2.2 | Performance of a contract (Art. 6(1)(b)) and legitimate interest in not providing the service to minors (Art. 6(1)(f)) |
| c | Preventing abuse, bots and fraudulent access (Cloudflare Turnstile, rate limiting) | 2.7 | Legitimate interest in Site security (Art. 6(1)(f)) |
| d | Providing features: card wallet, Miles Calculator, personalized news, loyalty program, referrals, promotions and Google Wallet pass | 2.3, 2.5 | Performance of a contract (Art. 6(1)(b)) |
| e | Managing and publishing merchant listings and user reports | 2.4, 2.6 | Performance of a contract (Art. 6(1)(b)) |
| f | Moderating content and handling reports of illegal content under Regulation (EU) 2022/2065 (DSA) | 2.6, 2.7 | Legal obligation (Art. 6(1)(c)) and legitimate interest (Art. 6(1)(f)) |
| g | Selling merchant points packages, collecting payment and invoicing | 2.4 | Performance of a contract (Art. 6(1)(b)) and compliance with tax and accounting obligations (Art. 6(1)(c)) |
| h | Sending the activation link for a SumUp × Fluent partnership requested by a merchant | 2.4 | Pre-contractual steps requested by the data subject (Art. 6(1)(b)) |
| i | Service communications (transactional emails) | 2.1 | Performance of a contract (Art. 6(1)(b)) |
| j | Internal administrator notifications (e.g. new registrations) and audit log of administrative actions | 2.1, 2.4, 2.7 | Legitimate interest in internal organization and security (Art. 6(1)(f)) |
| k | Usage statistics through Google Analytics 4 | 2.8 | Consent (Art. 6(1)(a) GDPR and Art. 122 Privacy Code) |
| l | Advertising through Google AdSense, Adsterra and Infolinks | 2.8 | Consent (Art. 6(1)(a) GDPR and Art. 122 Privacy Code) |
| m | Affiliate link management and commission attribution through Skimlinks | 2.8 | Consent (Art. 6(1)(a) GDPR and Art. 122 Privacy Code) |
| n | Establishing, exercising or defending legal claims | all relevant data | Legitimate interest (Art. 6(1)(f)) |
| o | Community, chat, voice messages, reviews, family sharing, stamp cards and personal tools | 2.6, 2.10 | Performance of a contract (Art. 6(1)(b)) |
| p | Push notifications, widgets, Live Activities and Wallet passes | 2.5, 2.9 | Performance of a contract (Art. 6(1)(b)); push notifications only with your device permission, revocable at any time |
| q | Nearby businesses and background alerts | 2.9 (location) | Consent given through the device permission (Art. 6(1)(a)) |
| r | Support through the virtual assistant and operators | 2.11 | Performance of a contract (Art. 6(1)(b)) |
| s | Automated pre-screening of uploaded images and text to protect the Community, and translation on request | 2.6 | Legitimate interest in the safety of the Community (Art. 6(1)(f)) and obligations under the DSA (Art. 6(1)(c)) |
| t | Weekly newsletter | 2.12 | Consent (Art. 6(1)(a)), withdrawable through the link in every email |
| u | Premium subscriptions and in-app purchases | 2.13 | Performance of a contract (Art. 6(1)(b)) |
For purposes based on legitimate interest, you may object at any time (Article 21 GDPR). Consent for purposes k, l and m may be withdrawn at any time using the “Cookie preferences” link at the bottom of each page. Withdrawal does not affect the lawfulness of processing carried out before withdrawal.
The Site does not make decisions based solely on automated processing that produce legal or similarly significant effects on users (Article 22 GDPR; Article 21 FADP). Moderation, suspension and approval decisions are made by human administrators or by volunteer moderators appointed by us. Automated tools (including AI models) may hold an image or text for review, but they do not take final decisions; you can always ask for a human review.
4. Whether providing data is mandatory
Data marked as mandatory in forms is needed to register and use the services. Without it, you cannot create an account or use the requested feature. Billing data is needed to purchase merchant points packages. Consent to analytics and advertising cookies is optional; refusing it does not prevent use of the Site.
