Weloa
Crea il tuo Welcome Book

Privacy Policy

1. Who processes your data

The data controller is Nexora Venture Studio S.r.l., with registered office at Piazza della Repubblica 19, 20124 Milan, Italy, VAT number IT14789390961.

For any question about this policy or to exercise your rights, you can write to us at .

We have not appointed a Data Protection Officer, because the law does not require one for the kind of processing we carry out.

2. Who this policy is for

Hosts. It concerns anyone who creates a Weloa account and uses the service to publish one or more Welcome Books. Weloa is designed for people who host as a business or activity: you must be at least 18 years old to open an account.

Guest data that you enter. When a host enters into Weloa the data of a person they are hosting (name, email address, language, dates of stay, any notes), the controller of that data is the host. Weloa processes it only on the host's behalf and according to the host's instructions, as a processor under Article 28 of Regulation (EU) 2016/679. The rules of this relationship are set out in the Data Processing Agreement attached to the Terms of Service. The duty to inform the guest remains with the host.

Guests, for one part only. To protect access to Welcome Books, Weloa processes on its own account, as controller, some technical data of anyone who opens a Welcome Book: the IP address of PIN attempts, the session opened after the PIN, and the data stored in the browser described in section 5. If you are a guest, sections 3.4, 4, 5, 6, 9 and 11 of this page apply to that data.

3. What data we process

3.1 Data you give us when you sign up

To open an account we ask for your email address, a password and the language in which you want to use the service. We do not ask for your first name, surname, company or phone number.

Your password is never stored in plain text: our authentication provider only keeps an encrypted, non-reversible version of it.

When you sign up, we also record when you accepted the Terms of Service and which version, so that we can prove it.

3.2 Data you enter while using the service

Everything you write or upload in your Welcome Books: texts, photos, documents, linked videos, the name and address of the property, its geographic coordinates and the place identifier on Google Maps, the contact email, phone number and website you choose to show, the welcome message, the logo and the colours.

Some of this content is public by nature: the logo and cover image of a Welcome Book can be reached by anyone who knows their address, because they must be shown to the guest before the PIN.

When you type the property address, the text you write is sent to our servers and from there to Google's address search service, which returns suggestions to us. Your browser never contacts Google directly.

3.3 Your guests' data

Name, email address, language, dates of stay, any private notes you write, and the access PIN, which we store protected and encrypted. We process this data on your behalf, as stated in section 2.

If you create an access with no expiry (a fixed PIN to leave at the property), no guest is linked to it: we process neither a name nor an email.

3.4 Technical data

Server logs. Every request to the site leaves a trace with our hosting provider: IP address, browser type, requested page, date and time.

Attempts to access a Welcome Book. Each time someone enters a PIN we record the IP address it comes from, together with the outcome and the time. This serves to stop repeated attempts.

Guest session. After the PIN we open a session, so the guest does not have to enter it again on every page. For the session we keep the opening date, the expiry and the last time the page was viewed, updated at most once a minute.

3.5 Payment data

Subscription payments are handled by Paddle, which acts as reseller (Merchant of Record): Paddle sells you the subscription, collects the payment, calculates taxes and issues the invoice. You enter your card details and billing details directly in Paddle's window, and Paddle processes them as an independent controller under its own privacy policy.

Weloa does not see, receive or store your card details. From Paddle we only receive a customer and subscription identifier, and the status of the subscription (active, cancelled, expired).

3.6 Emails we send you

We only write to you about the service: email address confirmation, password recovery, security notices about your account, welcome, subscription expiry and renewal notices, notices before your account is closed. We do not send newsletters or advertising. For subscription notices we keep a log (type of notice, date, delivery outcome) that does not contain your email address.

4. Why we process your data

Why
To let you use the service: creating the account, publishing Welcome Books, sending invitations to guests, managing the subscription
Legal basis
Performance of the contract
Why
To send you the service emails listed in section 3.6
Legal basis
Performance of the contract
Why
To protect the service from abusive access and repeated PIN attempts, and to keep the guest session open
Legal basis
Our legitimate interest in security
Why
To provide support, including by entering your account as described in section 8
Legal basis
Performance of the contract and our legitimate interest in solving problems
Why
To keep proof that you accepted the Terms of Service
Legal basis
Our legitimate interest in proving the contract
Why
To meet tax obligations and requests from authorities
Legal basis
Legal obligation
Why
To reply when you write to us
Legal basis
Performance of the contract or our legitimate interest

We do not carry out profiling, we do not take automated decisions about you and we do not use your data for advertising. We do not sell your data to anyone.

