PRIVACY POLICY ON THE PROCESSING OF PERSONAL DATA

pursuant to Articles 13 and 14 of Regulation (EU) 2016/679 (“GDPR”) and Legislative Decree 196/2003, as amended by Legislative Decree 101/2018

Website: www.dimoredeimarinai.it
Last update: May 4, 2026

1. DATA CONTROLLER

The Data Controller of the personal data collected through the website www.dimoredeimarinai.it is:

Dimore dei Marinai
Company Name: Dimore dei Marinai di Pasquale Maria Lanzone
Registered Office: via Giudicato vecchio, 9
VAT / Tax Code: IT01797500707
Email: dimoredeimarinaitermoli@gmail.com

For any communication related to the processing of personal data, the data subject may contact the Data Controller at the email or PEC address indicated above.

As of the date of this update of the privacy policy, the Data Controller has not appointed a Data Protection Officer (DPO), as the conditions for mandatory appointment under Article 37 GDPR do not occur. Should such an obligation arise, the contact details of the DPO will be published in this section.

2. TYPES OF DATA COLLECTED, PURPOSES, AND LEGAL BASES

2.1 Browsing Data and Internal Technical Logs

During normal navigation of the website, the system may automatically record certain technical data necessary for its functioning, security, and aggregated traffic analysis.

The data processed through the internal visit log system are:

Purpose: aggregated statistical analysis of traffic, cybersecurity, prevention of abuse, monitoring the proper functioning of the website.

Legal Basis: legitimate interest of the Data Controller pursuant to Article 6, paragraph 1, letter f) GDPR, in compliance with the principle of data minimization.

Retention Period: 90 days. Upon expiration, the data are automatically deleted through the periodic deletion system provided by the website.

2.2 Contact Form

Through the contact form available on the website, the user can voluntarily send a request for information to the Data Controller.

The collected data are:

The data are stored in the internal table dedicated to the website messages and are also sent to the email address info@dimoredeimarinai.it to enable the Data Controller to respond to the request.

The system uses an internal anti-spam control based on a random numeric code. No external anti-spam services such as Google reCAPTCHA are used unless otherwise specified in the policy.

Purpose: receiving and managing information requests sent by the user.

Legal Basis: execution of pre-contractual measures adopted at the request of the data subject pursuant to Article 6, paragraph 1, letter b) GDPR and/or legitimate interest of the Data Controller to respond to the requests received pursuant to Article 6, paragraph 1, letter f) GDPR.

Retention Period: 24 months from the receipt of the message, unless further retention is necessary for legal obligations, protection of the Data Controller's rights, or management of any disputes.

The provision of data is optional, but failure to provide makes it impossible to send the request and receive a response.

In the contact form, the user is invited to review this privacy policy before submission. The respective checkbox serves to acknowledge the information and does not constitute consent for marketing purposes.

2.3 Booking Form

Through the booking form, the user can send a request regarding availability or reservation of a stay at the facility.

The collected data are:

The data are stored in the internal table dedicated to bookings and are also sent to the email address info@dimoredeimarinai.it to manage the request.

Purpose: managing the booking request, checking availability, pre and post-stay communications, fulfilling contractual, administrative, tax, and accounting obligations related to the stay.

Legal Basis: execution of pre-contractual measures adopted at the request of the data subject and/or execution of a contract to which the data subject is a party, pursuant to Article 6, paragraph 1, letter b) GDPR. For any tax, accounting, or regulatory obligations, the legal basis is compliance with legal obligations pursuant to Article 6, paragraph 1, letter c) GDPR.

Retention Period: 36 months from the receipt of the request, unless further retention is necessary for tax, accounting, regulatory obligations, or protection of the Data Controller's rights.

The provision of data is necessary to manage the booking request. Failure to provide makes it impossible to process the request.

The user is invited not to enter sensitive data or unnecessary information for managing the request in the "message" field.

2.4 AI Chatbot with OpenRouter and ZDR Model

The website offers users a virtual assistant based on artificial intelligence, aimed at providing information about the facility, rooms, services offered, and site content.

The chatbot uses OpenRouter as a routing and access service to the AI model. The Data Controller configures the service using a ZDR Model/Provider, Zero Data Retention, where available, to minimize data retention by the AI provider.

The use of the chatbot is optional. Before use, users are informed that the messages typed may be transmitted to OpenRouter and the AI provider selected through OpenRouter to generate an automated response.

