Keeping records: how long to hold them, and what you must delete instead
Updated 14.09.2026
Hosts assume that keeping things is always the safe choice: when in doubt, hold on to everything. For receipts that is true. For your guests' identity documents it is the opposite, and a rule says so: that data must be deleted, not archived. Here is what to keep and for how long.
- The police receipt: five years, thirty days to download it
- What you are required to delete instead
- SPOT: no written deadline, but the records must exist
- Invoices: ten years, but not for everyone
- How far back the tax office can come
- Electronic invoices sent through the SdI
- How to keep them: format, order, copies
- How Chilloso solves it
- Frequently asked questions
The police receipt: five years, thirty days to download it
Sending the guest records is half the job. The proof is the digital receipt the portal produces afterwards, and the decree gives it a precise function: it counts as attestation that the duty was fulfilled. The retention period is five years, in digital form. Printing it serves no purpose.
The point where almost everyone slips is elsewhere. On the portal the receipt stays downloadable for a maximum of thirty days from issue. After that it disappears from the screen. If you did not take it in time, an inspection finds you without the very document the decree names as proof.
Thirty days is not cautious advice, it is the limit of the portal. The State Police write it in their own FAQ and add a single recommendation: download within the stated time. Nothing is reissued afterwards.
What you are required to delete instead
This is the part missing from almost every guide. The same article that imposes five years on the receipt obliges the host to delete the digital data transmitted and destroy any paper list, as soon as the system has generated the receipt.
So the archive of your guests' documents is not material to keep out of caution: it is material to remove as soon as the receipt is in your hands. What remains, for five years, is the receipt. Not the personal details, not the scans of identity cards, not the photos that arrived in a chat.
A folder full of scanned documents does not protect you in an inspection: the proof is the receipt, not the copy of a passport. It only exposes you, before the police and before the data protection authority.
SPOT: no written deadline, but the records must exist
For the monthly SPOT documents the regional law sets no retention period. It does not say, and there is no sense in inventing one. It does say two things that matter.
First: among the penalties on transmitting tourist movement data there is one for the case where the monthly return turns out to be, in its contents, at odds with the data obtainable from the property's records. The rule takes for granted that those records exist and that you can consult them.
Second: the penalty procedure follows the law on administrative sanctions, which sets the limitation on the right to collect at five years from the day of the breach. Five years, then, not because a retention rule demands it, but because until then you can still be called to answer.
Invoices: ten years, but not for everyone
The Civil Code requires ten years for accounting records, counted from the date of the last entry; for the same period you must keep the invoices received and copies of those issued. Mind the starting point: it is the last entry, not the date of the single invoice.
That rule, however, does not apply to everyone. It addresses the entrepreneur carrying on a commercial activity, and the same code expressly excludes small entrepreneurs. Anyone letting on a non-business basis falls outside it.
This does not mean you can throw everything out after a year: it means your clock is not the Civil Code but the period in which the tax office can still ask you to account. The rule covers everything around the house: Booking and Airbnb commissions, plumber, cleaning firm, gardener, water tanker, accountant. These are the items that reduce the taxable base, and they are exactly what you will be asked to prove.
If you let as a business: ten years, and it is an obligation. If you let privately: no ten-year civil obligation, but keeping documents until the tax deadlines close is the only way to have something to defend yourself with.
How far back the tax office can come
Income tax assessments must be served, on pain of forfeiture, by 31 December of the fifth year following the year in which the return was filed. If the return was omitted or void, by 31 December of the seventh year following the year in which it should have been filed.
Do the arithmetic on your own case, not on a round five years: an invoice from 2026 goes into the return filed in 2027 and stays open to assessment until the end of 2032. That is more than six years from the invoice.
And one rule stretches it further: mandatory accounting records must be kept until the assessments for the corresponding tax period are settled, even beyond the Civil Code term. With a dispute open, ten years is not a ceiling.
| Document | How long | What it rests on |
|---|---|---|
| Alloggiati Web receipt | 5 years from issue | Art. 4-bis D.M. 07.01.2013 |
| Guests' data and documents | to be deleted once the receipt exists | Art. 4-bis D.M. 07.01.2013 |
| Monthly SPOT documents | no written term; 5 years while you can be challenged | L.R. Puglia 49/2017, arts. 10 and 11; art. 28 l. 689/1981 |
| Invoices, business activity | 10 years from the last entry | Art. 2220 Civil Code |
| Invoices, non-business letting | until 31.12 of the 5th year after the return | Art. 43 D.P.R. 600/1973 |
| Records with an open assessment | until settled, even beyond 10 years | Art. 22 D.P.R. 600/1973 |
Electronic invoices sent through the SdI
For electronic invoices that passed through the Interchange System there is a rule almost nobody cites: the retention obligations are deemed satisfied for all electronic invoices and digital documents transmitted through the SdI and stored by the Revenue Agency.
In plain terms: on those documents you are not alone. Keeping your own copies within reach is still the practical choice — in an inspection you need the document straight away — but the fear of a failed hard disk is a different matter.
How to keep them: format, order, copies
Digital is enough. The Civil Code expressly allows keeping records on image media, provided they correspond to the documents and can be made legible at any time. Format is not the problem: finding them again is.
- Every document sits with the house it belongs to, not in a general folder on a computer.
- The file name states date and subject, not IMG_4471.
- There are at least two copies in different places: an archive living on a single disk is an archive with an expiry date.
How Chilloso solves it
The police receipts and the SPOT documents sit in the folder of the house they belong to, sorted by date. Remembering the thirty days is not your job.
Identity documents stay inside Chilloso: the guest uploads them from the check-in link, and they are deleted from our systems as soon as the notification to the police has gone through.
That is why we tell guests not to send them over WhatsApp: from there their data leaves the closed system and lands on third-party servers, and no one can say any more who keeps it, where and for how long. The check-in link is the only route on which you can answer for what happens to their documents.
Do you need more information?