Privacy

Last updated: 25 September 2026

This website is a set of static files. It sets no cookie, loads no third party resource and runs no analytics. Its only forms are the sign up and the dashboard sign in, which send what you type to our own API, as described below. The fonts are served from this domain. There is nothing to opt out of, which is why there is no banner asking you to.

Who is responsible

The data controller is MP Informatica Srl, Strada di Santa Bona Nuova 33/B, 31100 Treviso, Italy. Bookrail is a product of MP Informatica Srl. Contact: hello@bookrail.dev. The full company details are on the legal notice.

What is processed when you visit this site

One thing: the access log of the web server. Every request writes a line containing your IP address, the user agent your browser sends, the URL requested, the response status and the time. Nothing else is recorded, and nothing is combined with anything.

• Purpose: security and diagnostics. Detecting abuse, and finding out why a page is broken.
• Legal basis: legitimate interest, Article 6(1)(f) GDPR, in keeping the service available and secure.
• Retention: 14 days, then the log rotates and the lines are gone.
• Where: one server in Europe. No copy leaves it, and no processor receives it.
• Recipients: none. There is no analytics provider, no CDN, no tag manager and no advertising network.

When you sign up

The sign up form, and bookrail signup in the terminal, create an account from an email address. Nothing is created until the link we send is opened, which is what makes an address typed by mistake cost nothing.

• Purpose: creating the account, the project and the two keys you asked for, a test one and a live one.
• Legal basis: performance of a contract, Article 6(1)(b) GDPR: it is the step that brings the contract into being at your request.
• Data: the email address, a hash of the IP address the request came from, and the account name if you typed one. The address the request came from is never written down as such: the hash exists only so that two requests can be counted against the same caller, which is what keeps the endpoint from being used to send mail to strangers.
• Where the sign up came from: three short labels, none of them about you. Whether it came from the website or from the terminal. The name of the platform or campaign that sent you, if the link you followed carried one (?via= on this website, --via or BOOKRAIL_VIA in the terminal): a word such as lovable, which this website passes from page to page in the address of its links, never in a cookie or in your browser's storage. And, for the terminal only, the name of the coding assistant that ran the command, such as claude-code or cursor, which the command recognises from a setting that assistant publicly documents; it looks at those settings only, and sends only the name. The three labels are kept with the request and then with the account, for as long as the account exists. We use them to count which channels bring customers, on the basis of our legitimate interest, Article 6(1)(f) GDPR: they say nothing about who you are.
• Retention: a request that is never confirmed is deleted after 7 days, hash included. Once an account exists, the address is kept as the owner of that account, for as long as the account exists.
• Recipients: Hostinger, which runs the mailbox that delivers the confirmation message, inside the European Union. Nobody else. The message is sent from an address that is not read, and it says so.
• Internal notice: once a day, an automatic summary of what happened on the service is sent to our own mailbox at hello@bookrail.dev, on the same mail system as above. It lists the accounts created, every sign up of the last day and the keys that were used, plus per project request counts. It is how one person running a service finds out that somebody is using it. An email address appears only for an account that exists and for a sign up that was completed. A sign up that was never completed appears without its address: only the time, the status, whether it came from the website or the terminal, and the account and project names that were typed into the form. It also counts the completed sign ups by where they came from, as numbers only. Nobody outside the company receives this message.
• Deleting the account: write to hello@bookrail.dev. There is no command for it yet, and saying so is better than a page that pretends there is.

The confirmation link carries a token in the part of the URL after the #, which a browser never sends to a server: it is not in the log of this website, and it is not passed on to anywhere else.

When you use the dashboard

The dashboard has no password: you sign in with a link we send to the owner address of the account.

• Purpose: letting the owner of an account see its plan and usage and manage its API keys.
• Legal basis: performance of a contract, Article 6(1)(b) GDPR.
• Data: the email address you type, a hash of the IP address the request came from, and, once you open the link, a session. Every request for a link is recorded the same way whether or not the address has an account, so that the answer never says which addresses are customers; a message is sent only to the owner address of an account.
• Retention: a request for a link, address and hash included, is deleted by an hourly job once it is an hour old, so it is kept for about two hours at most. A link works once, for 15 minutes. A session lasts 12 hours, is never renewed, and ends at once when you sign out; its record is deleted 7 days after it ended.
• In your browser: the session is kept in sessionStorage of this site, for as long as the tab is open. A browser may bring it back if you reopen a closed tab or restore a session after a restart; either way it stops working 12 hours after you opened the link, and «Sign out» ends it at once. No cookie is set, and nothing is kept in localStorage. The link carries its token after the #, which a browser never sends to a server, and the page removes it from the address bar as soon as it has read it.
• Recipients: Hostinger, for the message with the link, as above. Nobody else.

When you buy a paid plan

Pro and Scale are sold to businesses through Stripe Checkout, and paid by card on Stripe's pages: the card never reaches Bookrail.

• Purpose: selling and invoicing the plan, and meeting the accounting and tax obligations of an Italian company.
• Legal basis: performance of a contract, Article 6(1)(b) GDPR, and legal obligation, Article 6(1)(c) GDPR, for the invoices.
• Data: the name of the business, its billing address, its VAT number or tax id and the result of Stripe's check of it, the SdI code or PEC address of an Italian company if you give one, the billing email, and, for each paid invoice, its number, date, lines and amounts. We also record when the account accepted the Terms of Service and the Data Processing Agreement, which versions, the address of the account's owner at that moment, and a hash of the IP address.
• Retention: invoices and the data on them are kept for ten years, as Italian law requires of accounting records; the record of an acceptance for as long as the account exists and, after that, for as long as a claim under the terms could be made.
• Recipients: Stripe Payments Europe, Ltd., which processes the payment and the subscription; the accounting software the electronic invoice is issued from, and the Italian tax authority's exchange system (SdI) it goes through; Hostinger, for the messages.

If you write to us

Mail sent to hello@bookrail.dev is processed for the purpose of answering it, on the basis of Article 6(1)(b) or 6(1)(f) GDPR depending on whether the exchange is about a contract. It is kept as long as the conversation is useful and then deleted. It is not used for marketing, and there is no mailing list.

When you use the API

This is the part that grows. When you build on the Bookrail API, data about your customers, a name, an email address, a booking, passes through the API and is stored in the project you own. In that relationship you are the controller and Bookrail is the processor: we process that data on your instructions, for the purpose of running your bookings, and for nothing else.

Today the API is in early access and there is no signed agreement in place. The terms of service and the data processing agreement that complete this section are being written and will be published here and linked from this page. Until they exist, do not put personal data you cannot afford to lose into a test project.

Your rights

Under Articles 15 to 22 GDPR you may ask for access to your personal data, its correction or erasure, a restriction of processing, portability, and you may object to processing based on legitimate interest. Write to hello@bookrail.dev. In practice, for a visit to this website, the only data that exists is a log line that is deleted within 14 days, and finding it requires the IP address and the approximate time of the visit.

You may also lodge a complaint with the Italian supervisory authority, the Garante per la protezione dei dati personali, Piazza Venezia 11, 00187 Roma.

Changes

If this notice changes, the date at the top changes with it. There is no version of this page that says one thing and does another: what the server does is what is written above.