Privacy policy

Identification data

• Email address
• Password (hashed, never stored in plain text)
• First and last name (optional at MVP stage, required for venue listing)

Profile data

• Profile picture (optional)
• Declared location (city or region)
• Preferences (language, notification settings)

Technical browsing data

• IP address
• Browser type and operating system
• Pages visited and session duration
• Cookies and trackers (see Cookie Policy)
• A hash of your IP address, kept for 24 hours, so that a search with no results is counted only once a day
• Approximate position, rounded to about 1 km on your device, if you use “Near me”: it appears in the address of the results page; it is not kept by Spotwee, apart from our hosting provider's technical logs

Marketplace-related data

• Venues added to favorites
• Booking requests sent
• Messages exchanged via the platform
• For hosts: information about listed venues (description, photos, capacity, etc.)
• Venue visit requests (proposed time slots, optional note)
• “Let us find a venue for you” requests: email address, search criteria and details
• Share link for your selection of favorites (only its hash is stored; the shared page does not reveal your identity)
• For hosts: public replies to reviews; addresses of imported external calendars (iCal) and the busy days extracted from them — nothing else from these calendars is kept
• If you enable them: your browser's push notification subscription (delivery address and encryption keys)
• Reporting a listing or a review: name, email address, reason and explanation of the reporter
• Waiting list, before sign-ups open: email address, language, date and version of your consent, and whether you said you have a venue to list
• Listing preparation sheet that you email to us yourself before sign-ups open: its content (description, address, capacities, amenities, prices, availability and rules of the venue, photos), your name, email address, phone number if you give it, and whether you act as a private individual or a professional

Payment data (planned service, upcoming)

Payment is not active at the current stage of the platform. Upon launch, payment processing will be delegated to Stripe (PCI-DSS Level 1 certified). Spotwee will never directly store users' banking data; only technical transaction identifiers will be retained.

Performance of contract (Art. 6.1.b)

Account creation and management, connection between users, sending transactional communications; preparing your listing from the sheet you send us before sign-ups open (pre-contractual steps taken at your request).

Consent (Art. 6.1.a)

Non-essential cookies (analytics, marketing), newsletter, promotional communications, push notifications on your device, waiting list before sign-ups open. You may withdraw your consent at any time.

Legal obligation (Art. 6.1.c)

Retention of accounting data (10 years, French Commercial Code), response to legitimate requests from competent authorities, handling of content reports (Regulation (EU) 2022/2065, Art. 16), responding to requests to exercise your rights (GDPR, Art. 12).

Legitimate interest (Art. 6.1.f)

Platform security, fraud prevention, defence of Spotwee's rights in case of dispute, handling of complaints and appeals (including with the AI-assisted analysis tool described above), aggregated measurement of searches with no results, email prospecting of venue operators. You may object to these processing operations via contact@spotwee.com.

How to exercise your rights

To exercise your rights, contact us at contact@spotwee.com. If we have reasonable doubt about your identity, we may request additional information necessary to verify it.

Response time

We undertake to respond within one month of receipt of your request, extendable to three months in case of justified complexity (Art. 12.3 GDPR).

Complaint to a supervisory authority

If you believe your rights are not being respected, you may lodge a complaint with the competent supervisory authority:

• France — Commission Nationale de l'Informatique et des Libertés (CNIL) — https://www.cnil.fr
• Luxembourg — Commission Nationale pour la Protection des Données (CNPD) — https://cnpd.public.lu
• Germany — Data protection authority of the federal state of residence (Landesdatenschutzbehörde)

Purposes

• Connection between requester and owner following an inquiry about a venue
• Preparation of the booking and performance of pre-contractual measures
• Logistical coordination of the event and user support
• Prevention of fraud, abuse and circumvention of the Platform
• Detection, handling and evidence of reported content
• Monitoring of the advertised response time: automated processing of communication metadata to detect a request left unanswered, remind the owner and, failing that, allow the Platform to reply to the requester under a clearly identified identity
• Service security and defense of the Platform's rights
• Arranging a visit to the venue before booking, at the renter's request

Legal basis

The exchanges necessary for the preparation of a booking and its follow-up are based on the performance of pre-contractual measures taken at your request and, where applicable, on the performance of the contract. Processing related to security, logging, abuse prevention, moderation and evidence preservation is based on the Platform's legitimate interest in securing its service and protecting its users.

Categories of data

• Participants' account identity
• Content of messages and, where applicable, attachments
• Communication metadata (date, time, conversation and message identifier, sending, receipt, read or report status)
• Technical and logging data necessary for security and incident handling
• Information related to a report, a moderation decision or a dispute

Recipients

Messaging data is accessible to the two participants in the exchange and, strictly on a need-to-know basis, to authorised staff members (support, security, moderation, fraud prevention, dispute handling) as well as technical service providers (hosting, infrastructure, maintenance, security). Automated processing operated by the Platform accesses communication metadata only (timestamps, sender, request status), excluding message content, for the purpose of monitoring the advertised response time. It may be disclosed to competent authorities where required by law or for the establishment, exercise or defense of a legal claim.

Retention periods

Conversations are stored in the active database for 3 years from the last interaction, then deleted. Logging data is retained for a period appropriate to its security purpose. In the event of a report, dispute, suspicion of fraud or legal obligation, the strictly necessary elements may be kept in restricted-access interim archives for the period required to handle the file or defend rights.

Contact details masking

Before acceptance of the request, certain direct contact details (email addresses, telephone numbers) may be automatically masked in the content of messages in order to limit abuse, secure the connection and prevent premature disintermediation. After acceptance, this masking may be lifted according to the service settings.

Your rights over conversations

You may exercise your rights of access, rectification, erasure, restriction and, where applicable, objection. Given the bilateral nature of conversations, a request for erasure may be assessed in light of the rights of others, legal obligations and the need to retain evidence or defend legal claims: depending on the case, it may result in deletion, de-referencing in the interface, anonymisation or partial masking rather than immediate full deletion.