The data processed within the chatbot are:

Purpose: to provide automated assistance to users and respond to inquiries about the facility, rooms, and services provided.

Legal Basis: consent of the data subject pursuant to Article 6, paragraph 1, letter a) GDPR, expressed through a positive action before using the chatbot and/or through the cookie preference management panel, where the chatbot uses technologies not strictly necessary.

Retention Period: technical usage logs, devoid of the textual content of conversations, are retained for 12 months.

Important Notice: users are invited not to enter sensitive data, health data, personal documents, tax codes, payment data, confidential information, or unnecessary personal data in the chatbot. Even if the chatbot is configured with a ZDR model/provider, the messages typed are still transmitted to an external AI service to generate the response.

The chatbot does not engage in automated decision-making processes that produce legal effects or similarly significantly affect the user.

2.5 Newsletter

The site does not currently have an active newsletter system and does not send periodic promotional communications via newsletter.

There is no public signup form for the newsletter, and email addresses collected through the contact or booking forms are not used for marketing or newsletter purposes without separate specific consent.

If a newsletter is activated in the future, this privacy policy will be updated to include registration methods, purposes, legal basis, retention period, unsubscription methods, and consent management.

3. COOKIES AND TRACKING TECHNOLOGIES

For detailed information on the cookies and tracking technologies used by the site, please refer to the Cookie Policy available at:

www.dimoredeimarinai.it/cookie.php

As of the date of this update, the site does not use Google Analytics, Google Tag Manager, or Meta/Facebook Pixel.

In summary, the site may use the following categories of cookies and tools:

Any unnecessary third-party scripts or content are pre-blocked and are activated only after the user expresses consent through the cookie banner or the preference management panel.

The preferences expressed by users are retained for at least 6 months, unless there are significant changes to the treatments, technical impossibility to recognize the previous choice, or deletion of cookies by the user.

Users can modify or revoke consent at any time via the link “Manage Cookie Preferences” present in the footer of the site.

4. DATA RECIPIENTS

The personal data collected through the website may be communicated or made accessible, within the limits of the purposes indicated in this policy, to the following categories of recipients:

Internal or Authorized Entities

• authorized personnel of the accommodation facility, for managing contact requests, bookings, and communication with users;
• subjects operating under the authority of the Data Controller, where present and duly authorized.

Technical Suppliers and Third-Party Services

The data may also be processed by technical suppliers providing services necessary for the functioning of the site or optional services activated with the consent of the user. Such subjects operate, where provided, as Data Processors pursuant to Article 28 GDPR or as independent Data Controllers, according to the role actually played.

Among the potentially used technical and third-party services are:

The site does not use, at the date of this privacy policy, Google Analytics, Google Tag Manager, Meta/Facebook Pixel, or active newsletter systems.

The data are not sold to third parties or transferred for purposes other than those indicated in this privacy policy.

5. TRANSFERS OF DATA TO THIRD COUNTRIES

Some third-party services used by the site may involve the transfer of personal data to countries not belonging to the European Economic Area.

The Data Controller is committed to ensuring that such transfers occur in compliance with Articles 44 and following of the GDPR, through adequate safeguards such as adequacy decisions, Standard Contractual Clauses approved by the European Commission, Data Processing Agreements, supplementary technical measures, or other bases provided for by applicable law.

The use of the AI chatbot involves the transmission of messages typed by the user to OpenRouter and the configured AI provider. The Data Controller uses a ZDR model/provider, where available, and adopts minimization measures. The user is nevertheless encouraged not to enter unnecessary personal data or special categories of personal data in the chatbot.

6. RETENTION PERIOD

Personal data are retained for the time strictly necessary for the purposes for which they were collected, in compliance with the principles of minimization and limitation of retention.

Upon expiration of the retention periods, the data are deleted or irreversibly anonymized, unless legal obligations or the need to protect the Data Controller's rights arise.

7. SECURITY MEASURES

The Data Controller adopts appropriate technical and organizational measures to ensure a level of security commensurate with the risk, pursuant to Article 32 GDPR.

