Last updated: 30/09/2026
This notice explains how guest data is processed for check-in at the accommodation that invited you through Pronto Host.
The guest-data controller is the accommodation operator who invited you to check in. Contact them using the details in your booking or invitation. The operator must provide their full identity and contact details. Pronto Host processes this data on the operator's behalf as a processor under Article 28 GDPR. The service provider is MYLAE DIGITAL DI DAVIDE MERENDA, Piazzale Europa n. 2, int. 1 — 98057 Milazzo (ME), Italia; C.F. MRNDVD91D18F158T — P.IVA 03878780836; hello@pronto-host.com.
Data is used to identify guests and make the mandatory report to the public-security authority through Alloggiati Web (Article 109 of Italy's TULPS). The legal basis is the operator's legal obligation, Article 6(1)(c) GDPR. Consent is not requested for this report; acknowledging this notice is not consent. Without the required data, the operator cannot complete the legal requirements for accommodation. Contact them if you need another collection method.
We process first and last name, sex, date and place of birth, citizenship, stay dates, family or group composition and, when required for the guest category, document type, number and place of issue. Booking references may also be included. When you upload a document, its image or PDF and extracted fields are processed temporarily. Uploading a document for every family or group member is not necessary where the law does not require their document details.
Host accounts are for adults. Check-in may include child guests whose data is supplied by a family member or accompanying adult for applicable registration obligations; it is not used for marketing.
Automatic document reading suggests fields for you and the operator to review and correct before submission. It does not decide admission on its own. The reading flow may use Gemini through Google Vertex AI's EU regional endpoint; other reading services, such as Google Document AI, operate only if configured. Copies help prepare the report and are not used to build a document archive.
The operator and authorized personnel can access the data, which is reported to the public-security authority. Technical providers involved are Google Cloud Storage for temporary uploads in a private bucket and Google Vertex AI for configured reading, Convex for the database, backend and receipt archive, and Vercel for the application. Subprocessors and their activities are described in the data processing agreement attached to the Terms.
The EU reading endpoint does not mean that every operation by all providers takes place in the EU. Any transfer outside the EEA must comply with Chapter V GDPR, using an adequacy decision or other applicable safeguards. Ask the operator for information and a copy of the safeguards, or contact hello@pronto-host.com for assistance.
Following Alloggiati Web's confirmation of acceptance, Pronto Host automatically starts deleting accepted guests' uploaded documents, OCR readings and transmitted personal data. For partial submissions, deletion covers explicitly accepted guests; rejected data or data with an uncertain result remains temporarily available to resolve the result, for at most 7 days after the attempt. We do not retain an archive of transmitted named guest records. The official receipt and technical metadata needed to identify it are retained for 5 years after submission, without adding document copies or named guest lists.
Drafts and unsubmitted check-ins expire two days after the arrival date, counted from 00:00 UTC, or 7 days after creation when no arrival date is set. Automatic jobs perform deletion and retry technical failures. The operator can delete data earlier when it is no longer needed. Account deletion also removes the receipt archive: the operator must download and retain receipts beforehand. These rules apply to data managed by the service; the authorities apply their own retention periods.
You may ask the operator for access, correction, erasure or restriction as applicable; objection and portability apply where their conditions are met. Erasure does not remove the operator's legal obligations. Pronto Host assists them; email hello@pronto-host.com for help reaching the controller. You may complain to Italy's Garante or the competent supervisory authority.