Last updated: October 21, 2026
1. Overview and who is responsible
MM Creatives ("ItalyGo", "we", "us") operates italygo.ca and is responsible for the personal information described in this policy. We are based in Ontario, Canada, and we handle personal information in line with the Personal Information Protection and Electronic Documents Act (PIPEDA) and applicable Ontario privacy law.
Our Privacy Officer, MM Creatives is accountable for compliance with this policy. You can reach them through the contact form by choosing "Privacy request". We answer privacy requests within 30 days.
By using the Site you consent to the practices described here. Consent to optional analytics and advertising cookies is asked separately, through the cookie banner, and can be withdrawn at any time.
2. What we collect
Information you give us
- Account: email address, display name, optional username, profile photo, bio, home city, leaderboard visibility setting, and a password stored only as a salted scrypt hash. We never store your password in readable form.
- Google sign-in: if you choose "Continue with Google", Google tells us your Google account identifier, name, email address and profile picture. We do not receive your Google password, contacts, calendar or other Google data.
- Your content: reviews, aspect ratings, "what to order" and vibe tags, check-ins, photos you upload, favourites, lists, likes and reward redemptions.
- Business information: if you claim a listing or ask us to add a business, the details and any supporting evidence you provide, plus your contact details.
- Messages: the name, email, topic and message you send through the contact form, and the confirmation emails we send in return.
- Ciao chat: the question you type (up to 240 characters) and the previous line used to understand follow-ups. Messages are processed in memory to produce a reply and are not saved to your account, not used to train any model, and not sent to a third-party AI provider.
Information collected automatically
- Technical data: IP address, browser and device type, requested page and timestamp in standard server logs, kept for security and troubleshooting.
- Usage data (with consent): pages viewed, city pages and device category, through Google Analytics.
- Advertising data (with consent): Google AdSense may use cookies, device information and approximate location to select and measure ads.
- Interaction records: when you click a website, booking, menu or map link, we record an anonymous count against that business. This is not linked to your account.
What we do not collect
We do not process payments on the Site, so we never receive card or bank details. We do not buy personal information from data brokers, and we do not collect your precise GPS location.
3. Why we use it
- To run your account and the community features — signing in, saving favourites, issuing passport stamps and rewards (performance of our agreement with you).
- To publish what you choose to share — reviews, photos, lists and your public profile (with your consent, given when you submit).
- To answer you — contact messages, corrections, business claims and privacy requests.
- To keep the Site honest and safe — detecting fake reviews, spam, scraping, fraud and abuse; enforcing our Terms and Community Guidelines.
- To improve the guide — aggregate statistics about which pages and cities are useful (analytics, with consent).
- To display advertising — only with your consent, and always labelled.
- To meet legal obligations — record-keeping, responding to lawful requests and enforcing our rights.
We do not sell your personal information, and we do not rent or trade it. We do not use your reviews or profile to make automated decisions that have legal or similarly significant effects on you.
4. Cookies and consent
Strictly necessary cookies keep you signed in and protect Google sign-in. Analytics and advertising cookies are off by default and load only after you accept them in the cookie banner. You can change or withdraw your choice at any time using the Cookie settings link in the footer. Full details, including every cookie and its lifetime, are in our Cookie Policy.
Your consent choice is stored in your browser's local storage, not in a tracking cookie, so we can remember it without setting anything before you agree.
5. What we share, and with whom
- Public content: your reviews, photos, check-ins, lists and public profile are visible to visitors and may appear in search results, attributed to your display name or username. Your email address is never shown publicly.
- Hosting and infrastructure: our hosting provider (Hostinger) stores the Site and its database; email is delivered through our email (SMTP) provider. Both act on our instructions and are bound by confidentiality obligations.
- Google: Google sign-in (authentication), Google Analytics (traffic statistics, with consent) and Google AdSense (advertising, with consent).
- Businesses: we do not give your email address to businesses. If you contact a business through an external link, that business's own privacy policy applies from that point.
- Legal and safety: where required by law, court order, a regulatory request, or where necessary to protect our rights, property, users or the public.