5. Recipients of data
Data is processed by authorized personnel instructed by the controller (Article 29 GDPR; Article 2-quaterdecies of the Privacy Code) and by the providers below, acting as processors (Article 28 GDPR) under an agreement or, where indicated, as independent controllers:
| Provider | Service | Role | Location of processing |
|---|---|---|---|
| Hostinger International Ltd. | Hosting, database and storage of uploaded files | Processor | EU |
| 650 Industries, Inc. (Expo) | Push notification delivery and app updates | Processor | USA |
| Apple Inc. / Apple Distribution International Ltd. | Push notifications (APNs), Apple Wallet, App Store and in-app purchases | Processor for push and Wallet; independent controller for App Store payments | Ireland / USA |
| Google Ireland Ltd. / Google LLC | Google Play in-app purchases; Google Maps Platform (Places) for public reviews of listings | Independent controller for payments; processor for Places | Ireland / USA |
| RevenueCat, Inc. | Management of in-app subscriptions and purchases | Processor | USA |
| Groq, Inc. | AI models for the support assistant, automatic translation and content pre-screening | Processor | USA |
| Sendinblue SAS (Brevo) | Newsletter | Processor | France / EU |
| Stripe Payments Europe Ltd. | Card payments | Independent controller for payment data | Ireland / USA |
| Apple Distribution International Ltd. / Apple Inc. | Sign in with Apple, only if selected by the user | Independent controller for Apple ID data | Ireland / USA |
| Google Ireland Ltd. / Google LLC | Sign in with Google (OpenID Connect), only if selected by the user | Independent controller for account data | Ireland / USA |
| Resend (Plus Five Five Inc.) | Transactional email delivery | Processor | USA |
| Cloudflare Inc. | Bot protection (Turnstile) | Processor | USA / global network |
| OpenStreetMap Foundation (Nominatim) | Address geocoding | Independent controller | United Kingdom |
| Google Ireland Ltd. / Google LLC | Google Analytics 4 | Processor | Ireland / USA |
| Google Ireland Ltd. / Google LLC | Google AdSense, Google Wallet | Independent controller under Google’s terms | Ireland / USA |
| iubenda s.r.l. | Cookie preference management (Privacy Controls and Cookie Solution) | CMP provider; role as set out in service terms | Italy / global network |
| AD MARKET LIMITED (Adsterra) | Display and native ads | Advertising provider; role under its notice and terms | Cyprus / global network |
| Infolinks, Inc. | Contextual ads | Advertising provider; role under its notice and terms | USA / global network |
| Skimbit Ltd. (Skimlinks) | Affiliate links and commission attribution | Roles set out in Publisher Privacy Terms | United Kingdom / global network |
| Telegram FZ-LLC | Internal administrator notifications, including support requests | Processor | United Arab Emirates / global network |
| SumUp / Fluent / myPOS | Payment services offered to merchants, only if activated through the link received | Independent controllers | EU |
| Electronic invoicing provider and SdI intermediary | Invoice issuance and transmission | Processor | Italy |
| Tax and accounting adviser | Accounting and tax compliance | Independent controller | Italy |
Data may also be disclosed to public or judicial authorities when required by law. The controller does not directly sell account data. Advertising and affiliate providers may receive technical and usage data only in accordance with the cookie choices made, and process them under their own notices. The current list of processors is available on request at privacy@nexamediagroup.it.
Data visible to other users. Your display name and optional profile photo appear next to your comments. Merchant listings are visible to registered users. Approved reports become public map points (business name, city and coordinates), without any data about the person who submitted the report. In the Community, your display name, photo, level and badges appear next to your posts, comments, chat messages, voice messages, reviews and events; only posts you mark “Also visible on the website” can be seen by people without an account.
6. Transfers outside the EU/EEA and Switzerland
Some providers are based in, or use infrastructure in, the United States or other third countries. Transfers take place only on the basis of:
- an adequacy decision of the European Commission dated July 10, 2023 on the EU-U.S. Data Privacy Framework, for certified providers and, for users in Switzerland, the inclusion of the United States (limited to companies certified under the Swiss-U.S. Data Privacy Framework) among countries offering adequate protection under Annex 1 DPO;
- standard contractual clauses approved by the European Commission in Decision (EU) 2021/914, also recognized by the Swiss Federal Data Protection and Information Commissioner, for providers that are not certified or transfers to other countries;
- adequacy decisions concerning the United Kingdom and Switzerland, where applicable.
Potential destination countries: United States, United Kingdom and United Arab Emirates. You may request a copy of the safeguards by writing to privacy@nexamediagroup.it.
