Last updated: 11 September 2026
This page explains what personal data TuscanDreamVacation.com collects, what I do with it, who else handles it, and how you can see it, change it or have it deleted. I’ve tried to write it in plain English. If anything is unclear, email me and I’ll explain.
Who is responsible for your data
Tuscan Dream Vacation is run by Gaby Frisoli, the author behind the site and its books. For data protection purposes, I am the “controller” of your data: Gaby Frisoli, 3 E Evergreen Road, New City, NY 10569, United States.
You can reach me about anything on this page at info@tuscandreamvacation.com. I’m a one-person business, so I don’t have a Data Protection Officer, and I’m not required to.
What I collect, why, and for how long
Free guides and reader bonuses
When you download a free guide, such as Florence in One Day, I ask for your email address. I use it to give you the guide and for nothing else, unless you also tick the separate box asking for my emails. The box is never ticked for you, and you get the guide whether you tick it or not.
Legal basis: taking the steps you asked for (GDPR Article 6(1)(b)). I keep your address, and a record of whether you ticked the box, for 12 months so I can help if there’s a problem with your download. After that I delete it, unless you agreed to hear from me.
My emails about books, Tuscany and reader extras
If you ticked the box, or signed up to hear about a new book, I use your email address (and your first name, if you gave it) to send you occasional emails. I also keep the date you signed up and the form you used, so I can show you gave permission.
Legal basis: your consent (Article 6(1)(a)). You can withdraw it whenever you like, using the unsubscribe link in any email or by writing to me. I keep your details until you unsubscribe, then delete them within 30 days. I keep only a note that you unsubscribed, so you don’t get added back by mistake.
Advance readers
If you apply to read a book before publication, I collect your name, email address, the format you prefer and where you usually post reviews. I use this to send you the book and to follow up about your review. Legal basis: your consent. I keep these details until 12 months after the book is published, or until you ask me to remove you, whichever comes first.
Quizzes, contact forms and emails you send me
If you fill in a quiz or a contact form, or email me directly, I keep what you send so I can reply and deal with your request. Legal basis: taking the steps you asked for, or my legitimate interest in answering messages. I keep these for up to 24 months after our last exchange.
Purchases
When you buy a digital product from this site, I collect your name, email address, billing country and postcode, and the details of your order. Stripe processes the payment. Your card details go straight to Stripe, and I never see or store them.
Legal basis: carrying out our contract (Article 6(1)(b)) and meeting my legal obligations (Article 6(1)(c)). Tax rules require me to keep sales records, usually for up to 7 years.
Comments, likes and ratings
If you leave a comment, the site stores your name, email address, the comment itself, your IP address and your browser type. The IP and browser details help catch spam. Your email address is never shown publicly. A scrambled version of it (a “hash”) may be sent to Gravatar, a service run by Automattic, to check whether you have a profile picture. The like button and star ratings may record your IP address so the same person can’t vote twice.
Legal basis: my legitimate interest in running a spam-free comment section and honest ratings. Comments stay up until you ask me to remove them.
Visitor statistics
With your permission, I use Google Analytics to see which pages people read and roughly where visitors come from. It uses cookies and collects things like your approximate location, device type and the pages you visit. I can’t identify you from it, and I don’t try to. Legal basis: your consent, given through the cookie banner. Analytics data is deleted automatically after 14 months.
Security and server records
Like any website, the server keeps short technical logs, including IP addresses, to keep the site running and fend off attacks. Legal basis: my legitimate interest in keeping the site secure. My hosting company deletes these logs on its own schedule, usually within a few weeks.
Who else handles your data
I don’t sell your data or share it with advertisers. A few companies handle it on my behalf so the site works, and each is bound by a data processing agreement:
- Hostinger hosts the website and its database.
- Titan provides my email and sends the site’s form notifications.
- Stripe processes payments.
- Google runs Google Analytics, and supplies some of the site’s fonts from its servers.
- Automattic runs Gravatar, used only when you comment.
Right now, reader emails are managed from the website itself. If I move to an email newsletter service, I’ll name it here before any of your details go to it.
Amazon links. Some links to Amazon on this site are affiliate links. If you buy something after clicking one, I earn a small commission at no cost to you. Once you’re on Amazon, Amazon’s own privacy policy and cookies apply, not mine.
If you live in Europe
This website is run from the United States, so your data is processed there, as it is by Google, Stripe and Automattic. If you live in the EU or the UK, the GDPR still protects your data when you use this site, and everything on this page applies to you. The services I use are covered by the EU-US Data Privacy Framework or by the European Commission’s Standard Contractual Clauses.
Cookies
The first time you visit, a banner asks which cookies you accept. Cookies the site needs to work, such as the one that remembers your choice, are always on. Analytics cookies are only set if you say yes. You can change your mind at any time with the cookie icon in the bottom-left corner of every page.
If you leave a comment, you can choose to save your name and email in a cookie so you don’t have to type them again. It lasts one year. Login cookies apply only to people who manage the site.
Your rights
Under the GDPR you can ask me to:
- show you the personal data I hold about you, and send you a copy
- correct anything that’s wrong
- delete your data
- stop or limit how I use it, or object to a use based on my legitimate interests
- send your data to you, or to another service, in a common file format
- withdraw your consent, which never affects anything done before you withdrew it
Email info@tuscandreamvacation.com with your request. It’s free, and I’ll reply within one month. I may ask you to confirm your identity first, so I don’t hand your data to someone else.
If you’re unhappy with how I’ve handled your data, and you live in the EU, you can complain to the data protection authority in your country. In Italy, for example, that is the Garante per la protezione dei dati personali (garanteprivacy.it). I’d appreciate the chance to put it right first.
A few more things
No automated decisions. Nothing on this site makes decisions about you by software alone.
Children. This site is written for adult travelers and readers. I don’t knowingly collect data from anyone under 16. If you think a child has sent me their details, tell me and I’ll delete them.
Security. The site uses an encrypted (HTTPS) connection. Only I can access the admin area where form entries are kept. No website is perfectly secure, but if a breach ever put your data at risk, I would tell you and the authorities as the law requires.
Other websites. Links to other sites, including booking sites, museums and Amazon, take you somewhere I don’t control. Their own privacy policies apply there.
Changes. If I change how I handle your data, I’ll update this page and the date at the top. If a change is significant and I have your email address, I’ll tell you by email.
