Terms, Early Bird, privacy

Version 1.2 · 03/11/2026

Draft to be validated by a lawyer before final publication. The Italian version prevails.

Terms of service

Service provider: Andrea Calvo · Via Filisto, 257 – 96100 Siracusa, Italy · VAT IT01735860890.

1. Subject

sulìa stays is subscription software for managing holiday homes and short lets. The customer chooses the Core PMS and add-on modules; the price is the sum of the chosen modules, per rental unit or per account, as shown in the price list accepted with the order.

2. Term and renewal

The subscription is yearly and starts on the activation date. It renews automatically for another year at the current price list, unless cancelled at least 30 days before expiry. The provider emails the customer 30 days before each renewal.

3. Prices and payments

The provider uses the Italian flat-rate scheme: transactions are without VAT under art. 1, paragraphs 54-89, Law 190/2014. Documents above € 77.47 carry a € 2 stamp duty, charged to the customer. Payment is by card via Stripe or by PayPal. The price of a paid order does not change for the purchased period. Price list changes apply from the next renewal and are announced in advance. A 4% INPS social security contribution (art. 1, par. 212, Law 662/1996) is added to every payment and shown next to prices. The assisted setup is a one-off service included in every activation and paid with the balance.

4. Balance charge

By paying the deposit, the customer authorises the provider to store the payment method with Stripe or PayPal and to charge the first-year balance to it when the service is activated. The charge is notified by email. If it fails, the customer receives a link to pay the balance another way. The customer can revoke the authorisation by writing to the provider before activation.

5. Third-party services

Not included in the fee: WhatsApp message costs charged by Meta, Stripe and PayPal fees, the SDI intermediary’s e-invoice sending cost, booking channels’ fees. Activating WhatsApp and channel API connections depends on approval by the respective providers.

6. Modules in development

Modules marked «in development» or «beta» show an estimated availability date. A module that isn’t available isn’t charged until it is activated.

7. Customer and guest data

The customer is the controller of their guests’ data; the provider acts as processor under the data processing agreement (DPA) published on this page and accepted with the order. Data is hosted in the European Union (Germany). Guests’ ID documents are used only for the police registration: the document number, stored encrypted, is deleted automatically 90 days after departure. WhatsApp conversations with guests are kept for 12 months after the last message; the Carly assistant processes texts on sulìa servers in the European Union, without sending them to external AI providers.

8. Availability and support

The provider commits to keeping the service available and fixing issues reported through support. Ordinary requests are answered within one working day, urgent ones within two hours.

9. Termination and data export

On termination the customer can export all their data in an archive. 30 days after termination data is deleted, subject to legal retention obligations for tax documents.

10. Non-payment

If a renewal or the balance isn’t paid, the provider sends two reminders 7 days apart; 15 days after the due date it may suspend access, keeping the data for 30 days.

11. Law and jurisdiction

Italian law applies. For consumer customers the court of the consumer’s residence has jurisdiction; otherwise the court of the provider’s seat.

Early Bird terms and refunds

Campaign valid from 07/01/2027 to 31/01/2027, for at most 50 customers. A spot is assigned only when the deposit payment is confirmed by Stripe or PayPal.
25% discount on the first year of subscription, applied to the chosen setup. From the second year the current price list applies.
€ 49 deposit, deducted from the first fee. The balance is paid at service activation, not before, on the payment method used for the deposit (see point 4 of the terms).
The first year starts on the activation date, not on the deposit date.
Until activation the customer can change the setup at no cost.
Full refund of the deposit within 14 days of the request if the service isn’t activated by 30/06/2027, or if the customer withdraws before activation.
The Early Bird discount can’t be combined with other promotions; the volume discount by number of units still applies.

Privacy notice

Data controller

Andrea Calvo, sole trader · Via Filisto, 257 – 96100 Siracusa, Italy · VAT IT01735860890. For any request about your data write to info@applicationweb.it.

What data we process and why

WhatDataWhy and legal basisHow long

Browsing the siteIP address, browser, pages requested, date and time, logged automatically by the server.Site security and abuse prevention (legitimate interest, art. 6.1.f GDPR).14 days.

Bot protection (Google reCAPTCHA)When you fill in the contact form, a booking request or a sign-in: IP address, browser and device data, interaction with the page and the _GRECAPTCHA cookie, collected by Google.Telling people from automated programs and protecting forms from spam and abuse (legitimate interest, art. 6.1.f). Google’s script loads only when you start filling in one of these forms.We keep only the check result in technical logs (14 days); Google keeps data under its own privacy policy.

«Request information» formName, email, number of units, town, message, IP address and the consent text accepted.Replying to your request and making you an offer (pre-contractual steps at your request, art. 6.1.b).12 months from sending, then automatic deletion, unless you become a customer.

Purchase and subscriptionName, email, phone, business name, VAT number or tax code, billing address, SDI code or PEC, chosen setup, orders and payments.Managing the order, subscription, support and invoicing (contract, art. 6.1.b; tax obligations, art. 6.1.c).For the contract term plus 30 days for export; tax documents for 10 years (art. 2220 Italian Civil Code).

