Privacy policy
Draft for counsel. Not yet in force. Everything in [brackets] is to be completed or confirmed.
Who is responsible
[Company name] (see the legal notice) is the controller of the personal data collected on this website. Counsel: confirm whether each Owner is a separate controller for the bookings of their space (they receive the guest's details to host them), and document it.
Contact for anything about your data: [privacy contact address].
What we collect, why, and on what basis
| What | Why | Legal basis |
|---|---|---|
| Name, email, phone, company, the message you write, your booking, the language you booked in | To handle your request and booking, contact you about it, and send you reminders and practical information | Taking steps at your request before a contract, and performing it |
| Your answer to the offers box | To send you FUN offers now and then, only if you ticked the box | Consent, which you can withdraw at any time by replying to any email or writing to us |
| Your email, the language of the page, what you'd book and where (if you choose), and when you agreed, when you sign up for news on the site | To email you about FUN's opening and offers, once you confirm from the email we send | Consent, which you can withdraw at any time with the unsubscribe link in every email |
| What you ask the concierge (the text you type or say) | To find options that fit | Taking steps at your request |
| Anonymous search statistics: the occasion, number of guests, date asked, the property, whether something fitted | To understand demand and plan availability and prices. No name, contact or words typed are kept | Legitimate interest |
| Technical data: IP address, browser, pages requested | To keep the site secure and working (protection against abuse, error logs) | Legitimate interest |
| Invoices and payment records [when payments start] | Accounting and tax obligations | Legal obligation |
Who receives your data
- The Owner of the space you book, to answer your request and host you.
- Our service providers, who process data only on our instructions:
- Vercel Inc. (website hosting, USA);
- [database provider and region, e.g. Supabase, EU: confirm];
- Resend, Inc. (sending emails, USA);
- Anthropic PBC (reading concierge requests with artificial intelligence, USA): the text of your request is sent, without your name or contact details;
- [payment provider, when set up].
- Voice input. If you use the microphone, speech is turned into text by your browser, which may send the audio to its maker (Google for Chrome, Apple for Safari) under their own terms. You can always type instead.
Some providers are in the United States. Transfers rely on [the EU–US Data Privacy Framework where the provider is certified, or the European Commission's standard contractual clauses: confirm for each].
How long we keep it
Counsel: suggested periods to confirm.
- Requests that did not become bookings: [3 years] after the request.
- Bookings: [5 years] after the booking for claims, and accounting records for 10 years as the law requires.
- Offers and news sign-ups: until you withdraw consent, or [3 years] after your last contact with us. A sign-up never confirmed: [30 days].
- Anonymous search statistics: [13 months].
- Security logs: [up to 12 months].
Your rights
You can ask to access, correct or delete your data, to restrict or object to its use, and to receive it in a portable format. You can withdraw consent at any time. Write to [privacy contact address]. You may also complain to the CNIL (www.cnil.fr).
Cookies
See the cookie policy.
Version: draft, [date].