- Business transfer: if the Site or MM Creatives is sold, merged or reorganised, personal information may transfer as part of that transaction, subject to this policy.
6. Where your data is processed
Our database and hosting are located in Canada or the European Union, depending on the hosting region in use. Some processing happens outside Canada: Google (Analytics, AdSense and sign-in) processes data in the United States and other countries. Where personal information leaves Canada, we rely on the service provider's contractual protections and remain accountable for it under PIPEDA. Foreign authorities may be able to access data held by those providers under their own laws.
7. How long we keep it
- Account and profile: while your account is active, then deleted within 30 days of a verified deletion request.
- Reviews and photos: kept while published. On account deletion they are removed or anonymised (attributed to "Former member") unless you ask us to delete them, which we do within 30 days.
- Passport, check-ins, favourites and lists: deleted with your account.
- Contact messages and business claims: up to 24 months after the matter is closed, for record-keeping and dispute resolution.
- Server logs: short-lived, normally no more than 90 days.
- Analytics: aggregated reports are retained for up to 14 months in Google Analytics.
- Uploaded images: removed when the related review, profile or account is deleted.
Residual copies may remain in backups for a limited period until they are overwritten. We may keep information longer where the law requires it or to establish or defend a legal claim.
8. How we protect your information
- Passwords are stored as salted scrypt hashes, never in readable form.
- Sessions use signed, httpOnly cookies with a 30-day expiry, served over HTTPS.
- Administrative tools are restricted to authorised team members on a least-privilege basis.
- Uploads are size- and type-checked; abuse, scraping and spam are monitored.
- Access to the production database is limited and credentialed.
No online service can guarantee absolute security. If a breach creates a real risk of significant harm, we will notify affected individuals and the Office of the Privacy Commissioner of Canada as required by law, and take steps to contain it.
9. Your rights and choices
- Access: ask for a copy of the personal information we hold about you and how it has been used.
- Correction: ask us to fix inaccurate or incomplete information.
- Deletion: ask us to delete your account and personal information.
- Withdraw consent: change analytics or advertising consent at any time via Cookie settings in the footer; delete a review or photo and it stops being published.
- Leaderboard: turn off public visibility from your account settings.
- Challenge compliance: raise a concern with our Privacy Officer, and if you are not satisfied, with the Office of the Privacy Commissioner of Canada.
To exercise any of these, use the contact form and choose "Privacy request". We may ask for proof of identity before acting, so we do not disclose or delete the wrong person's data. There is no fee for a reasonable request.
10. Email and commercial messages
We send service messages you need — for example a contact-form confirmation, a claim update or a security notice. These are not marketing and cannot be opted out of while you use the relevant feature. If we ever send a newsletter or promotional message, we will do so only with your express consent under Canada's Anti-Spam Legislation (CASL), and every message will include a working unsubscribe link and our mailing address. We do not share your email with advertisers.
11. Children
The Site is intended for adults. You must be at least 18 to create an account, and alcohol-related content is intended for people 19+. We do not knowingly collect personal information from anyone under 18. If you believe a minor has created an account, contact us and we will delete it and its data.
12. Business and public information
Business names, addresses, phone numbers, websites and hours are published as part of the public directory. This is business contact information, not personal information about an individual, except where a sole proprietor uses personal details. Owners can request corrections or removal at any time through the contact form.
13. Links to other sites
The Site links to businesses and third-party booking platforms. Once you leave italygo.ca, this policy no longer applies; the destination site's privacy policy governs what happens there. We receive no personal data from those sites.
14. Changes to this policy
We may update this policy as the Site changes. The current version is always posted here with a new "Last updated" date. If a change is material, we will highlight it on the Site or email registered users before it takes effect.
15. Contact us
Privacy questions, access requests or complaints: use the contact form and choose "Privacy request", addressed to the Privacy Officer, MM Creatives. You can also write to MM Creatives, Ontario, Canada. We respond within 30 days. If we cannot resolve your concern, you may contact the Office of the Privacy Commissioner of Canada at priv.gc.ca.