Payments and saved methodCard or PayPal account data go directly to Stripe and PayPal: we only keep a reference to the method, never the card number.Collecting the deposit and, with your authorisation, the balance at activation (contract, art. 6.1.b).Until the balance is collected or the authorisation is revoked.

Customer areaEmail, sign-ins via emailed link, session.Giving you access to your subscription (contract, art. 6.1.b).For the life of the account.

Service emailsEmail address and message content (confirmations, receipts, activation and renewal notices).Communications needed for the contract (art. 6.1.b).The email provider keeps sending logs for up to 30 days.

Product updatesEmail.Only if you opt in at checkout (consent, art. 6.1.a), revocable at any time.Until you withdraw consent.

Activity logActions taken by administrators and payment confirmations, with date, author and IP address.Security and evidence of operations (legitimate interest, art. 6.1.f).5 years.

Who receives the data

Data is processed by us and by providers acting as processors or independent controllers, only as needed for the service:

IONOS SE — hosting of the site and databases · European Union (Germany)
Sinch Mailgun — sending service emails · European Union (EU region)
Stripe Payments Europe Ltd. — card payments (independent controller for card data) · Ireland; any transfers to the US under the Data Privacy Framework or standard contractual clauses
PayPal (Europe) S.à r.l. et Cie, S.C.A. — PayPal payments (independent controller) · Luxembourg; any transfers under standard contractual clauses
Meta Platforms Ireland Ltd. — only if you message us on WhatsApp (independent controller) · Ireland; any transfers under the Data Privacy Framework
Google Ireland Ltd. — bot protection of forms with reCAPTCHA (independent controller, policy at policies.google.com/privacy) · Ireland; any US transfers under the Data Privacy Framework

Where data is kept

Our servers are in the European Union (Germany). We don’t sell or share data with third parties for advertising or marketing, and we don’t use your data for profiling or automated decisions.

Your rights

You can request access, rectification, erasure, restriction, data portability and object to processing based on legitimate interest (arts. 15–22 GDPR); you can withdraw consent at any time without affecting past processing. Write to info@applicationweb.it: we reply within 30 days. You also have the right to lodge a complaint with the Italian data protection authority (www.garanteprivacy.it).

Required data

Data requested at checkout is needed to conclude the contract and invoice; without it we can’t activate the subscription. The contact form needs name and email to reply.

Minors

The service is aimed at people running accommodation and is not intended for anyone under 18.

Changes

If we change this notice we update the date at the top; for significant changes we email customers.

Data processing agreement (DPA)

Agreement between the customer (controller) and Andrea Calvo, provider of sulìa (processor), under art. 28 GDPR. It is part of the terms of service, accepted with the order, and applies for the whole subscription.

1. Subject and duration

The processor processes personal data on behalf of the controller only to provide sulìa stays (management system, booking engine, compliance, WhatsApp assistant, e-invoicing and other active modules), for the subscription term and until data is returned or deleted.

2. Data and data subjects

Data subjects: the controller’s guests and prospective guests, staff and property owners. Data: personal and contact details, booking and payment data, ID document data needed for police registration (Alloggiati Web) and ISTAT, WhatsApp conversations with guests, invoicing data. No special categories are processed, except what guests disclose spontaneously.

3. Instructions

The processor processes data only on the controller’s documented instructions, which are the use of the service’s features and the settings chosen. If an instruction appears to breach the GDPR, the processor flags it.

4. Confidentiality

Anyone accessing data on the processor’s behalf is bound by confidentiality. Administrative access to the controller’s account happens only for support and is recorded in the activity log.

5. Security

Appropriate technical and organisational measures (art. 32): encrypted connections (HTTPS), data separated per customer with automated checks against cross-customer access, connected-service credentials encrypted in the database, sign-in via temporary links, administrative activity log, daily database backups, servers in the European Union. Guests’ ID documents are deleted after submission to the police portal.

6. Sub-processors

The controller authorises the sub-processors listed below. The processor announces any new sub-processor at least 30 days in advance; the controller may object on reasonable grounds and, failing agreement, terminate without penalty.

7. Assistance

The processor helps the controller respond to data subjects’ requests, assess processing impact and meet security obligations, within the information available to it.

8. Data breaches

The processor informs the controller without undue delay, and in any case within 48 hours of becoming aware, of any personal data breach, with the information useful for any notification to the authority.

9. End of service

On termination the controller can export data for 30 days; the processor then deletes it, subject to legal retention obligations.

10. Audits

The processor makes available the information needed to demonstrate compliance with this agreement and allows reasonable audits, with at least 30 days’ notice and at the controller’s expense.

Sub-processorActivityLocation

IONOS SEhosting and databasesEuropean Union (Germany)

Sinch Mailgunemails to guests and to the controllerEuropean Union

Meta Platforms Ireland Ltd.WhatsApp Business (only with the Carly module)Ireland

Google Ireland Ltd.bot protection (reCAPTCHA) of the booking form and sign-insIreland; any transfers under the Data Privacy Framework

Openapi S.p.A.sending e-invoices to SDI (only with the module active)Italy

sulìa stays · Andrea Calvo · Via Filisto, 257 – 96100 Siracusa · P.IVA 01735860890 · applicationweb.it