The measures adopted include, where technically implemented:

• forced HTTPS connection across the entire site;
• active SSL/TLS certificate;
• redirect from HTTP to HTTPS;
• session cookies configured with security flags such as HttpOnly, Secure, and SameSite=Lax, where compatible;
• periodic regeneration of Session ID to reduce the risk of session fixation;
• validation and sanitization of user inputs;
• protection against Email Header Injection in forms;
• using prepared statements via PDO to reduce the risk of SQL Injection;
• admin panel protected by authentication and, where active, by two-factor authentication;
• MariaDB/MySQL database hosted in an environment not directly exposed to the public network;
• minimization of collected data;
• anonymization of the IP address in internal logs;
• configuration of the chatbot with ZDR model/provider via OpenRouter, where available;
• non-storage of the textual content of chatbot conversations in the website database;
• periodic deletion of data upon expiration of retention periods.

Users are invited not to transmit unnecessary data through forms or the chatbot, sensitive data, health data, personal documents, credentials, payment data, or confidential information.

8. RIGHTS OF THE DATA SUBJECT

Pursuant to Articles 15-22 GDPR, the data subject may exercise the following rights:

• Right of Access: to obtain confirmation as to whether or not personal data concerning them are being processed and to receive information related to the processing.
• Right to Rectification: to obtain the rectification of inaccurate personal data and the completion of incomplete data.
• Right to Deletion: to obtain the deletion of personal data in the cases provided for by law.
• Right to Restrict Processing: to obtain the restriction of processing in the cases provided for by the GDPR.
• Right to Data Portability: to receive in a structured, commonly used, and machine-readable format the personal data provided to the Data Controller, in the cases provided for by Article 20 GDPR.
• Right to Object: to object to processing based on the legitimate interest of the Data Controller, for reasons related to their particular situation.
• Right to Withdraw Consent: to withdraw consent granted at any time, without affecting the lawfulness of processing based on consent before withdrawal.

Consent to cookies and optional tools may be modified or revoked at any time via the link “Manage Cookie Preferences” present in the footer of the site.

How to exercise rights

Requests can be sent:

• via email to: info@dimoredeimarinai.it
• via PEC to: [INSERT PEC ADDRESS]

The Data Controller will respond without undue delay and, in any case, within one month of receiving the request. This period may be extended by two months in the event of particular complexity or a high number of requests, with prior notification to the data subject.

9. RIGHT TO LODGE A COMPLAINT

The data subject who believes that the processing of their personal data is carried out in violation of current regulations has the right to lodge a complaint with the Italian Data Protection Authority.

Italian Data Protection Authority
Piazza Venezia, 11
00187 Rome
Website: www.garanteprivacy.it
Email: garante@gpdp.it
PEC: protocollo@pec.gpdp.it

The data subject may also lodge a complaint with the control authority of the EU member state in which they reside or work habitually, or of the place where the alleged violation occurred.

10. NATURE OF DATA PROVISION

11. AUTOMATED DECISION-MAKING PROCESSES

The site uses an AI-based chatbot via OpenRouter and a ZDR-configured model/provider to provide informational assistance to users.

The chatbot:

• does not adopt automated decisions that produce legal effects concerning the user;
• does not significantly affect the person;
• does not replace direct contact with the facility;
• provides automatic responses based on the website's content, a predefined knowledge base, and the configured AI model;
• may make errors or generate outdated responses; therefore, relevant information, especially availability, prices, terms of stay, and bookings, must always be confirmed directly by the facility.

Messages from the user are sent to OpenRouter and the configured AI provider to generate the response. The Data Controller uses a ZDR model/provider, where available, and adopts settings oriented towards minimization, limitation of retention, and reduction of data use for further purposes.

12. CHANGES TO THIS PRIVACY POLICY

The Data Controller reserves the right to modify or update this privacy policy at any time, particularly in case of regulatory changes, technical updates to the site, introduction of new services, or changes to the suppliers used.

Substantial changes will be communicated through an announcement on the site. The date of the last update is indicated at the beginning of the document.

Users are encouraged to periodically consult this page.

APPENDIX — LINKS TO THIRD-PARTY SERVICE POLICIES

To view the privacy policies of third-party services potentially used by the site:

This policy is drafted pursuant to Articles 13 and 14 of Regulation (EU) 2016/679, GDPR, and Legislative Decree 196/2003, as amended by Legislative Decree 101/2018.

Last update: May 4, 2026

TERMS AND CONDITIONS OF USE OF THE SITE

Website: www.dimoredeimarinai.it
Last updated: May 4, 2026

1. INFORMATION ABOUT THE WEBSITE OWNER

The site www.dimoredeimarinai.it is managed by:

Dimore dei Marinai
Company name: Dimore dei Marinai di Pasquale Maria Lanzone
Registered office: via Giudicato vecchio, 9
VAT / Tax Code: IT01797500707
Email: dimoredeimarinaitermoli@gmail.com

In this document, the above-mentioned entity is also referred to as “Owner,” “Manager,” “Structure,” or “Dimore dei Marinai.”

