ExploreLog in

Privacy Policy

Data processed by The Openers in its role as a booking intermediary.

Last updated: 18 July 2026

Publication blocked: the data controller's official identity is incomplete (LEGAL_COMPANY_NAME, LEGAL_COMPANY_FORM, LEGAL_COMPANY_CAPITAL, LEGAL_COMPANY_ADDRESS, LEGAL_COMPANY_RCS_NUMBER, LEGAL_COMPANY_RCS_CITY, LEGAL_COMPANY_SIRET, LEGAL_PUBLICATION_DIRECTOR, LEGAL_CONTACT_EMAIL, LEGAL_CONSUMER_MEDIATOR_NAME, LEGAL_CONSUMER_MEDIATOR_ADDRESS, LEGAL_CONSUMER_MEDIATOR_URL).

Data controller

The data controller is not yet configured. This version cannot be published to production.

Its address, registration and full contact details are in the Legal Notice. No person is described as a DPO unless one has actually been appointed.

Data processed

We limit data to account, matching, contracting, payment and legal-duty needs.

  • Account and contact: name, email, phone, language, photo, authentication and settings.
  • Trust and compliance: identity-verification result, private or trader host status, business information and supporting documents. DAC7 tax identifiers are encrypted at rest.
  • Properties and bookings: listing, photos, exact address protected before authorisation, availability, travellers, dates, messages, agreement, inventory, cancellation and disputes.
  • Remunerated short-term rentals: registration declaration and number, nights, guest count and each guest's country of residence where required for regulatory activity reporting.
  • Payment and tax: amounts in cents, Stripe identifiers, payment status, saved card and any documented damage-claim cap, tourist tax, host consideration and data required for DAC7 reporting. The Openers does not store full card numbers and does not hold funds in advance.
  • Technical: security logs, IP address and device when needed; pseudonymous PostHog pages and functional events only after consent.

Purposes

Each operation has a defined purpose.

  • Create and secure accounts, display authorised listings and enable communication between members.
  • Calculate a transparent price, generate the host-guest agreement, process payment and handle cancellation or disputes.
  • Check identity, right to offer a property, trader status and documents without presenting those checks as an exhaustive guarantee.
  • Collect and report tax or tourist information that the law requires from an intermediary platform.
  • Check the display of registration numbers and transmit activity reports to competent public entry points where applicable.
  • Prevent fraud, secure the service, provide support and, after consent, measure platform usage.

Legal bases

The legal basis depends on the purpose rather than a single formula.

  • Contract or pre-contract steps: account, booking, messaging, agreement, payment, cancellation and transaction support.
  • Legal duty: accounting, tax, DAC7, tourist tax, authority requests, mandatory evidence retention and trader information.
  • Legal duty: collection and transmission of short-term rental activity data for the relevant areas and regulatory reporting frequency.
  • Legitimate interests: security, fraud prevention, legal claims, moderation and non-intrusive improvement after balancing individual rights.
  • Consent: PostHog audience-measurement trackers and any optional purpose requiring it. Consent can be withdrawn at any time.

Recipients

Access is limited to what is necessary.

  • Host and guest receive data needed for their booking and agreement; visitors see only public data, including mandatory trader status and information.
  • Technical processors: Vercel (application), Neon (database), Cloudinary (media), Stripe (payment and identity), Resend (email) and PostHog (analytics after consent).
  • A remote OCR or AI service receives a document only where that feature is enabled and governed; its output remains subject to human review.
  • Authorities, courts or authorised advisers where required by law or to establish, exercise or defend a claim. Data is not sold.
  • Single digital entry point and competent authorities for short-term rental reports, only with the required data and for the relevant areas.

Hosting and transfers

Some international providers may process data outside the European Economic Area.

  • Database, analytics and configurable services must use a European region where available.
  • Before production activation, each transfer must be recorded with country, purpose, applicable safeguard and processor contract: adequacy decision or standard contractual clauses and supplementary measures as applicable.
  • A provider must not be enabled until those safeguards and its retention period have been verified.

Retention

Data is kept for its purpose and then for applicable statutory evidence periods.

  • Account and listing: while the service is used, followed by limited deletion or archiving after closure based on ongoing agreements, disputes and limitation periods.
  • Bookings, agreements, payments, accounting, tourist tax and DAC7: for periods imposed by applicable civil, tax and accounting rules for each record.
  • Guest countries of residence: automatically deleted no later than eighteen months after confirmed regulatory transmission; a disputed booking is excluded from this deletion until resolution.
  • Identity and compliance documents: during verification and only as long as strictly required by security or law; unnecessary copies must be deleted promptly.
  • Security logs: a risk-proportionate period recorded internally. PostHog analytics: the period declared in the Cookie Policy, capped in code at 365 days.
  • An internal deletion policy must turn these criteria into operational periods and be checked periodically.

Security

We apply technical and organisational measures proportionate to risk.

  • Role-based access, server-side authorisation, audit logs for sensitive operations and minimisation of data returned publicly.
  • Authenticated AES-256-GCM encryption of DAC7 tax identifiers with a dedicated key; secrets and keys must never be logged or committed.
  • Stripe handles card data; sensitive documents use time-limited access where supported by storage.
  • No measure removes all risk. Incidents are assessed, recorded and notified to individuals and authorities where legally required.

Your rights

Depending on the processing, you may exercise GDPR rights.

  • Access, rectification, erasure, restriction, objection and portability; withdrawal of consent without retroactive effect.
  • Proof of identity is requested only where there is reasonable doubt. A response is provided within the legal period, extendable for complex requests under GDPR conditions.
  • Send the request to the official Legal Notice address. You may also complain to the competent supervisory authority.

Cookies and audience measurement

Necessary and optional trackers are separated.

  • Session, security, language and consent-choice cookies are required for the service.
  • PostHog initialises only after analytics consent; autocapture, session recording, named profiles and automatic exception capture are disabled.
  • Reject is as accessible as accept and the choice can be withdrawn at any time from the Cookie Policy.

Before production: have this policy, processing register, deletion periods, processor contracts, transfers and rights-request procedure validated by competent counsel.