Privacy Policy

Last updated: 2026-07-16

1. Who we are

Monaco Editorial publishes the website monacoeditorial.com and the forthcoming MyMonaco mobile app — a curated editorial guide to the Principality of Monaco. Monaco Editorial is operated by its publisher, who acts as the data controller responsible for processing personal data under the EU General Data Protection Regulation (GDPR).

For any privacy question, or to exercise your rights under this policy, contact us at privacy@oletech.xyz.

2. The short version

• We do not use Google Analytics, Facebook Pixel, or any cookie-based tracking script.
• We do use Plausible Analytics — a cookieless, EU-hosted, GDPR-compliant analytics service — to count page views and aggregate engagement signals like "people opened the map". No cookies set, no IPs stored, no personal data leaves the EU. See section 3.3.
• We set no cookies for marketing, personalisation, or cross-site tracking.
• We do not collect your name, email, IP, or location unless you explicitly send it to us by email or by editing the admin console (admins only).
• We self-host all fonts. No request goes to Google for typography.
• When you open the interactive map, your IP is sent to Cloudflare-hosted OpenFreeMap servers to fetch map tiles. We don't see this; OpenFreeMap discloses it under its own privacy policy.
• When you tap a place photo, your IP is sent to whichever CDN hosts the bytes (almost always our own Firebase Storage bucket on Google Cloud EU; rarely a venue CDN). Same for affiliate links to Booking.com or restaurant reservations.

3. What data we process — and why

3.1 Browsing the website

Reading any page on monacoeditorial.com does not require an account. The site is statically served from Firebase Hosting (Google Cloud, EU region). Firebase processes connection logs (IP address, user agent, URL, timestamp) for security and operational purposes for up to 30 days. We have no access to identifying information in these logs. Legal basis: legitimate interest in operating a public website (GDPR Art. 6(1)(f)).

3.2 Analytics — Plausible

We measure aggregate site usage with Plausible Analytics, hosted in Germany on Hetzner infrastructure (EU). Plausible is engineered specifically to be cookieless and GDPR-compliant: no cookies are set, no localStorage entries are written, and your IP address is hashed together with a daily-rotating salt only long enough to compute "unique visitors" — the hash is then discarded the next day. No identifying data is stored.

The events we send to Plausible are aggregate signals like "the /map page was opened" or "a Book a Stay button was clicked on hotel X". Plausible cannot link these events to you specifically; they roll up into counts in our dashboard. Legal basis: legitimate interest in understanding which content is useful to visitors (GDPR Art. 6(1)(f)).

A consent banner is not required because no terminal-equipment storage is involved (ePrivacy Directive Art. 5(3)). You can verify by opening browser DevTools → Application → Cookies and Storage while browsing this site.

Plausible's own privacy policy: https://plausible.io/privacy. Their data processing agreement (which covers us): https://plausible.io/dpa.

3.3 Map tiles

When you open /map/, your browser fetches vector map tiles from OpenFreeMap(served via Cloudflare). The recipient receives your IP address, the requested tile coordinates, and a default browser User-Agent string. OpenFreeMap states it does not retain identifying logs. We chose this provider specifically because they do not require an API key and do not impose tracking. If you use the map's locate-me button, your coordinates are used only locally by the map library to centre the view and show your position — we never receive them, and they are never added to the page URL or analytics, or stored by us. Recentring the map still requests tiles for the displayed area, as described above.

3.4 Place and event imagery

Place and event photos are served from our own Firebase Storage bucket mytownbackend.firebasestorage.app at storage.googleapis.com (Google Cloud, EU region). Photo origin: most are sourced from Google Places and rehosted on our bucket so the URLs are permanent and served from an EU edge. When your browser loads these images, Google Cloud sees the request (we do not). A small number of event photos remain on the venue's own CDN (e.g. montecarlosbm.com, grimaldiforum.com) when no rehosted copy exists. If you'd prefer not to load these images, browser extensions that block third-party media (e.g. uBlock Origin) work without breaking the rest of the site.

Google Places photo attribution: when the source photo was supplied by a Google Maps contributor, we display their attribution next to the image per Google's terms.

3.5 Outbound booking links

"Book a Stay", "Book a Table", and "Reserve" buttons on place pages (and the matching short chips on the map) open third-party booking or reservation systems — for example Booking.com, TheFork, SevenRooms, a Monte-Carlo SBM booking page, or the venue's own site. When a Booking.com affiliate programme is configured for a surface, that surface may append an affiliate identifier to the Booking.com URL so we can attribute a commission; no other booking platforms currently pay us a referral fee. These are outbound links you click intentionally, not tracking pixels — nothing about the booking destination fires before you click (we may record a cookieless Plausible event that a booking button was clicked, without the full URL). Once on the booking site, that site's privacy policy applies, not ours. The same applies to "Order online" buttons and the Food Delivery directory page, which open Monaco's food-delivery platforms (Delovery, Mr Room Service): outbound links you click intentionally, no affiliate relationship, and the destination's own privacy policy once you are there.

3.6 Email correspondence

If you email privacy@oletech.xyz, your message and email address land in our inbox. Retention: up to 24 months for correspondence history, then deleted. Legal basis: legitimate interest in handling support requests (GDPR Art. 6(1)(f)).

4. Cookies

We do not set any first-party cookies. The browser-level technologies present on this site are limited to:

• localStorage used by MapLibre (the map library) to cache vector tiles for the current session, so re-opening the map doesn't re-download tiles. Purely functional, contains no identifying data, can be cleared in your browser at any time.

See our Cookies page for the full audit + how to disable.

5. Your rights (GDPR)

Since we don't collect personal data, most GDPR rights have nothing to act on. For data we do hold (email inbox correspondence), you can:

• Access what we have about you (Art. 15).
• Correct inaccurate data (Art. 16).
• Delete your data (Art. 17 — "right to be forgotten").
• Object to processing (Art. 21).
• Lodge a complaint with your national Data Protection Authority — in Monaco, the CCIN; in France, the CNIL; in Italy, the Garante; in Germany, the BfDI; etc.

Email privacy@oletech.xyz. We respond within 30 days per GDPR Art. 12(3).

6. International transfers

Firebase Hosting is configured to the europe-west1 region — your site requests stay within the European Economic Area. Google's underlying infrastructure may transfer technical operational data to the United States under EU-US Data Privacy Framework certification. For map tiles, OpenFreeMap uses Cloudflare's global network and may route through any Cloudflare PoP geographically near you.

7. Children

This site does not knowingly process data from children under 16. We do not require sign-up to read content.

8. Changes

When this policy changes materially we update the "Last updated" date at the top and post a notice on the homepage for two weeks.

9. Governing law

Where the GDPR applies — for visitors in the European Economic Area — this policy is read in accordance with it. EU and EEA residents retain their statutory GDPR rights regardless of where the publisher is established.