2. SUBJECT OF THE TERMS

These Terms and Conditions govern access to and use of the site www.dimoredeimarinai.it, its contents, contact and reservation forms, AI chatbot, and any informational services available online.

Access to and use of the site imply acceptance of these Terms, within the limits applicable to browsing and the use of available features.

If the user does not wish to accept these Terms, they are invited not to use the site and its related online services.

These Terms do not replace any specific conditions for stay, booking, payment, cancellation, or ancillary services communicated directly by the Structure during the request, confirmation, or contract phase.

3. NATURE OF THE SITE

The site is intended for informational and promotional purposes related to the accommodation facility Dimore dei Marinai, its lodgings, services offered, the surrounding area, contact methods, and any requests for availability or reservation.

The information published on the site is provided for general purposes and may concern, by way of example:

• description of the facility;

• rooms or available lodgings;

• services offered;

• images and photographic content;

• tourist information;

• contact details;

• information request form;

• reservation request form;

• informational chatbot based on artificial intelligence;

• any maps, videos, virtual tours, or external content.

The Owner commits to keeping the information as up-to-date as possible but does not guarantee that every content is always complete, error-free, or updated in real-time.

4. CONTACT FORM

The site provides a contact form through which the user can send information requests to the Structure.

The user agrees to provide correct, updated, and relevant data for the request sent.

The submission of the contact form does not automatically result in the conclusion of a contract or an obligation for the Structure to provide a service, unless otherwise agreed upon between the parties.

The Structure will respond to requests received in accordance with its internal organizational timing.

The user is invited not to include sensitive data, health data, payment data, credentials, personal documents, or confidential information not necessary for the request in the message.

The processing of personal data sent through the contact form is governed by the site's Privacy Policy.

5. RESERVATION FORM AND AVAILABILITY REQUESTS

The site may provide a form to send requests for availability or reservations related to the Structure.

Unless expressly indicated otherwise, the submission of the reservation form constitutes a request for availability or reservation and does not automatically imply the final confirmation of the stay.

The reservation is considered confirmed only following an explicit communication from the Structure, sent via email, phone, message, or other channels agreed upon with the user.

Any specific conditions relating to:

• actual availability;

• prices;

• deposits or advance payments;

• payment methods;

• check-in and check-out times;

• cancellation conditions;

• rules of the facility;

• included or excluded services;

• tourist tax, where applicable;

• documentary obligations of guests;

will be communicated by the Structure during the response, quote, confirmation, or management of the reservation.

The user is responsible for the accuracy of the data entered, including name, surname, email, phone, stay dates, number of guests, and any notes.

The Structure is not responsible for missed contacts or confirmations due to the entry of incorrect or incomplete data by the user.

6. PRICES, AVAILABILITY, AND STAY INFORMATION

The information present on the site concerning prices, rooms, availability, offers, images, services, and stay conditions is for informational purposes and may be subject to updates, seasonal changes, material errors, or organizational modifications.

Any prices or availability indicated on the site do not constitute a binding offer, unless expressly confirmed in writing by the Structure.

In case of discrepancies between the information present on the site and the direct communication sent by the Structure to the user during the confirmation phase, the conditions confirmed directly by the Structure shall prevail, unless mandatory rights recognized by applicable law provide otherwise.

The images present on the site are for descriptive and representative purposes. The Structure commits to presenting its environments accurately, but elements such as furnishings, layout, lighting, amenities, or aesthetic details may vary over time.

7. AI CHATBOT

The site may provide an AI-based chatbot designed to provide informational assistance to users.

The chatbot uses OpenRouter as a service for access and routing to a configured AI model/provider in ZDR — Zero Data Retention mode, where available.

The chatbot has exclusively informational and navigation support purposes. The responses generated do not constitute:

• a contractual proposal;

• booking confirmation;

• a binding quote;

• guarantee of availability;

• official communication from the Structure;

• legal, tax, health, or professional advice.

Relevant information regarding availability, prices, stay conditions, bookings, cancellations, and services must always be confirmed directly by the Structure through official contact channels.

The chatbot may generate incomplete, inaccurate, outdated, or not perfectly aligned responses to the actual situation. The user is encouraged to always verify important information before making decisions.

