Privacy Policy
1. Data controller
The data controller is to be completed, to be completed (SIREN: to be completed). Contact for any question about personal data: to be completed.
2. Data collected
- Account: email, password (hashed), first name, last name, phone (optional), profile photo.
- Trust and reputation: average rating, number of trips (eligibility for instant booking).
- Payment: Stripe identifiers; bank details are processed exclusively by Stripe and are never stored by us.
- Bookings: dates, time slots, amounts, statuses, chosen options, messages exchanged.
- Listings (Hosts): title, description, address, photos, prices, availability.
- Imported calendars (Hosts): the address (.ics link) of the external calendars you import and the busy periods extracted from them, used only to close the relevant time slots.
- Local Providers (professionals): company name, legal form, SIRET and VAT numbers, proof of insurance and of diploma or professional card, business address, service area, hours, services and prices.
- Location: address entered or position chosen on the map for a search, a listing or a delivery; approximate geolocation deduced from the IP address to offer nearby results.
- Service orders: services and activities added, quantities, time slots, pick-up or delivery method, instructions you leave for the provider.
- Identity verification (where applicable): your identity verification status; any documents submitted are used only for this verification.
- Referral: your referral code, the link with your referrer or referred friends (a referrer sees the first name of the people they referred to track rewards), the referred person’s sign-up IP address (abuse detection) and your credit history.
- Reviews and reports: ratings, comments, reasons and processing status.
- Notifications and alerts: your browser notification subscription and the availability alerts you create.
- Security: IP address and timestamp of login attempts, sign-ups and sensitive actions (fighting fraud and abuse).
- Preferences: language, currency, cookie choices.
- Audience measurement: only if you accept it (see article 9).
3. Purposes and legal bases
| Purpose | Legal basis |
|---|---|
| Account creation and management, matching, booking, payment, messaging | Performance of the contract |
| Security, prevention of fraud and abuse (including referral), request rate limiting | Legitimate interest |
| Moderation, handling of reports and disputes | Legitimate interest |
| Review of professional provider applications and verification of their status | Performance of the contract and legitimate interest |
| Displaying results near you (search, nearby services and activities) | Performance of the contract and legitimate interest |
| Accounting and tax obligations (including DAC7) and responses to authorities | Legal obligation |
| Transactional emails and notifications (confirmations, booking reminders, alerts you requested, referral reward) | Performance of the contract |
| Audience measurement and service improvement | Consent |
4. Retention periods
- Account: for the duration of the relationship, then deletion or anonymization when the account is closed.
- Booking and invoicing data: 10 years (accounting obligations), anonymized after account deletion.
- Security logs (IP, attempts): 12 months maximum.
- Professional provider file: for the duration of the relationship, then 5 years to evidence the checks carried out, unless a longer legal obligation applies.
- Rejected provider applications: 12 months.
- Messages: for the duration of the relationship, then anonymized with the account.
- Cookie choices: 6 months, then asked again.
- Referral and credit history: for the duration of the relationship, then 10 years in anonymized form for accounting entries.
When an account is deleted, your identification data is erased or anonymized (name, first name, email, password); past bookings and accounting records are kept with no link to your identity.
5. Recipients
- Hosts and Travelers involved in a booking (name, messages, information needed for the service).
- Local Providers whose service you order: first name, last name, time slot, quantity, delivery or meeting address and instructions, solely to fulfil the order.
- Our processors: Vercel (hosting), Neon (PostgreSQL) (database), Stripe (payment and payouts), PayPal (payouts, when the Host chooses this method), Google (maps and geocoding), to be completed (image storage), to be completed (email sending).
- Authorized authorities, in the cases provided for by law.
Your data is never sold.
6. Transfers outside the European Union
Some processors (notably Vercel, Stripe, Google) may process data outside the European Union, in particular in the United States. These transfers are covered by an adequacy decision (Data Privacy Framework) or by the European Commission’s standard contractual clauses.
7. Security
Hashed passwords, encrypted connections (HTTPS), httpOnly session cookies, request rate limiting on sensitive actions, role-based access control and logging of security events.
8. Your rights
- Right of access, rectification and erasure;
- Right to restriction of processing and to object;
- Right to data portability;
- Right to withdraw your consent at any time;
- Right to set directives on what happens to your data after your death.
Account deletion is available directly in “Settings” (not possible while a booking is in progress). To exercise your other rights, write to to be completed, attaching proof of identity if necessary; we reply within one month.
9. Cookies and trackers
Strictly necessary cookies (no consent required)
- Session cookie (httpOnly): keeps you logged in.
- “Remember me” cookie (optional, enabled by you).
- Language cookie.
- Recording of your cookie choice.
Audience measurement (with your consent)
If you accept, we use Google Analytics to measure traffic and improve the service. No measurement cookie is set and no analytics script is loaded before you agree. Refusing is as easy as accepting and has no effect on using the site. You can change your mind at any time: .
With the same consent, we also compile our own traffic statistics (page views, approximate city derived from the IP address, device type, visit source, a browser identifier stored in a cookie for 13 months) and the real loading speed of pages, without any personal identifier. These speed measurements are kept for 90 days. We also tell robots apart from human visitors using their technical identifier (User-Agent).
10. Automated decisions, minors and photos
- No decision producing legal effects concerning you is taken solely by automated processing. Result ranking and eligibility for instant booking rely on criteria described in the Terms of Use. Referral anti-abuse checks are reviewed by a person before any refusal.
- The Platform is reserved for adults; we delete accounts of users who are minors.
- Photos published by Hosts and Providers must not show identifiable people without their consent. You can request their removal at to be completed.
11. Complaints
If you believe your rights are not being respected, you can lodge a complaint with the CNIL: cnil.fr/fr/plaintes — 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07.