7. How long we retain data
| Data | Retention period |
|---|---|
| Account and linked data | Until the user deletes the account, and in any case no longer than permitted by applicable law |
| Date of birth | Not retained after verification |
| Billing data and purchase records | 10 years from the transaction (Article 2220 of the Italian Civil Code and tax laws), including after account deletion |
| Email verification token | 24 hours |
| Password reset token | Until used or expired |
| Abuse and rate-limiting logs (IP) | 90 days |
| Technical server logs | 90 days |
| Transactional email logs | 12 months |
| Audit log of administrative actions | 24 months, unless needed for legal defence |
| Reported content and moderation decisions | 6 months from the decision, unless a dispute is ongoing |
| Cookie-based usage data | See Cookie Policy |
| Push token | Until you disable notifications, sign out or the token expires |
| Location used for nearby businesses | Not stored |
| Community content, chat and voice messages | Until deleted by you or by moderation, or until the account is deleted |
| In-app notifications | For as long as needed to provide the service, within the limits set by law |
| Support conversations | For the period required by law and to handle any complaints or disputes |
| Newsletter | Until you unsubscribe |
When an account is deleted, the profile, cards, loyalty points and related transactions, listings, comments, reports, bookings, sessions, tokens, links and referrals are permanently deleted. Data needed to meet tax and accounting obligations is retained only for the period and purpose required by law. Data in SumUp/Fluent requests is anonymized. Once the stated periods expire, data is deleted or irreversibly anonymized.
8. Security
The controller uses appropriate technical and organizational measures (Article 32 GDPR; Article 8 FADP), including scrypt password hashing, HTTPS connections, HttpOnly/Secure/SameSite session cookies, restricted database access, bot protection, sign-in attempt limits, an audit log of administrative actions and access to data restricted to authorized personnel. If a personal data breach occurs, the controller will meet its notification duties to the supervisory authority and, where required, affected individuals (Articles 33–34 GDPR; Article 24 FADP).
9. Your rights
Users in the EU/EEA. You may exercise the rights under Articles 15–22 GDPR at any time: access, rectification, erasure, restriction, portability, objection and withdrawal of consent. You can delete your account in your profile settings. Other requests, including a copy of your data in a structured, machine-readable format, may be sent to privacy@nexamediagroup.it or by certified email to nexamediagroup@pec.it. The controller will respond without undue delay and within one month, which may be extended by two months where Article 12 GDPR allows. To verify your identity, the controller may ask you to send the request from the email address associated with your account. You may lodge a complaint with the Italian Data Protection Authority (Piazza Venezia 11, 00187 Rome — www.garanteprivacy.it) or the supervisory authority in the EU Member State where you live or work.
Users in Switzerland. You have the rights under the FADP, including access (Article 25), delivery or transfer of data (Article 28), rectification, erasure and objection to processing (Article 32). Send requests to the same contacts; we normally respond within 30 days. You may contact the Swiss Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern (www.edoeb.admin.ch).
Users in other countries. Users residing elsewhere (e.g. the United Kingdom) have the rights provided by applicable local law and may exercise them using the same contact details.
10. Children
The Site is for people aged 18 or over. Registration is refused if the date of birth provided does not show that the user is an adult. If the controller learns that data about a minor has been collected, it will delete it without delay.
11. Advertising and affiliate links
The Site may display ads from Google AdSense, Adsterra and Infolinks. Their tags are subject to the consent preferences managed by iubenda. These providers may use cookies and similar technologies to serve and measure ads and, where authorized, personalize them. More information: Google, Adsterra and Infolinks. You can change or withdraw your choices at any time in the “Cookie preferences” panel.
The Site may also use Skimlinks to convert some store links into affiliate links and attribute any resulting commissions. If you purchase through such a link, Il Cartaista may receive a commission at no additional cost to you. Skimlinks code is subject to cookie preferences. Policy: Skimlinks.
Advertising spaces and sponsored content are identified as such. Articles containing affiliate links are labelled accordingly.
12. Changes
This notice may be updated. If there are material changes, registered users will be notified by email or by a notice on the Site before the changes take effect. The date of the latest update appears at the top.
13. Contact
Nexa Media Group S.r.l. — Via dei Normanni 30/1, 84085 Mercato San Severino (SA), Italy
Privacy: privacy@nexamediagroup.it — PEC: nexamediagroup@pec.it — Site: info@ilcartaista.com