The user agrees not to input into the chatbot:

• sensitive data;

• health data;

• personal documents;

• tax codes;

• payment data;

• credentials;

• confidential information;

• offensive, illegal, discriminatory content or content contrary to the law.

The textual content of conversations is not saved in the site's database. Technical logs devoid of the text of conversations, such as input/output token counts, may be retained for technical monitoring purposes and API usage control.

For further details on data processing via the AI chatbot, please refer to the site's Privacy Policy.

8. PROPER USE OF THE SITE

The user agrees to use the site lawfully, correctly, and in compliance with these Terms.

It is prohibited, by way of example:

• to use the site for unlawful, fraudulent, or harmful purposes;

• to send false, incomplete, misleading data or data referring to third parties without authorization;

• to use the forms for spam, phishing, unsolicited advertising messages, or mass communications;

• to attempt unauthorized access to the administration panel, server, database, or restricted areas;

• to interfere with the operation of the site, overload it, or compromise its security;

• to introduce viruses, malware, harmful scripts, or malicious code;

• to perform scraping, aggressive crawling, mass copying, or unauthorized automated collection of content;

• to use the chatbot to generate unlawful, offensive, defamatory, discriminatory content, or that infringes others' rights;

• to violate intellectual property rights, privacy, image rights, or other rights of third parties.

The Owner reserves the right to block, limit, or report improper uses of the site, even in order to protect the security of the systems and its rights.

9. INTELLECTUAL PROPERTY

Unless otherwise indicated, all content on the site, including texts, photographs, images, graphics, logos, visual elements, layout, code, page structure, descriptions, informational materials, and multimedia content, are owned by the Owner or used based on rights, licenses, or permissions.

Copying, reproducing, modifying, distributing, publishing, extracting, reusing, or commercially exploiting the site's content without the written permission of the Owner is prohibited, except in cases permitted by law.

Viewing the content for personal, informational, and non-commercial use is permitted.

Any trademarks, logos, trade names, or distinctive signs of third parties present on the site belong to their respective owners.

10. PHOTOGRAPHIC AND MULTIMEDIA CONTENT

The photographs, videos, virtual tours, and other multimedia content on the site have descriptive and promotional purposes.

It is prohibited to download, copy, reuse, modify, or publish such content on other sites, social networks, advertising materials, or commercial channels without the written permission of the Owner or the relevant rights holder.

Any discrepancies between published images and the actual state of the environments may depend on updates, maintenance, seasonal changes, furniture modifications, or other organizational reasons.

11. THIRD-PARTY SERVICES AND CONTENT

The site may include or link to services and content provided by third parties, such as by way of example:

• OpenRouter for the AI chatbot;

• Google Maps or Snazzy Maps, if available;

• YouTube or other video services, if available;

• Kuula for any virtual tours;

• Cloudflare CDN for technical resources like icons or static files;

• Open-Meteo for any public weather data.

These services are managed by third parties and may be subject to their own terms, conditions, and privacy policies.

The Owner does not fully control the content, availability, security, updates, or modes of operation of third-party services and is not responsible for any changes, interruptions, errors, or processing independently performed by those entities, within the limits permitted by law.

Where applicable, loading of external content not necessary for navigation is subject to user consent or a positive action on their part, as indicated in the Cookie Policy.

12. EXTERNAL LINKS

The site may contain links to external sites or resources that are not controlled by the Owner.

Linking to external sites does not imply approval, guarantee, or liability of the Owner in relation to their contents, services, products, policies, security, or processing of personal data.

The user is invited to consult the terms of use and privacy policies of external sites visited.

13. PRIVACY AND COOKIES

The processing of users' personal data is governed by the Privacy Policy of the site.

The use of cookies and similar technologies is governed by the Cookie Policy of the site.

As of the last update of these Terms, the site states that it does not use Google Analytics, Google Tag Manager, Meta/Facebook Pixel, active newsletter systems, or remarketing tools.

The AI chatbot is configured via OpenRouter with the ZDR model/provider, where available, as described in the Privacy Policy and Cookie Policy.

14. SITE AVAILABILITY

The Owner commits to keeping the site available and functional but does not guarantee that access will be continuous, uninterrupted, error-free, or always secure.

The site may be temporarily unavailable due to technical reasons, maintenance, updates, hosting issues, security, force majeure, or causes beyond the Owner's control.

The Owner reserves the right to modify, suspend, update, or discontinue, in whole or in part, functionalities, content, or services of the site without incurring liability toward the user, except as unavoidably provided by law.

