Privacy Policy

The controller for processing related to the platform, accounts and marketplace is Prennot, which can be contacted at hello@maukastudio.com. This notice covers prennot.com and the Account, Hub, Admin and API service subdomains.

Businesses published in the marketplace remain independent controllers for processing carried out for their own purposes, for example when receiving an enquiry, managing an appointment or entering into a sale or rental. Prennot provides them with the data needed to answer the request and processes their organisation’s data under the service agreement.

Fields marked as required are needed to create an account, use a feature or fulfil an enquiry. Not providing them only prevents the relevant operation. Optional data may be omitted. Consent to non-essential cookies is never a condition of access to the service.

Data is available to authorised personnel and, where necessary, to providers acting as processors or independent controllers: hosting and databases, media storage, email, security and maintenance, payments, electronic invoicing and translation. Depending on enabled features, this may include Stripe, PayPal, Fatture in Cloud, Fatturazione CGN, Aruba Electronic Invoicing, an S3-compatible service and LibreTranslate.

If you choose ‘Continue with Google’, your browser is redirected to Google with the client identifier, return URL, minimum requested scopes and a temporary security value. Google returns the identity data you authorise. Google processes data collected on its systems as an independent controller under its own privacy policy; Prennot does not request access to Gmail, Drive, Contacts or Calendar.

When you send an enquiry, the data entered in the form is disclosed to the selected business. Content a business elects to publish is visible to marketplace users or on its public website. Data may also be disclosed to authorities or advisers where required by law or necessary to protect a legal right.

Some providers, including Google when the user chooses Google sign-in, may process data in countries outside the European Economic Area. In that case the transfer relies on an adequacy decision, European Commission standard contractual clauses and, where necessary, supplementary measures. Google describes its safeguards in its privacy policy; you may request information about the safeguard applied by Prennot from the privacy contact.

Data is kept for as long as needed for the purpose for which it was collected. Accounts and content remain available while the relationship is active and for the later period required to manage deletion, disputes and backups. The Google link, scopes and technical tokens remain associated with the account until the link or account is removed, although a token may expire or be revoked sooner; temporary OAuth transaction data expires within 10 minutes. Contractual, accounting and tax data is retained for statutory periods; security logs and enquiry data for a period proportionate to abuse prevention and relationship management. When the period ends, data is deleted or anonymised unless litigation or a further legal duty requires retention.

Technical and organisational measures proportionate to risk are used, including access and role controls, tenant data isolation, encryption of secrets and stored OAuth access or refresh tokens, HttpOnly session cookies that are Secure in production, CSRF and origin checks, logging that excludes sensitive values, backups and incident-handling procedures. No system can guarantee zero risk.

You may request access, correction, erasure, restriction, portability, objection to processing based on legitimate interests and withdrawal of consent without affecting prior lawfulness. You may also complain to the Italian Data Protection Authority or the authority in your Member State.

To exercise your rights, email hello@maukastudio.com. We may request reasonable information to verify identity. If a request concerns only a marketplace business, we will forward it or identify the relevant controller.

You can revoke Prennot’s authorisation in your Google Account settings. Revocation prevents later use of Google to sign in but does not automatically delete the Prennot account; contact the privacy address to remove the link or the account.

The service is not intended for anyone under 18 and does not make decisions based solely on automated processing that produce legal or similarly significant effects. Search and ordering systems only present content and do not determine access to rights or essential services.

This notice may be updated for legal, organisational or technical changes. Material changes will be highlighted and fresh consent will be requested where required.