6. Videos

If a Welcome Book contains a YouTube video, the preview image is served by our servers: until you press play, your browser contacts neither Google nor YouTube.

When you press play, the video is loaded from YouTube in the version that does not set tracking cookies. From that moment YouTube (Google) processes data as an independent controller, and its privacy policy applies.

7. Who we share data with

We do not pass data to third parties for their own purposes. We do, however, rely on providers who process data on our behalf, appointed as processors.

Provider
Supabase
What it does
Database, authentication and file storage
Where it processes data
European Union (Frankfurt)
Provider
Vercel
What it does
Website hosting
Where it processes data
United States
Provider
Resend
What it does
Sending emails to guests and to you
Where it processes data
United States
Provider
OpenAI
What it does
Automatic translation of content
Where it processes data
United States
Provider
Google
What it does
Address search while you type
Where it processes data
United States

Some of these providers process data outside the European Union. The transfer is based on the EU-US Data Privacy Framework, for providers that participate in it, or on the standard contractual clauses approved by the European Commission.

To the automatic translation service we send only the Welcome Book texts you wrote, any instructions you give for the translation and the target language. We never send your guests' name, email or PIN, and we ask the provider not to store the texts.

Besides them, two parties process data as independent controllers, under their own privacy policies: Paddle, for payment (section 3.5), and YouTube, only when play is pressed on a video (section 6).

We may also disclose data to judicial or other authorities when the law requires it.

8. Support access to your account

To provide support or solve a technical problem, an authorised member of our support team may enter your account and see what you see. We do this only when needed, and under fixed rules:

  • access lasts at most 60 minutes and then closes by itself;
  • during access it is not possible to make payments or cancellations, change email, password or language, delete Welcome Books or the account, revoke guest accesses or send emails to your guests;
  • every access leaves a trace: who entered, when, for how long and how it ended.

9. How long we keep data

Data
Account and Welcome Book content
Retention
As long as you keep the account; if the account is deactivated for non-payment, see section 10
Data
Guest data you entered
Retention
Until you delete it, or until the account is deleted
Data
IP addresses of PIN attempts
Retention
30 days
Data
Guest session
Retention
Expires at check-out or after 30 days; its record is deleted together with the access it belongs to
Data
Log of emails sent to guests
Retention
As long as the guest access it refers to exists
Data
Log of notices to the host
Retention
As long as the account exists
Data
Proof of acceptance of the Terms
Retention
As long as the account exists
Data
Record of support accesses and log of account deletions
Retention
2 years — they contain neither emails nor content
Data
Tax documents
Retention
Kept by Paddle, which issues them, for the time required by law
Data
Server logs
Retention
According to our hosting provider's retention periods

10. If your subscription expires or you close your account

If your subscription expires. The account is blocked: you can still sign in and see your content, but not change it, and your Welcome Books are no longer visible to guests. If you do not renew, 90 days after expiry the account is deactivated: you can no longer sign in. Before that day we send you up to five email notices. Your data is then deleted within 30 days of deactivation. Until then you can still reactivate the account by paying: write to us at support@weloa.app.

If you close your account yourself. You can delete your account at any time from your profile page. Deletion is irreversible and removes your Welcome Books, sections, content, uploaded files, guest accesses and translations.

In both cases, for the sake of accuracy, some things do not disappear:

  • emails already sent to you and to your guests, which are in the recipients' inboxes;
  • the technical logs of our hosting provider, which follow its retention periods;
  • payment data and invoices held by Paddle, which keeps them as required by law;
  • the records listed in section 9, which contain neither your email nor your content;
  • any files left in the public storage that the system failed to remove. They can only be reached by someone who knows their exact address; if you notice any, write to us and we will remove them manually.

11. Your rights

You can ask us at any time to access your data, correct it, delete it, restrict its processing, receive it in a readable format to take it elsewhere, and object to processing based on our legitimate interest.

If you are a guest and your request concerns the data the host entered about you, contact the host: they are the controller. We will help them respond to you.

We reply within one month. If you believe the processing breaches the law, you can lodge a complaint with the Italian Data Protection Authority (Garante per la protezione dei dati personali, www.garanteprivacy.it) or with the authority of the country where you live or work.

12. Changes

If we change this policy substantially we will tell you by email or within the service before the changes take effect. At the bottom of the page you will always find the date of the last update.

For the rules of the service, see the Terms of Service.

Last updated: September 23, 2026