15. LIMITATIONS OF LIABILITY

The Owner is not responsible, within the limits permitted by law, for damages, losses, or disruptions arising from:

• improper use of the site by the user;

• inputting incorrect or incomplete data into forms;

• failure to receive communications due to user errors, anti-spam filters, email issues, or technical problems;

• temporary unavailability of the site;

• material errors, typos, or outdated content;

• information generated automatically by the AI chatbot and not confirmed by the Structure;

• services, content, or third-party sites;

• force majeure events or circumstances outside the reasonable control of the Owner.

It is understood that no provision of these Terms limits or excludes liability that cannot be excluded under applicable law, including willful misconduct, gross negligence, damage to persons or mandatory consumer rights.

16. ADMINISTRATIVE AREA AND RESTRICTED ACCESS

Any administrative or restricted areas of the site are accessible exclusively to authorized individuals.

Any attempt at unauthorized access, circumvention of security measures, using others' credentials, abusive scanning, code manipulation, server compromise, or unauthorized access to the database is prohibited.

The Owner reserves the right to implement technical, organizational, and legal measures to protect the site and its information systems.

17. MINORS

The site is directed at adult users or users who browse with the consent and supervision of a parent or guardian.

Reservation requests and contractual relations related to the stay must be made by adults who are capable of acting, unless otherwise provided by applicable regulations.

18. COMMUNICATIONS WITH THE STRUCTURE

Official communications with the Structure can take place via:

• email: dimoredeimarinaitermoli@gmail.com;

• other contact details possibly indicated on the site.

Responses provided via AI chatbot do not constitute official communication from the Structure.

For urgent requests, reservations, changes, cancellations, or relevant information on the stay, the user is invited to contact the Structure directly via official channels.

19. MODIFICATIONS TO THE TERMS

The Owner reserves the right to modify or update these Terms at any time, particularly in the event of:

• regulatory changes;

• technical updates of the site;

• introduction or removal of services;

• variations in the management of forms, chatbots, third-party content or online functionalities;

• organizational needs of the Structure.

The changes will be published on this page with an update of the date indicated at the top.

The user is invited to periodically consult these Terms.

20. APPLICABLE LAW AND JURISDICTION

These Terms are governed by Italian law.

For any disputes related to the use of the site, these Terms, or online informational services, the jurisdiction designated by applicable law will be competent.

If the user acts as a consumer, the mandatory jurisdiction of the court in the place of residence or domicile of the consumer, where provided by law, remains unaffected.

Before initiating any dispute, the user is invited to contact the Structure at dimoredeimarinaitermoli@gmail.com to seek an amicable resolution.

The European online dispute resolution platform, previously known as the ODR platform, has not been operational since July 20, 2025. The consumer user nonetheless retains the rights and protection mechanisms provided by applicable Italian and European legislation.

21. RELATED DOCUMENTS

These Terms must be read together with the following documents published on the site:

• Privacy Policy;

• Cookie Policy;

• any specific conditions for booking, cancellation, payment, or stay communicated by the Structure.

22. CONTACTS

For questions regarding these Terms and Conditions, you can contact:

Dimore dei Marinai
Email: dimoredeimarinaitermoli@gmail.com

Last updated: May 4, 2026

OPERATIONAL NOTES TO VERIFY BEFORE PUBLICATION

This section is for internal use only and should be removed from the public page before going online.

1. Fill in company name, registered office, VAT / Tax Code, and certified email.

2. Check if the site displays public prices: if so, ensure they are clear, up-to-date, and consistent with the conditions communicated by the facility.

3. Verify if the reservation form only sends a request or if it generates an automatic confirmation: if it confirms automatically, modify Section 5.

4. Check if payments, deposits, or advances are requested online: if yes, add a dedicated section on payments, refunds, cancellations, and payment providers.

5. Check if there are any specific conditions for cancellation/no-show/check-in/check-out: if yes, add or link them.

6. Ensure that the chatbot displays a warning before use and that it is indicated as a non-binding informational service.

7. Verify that OpenRouter is configured with the ZDR model/provider consistent with the Privacy Policy and Cookie Policy.

8. Ensure that newsletters, Google Analytics, Google Tag Manager, and Meta/Facebook Pixel are indeed inactive.

9. Check if Kuula is an external link or an embedded iframe and update the third-party content section if necessary.

10. Remove this section of operational notes from the published version on the site.