1. Data controller
Nicolas Lipowiez, sole trader, publisher and operator of the loveinroom.fr platform.
437 avenue Aristide Briand, 83160 La Valette-du-Var, France
SIRET 803 893 809 00043
[email protected]
Love in Room is not required to appoint a data protection officer. Any request relating to personal data should be sent to the address above.
2. What this policy covers
This policy describes the processing carried out by Love in Room as a data controller.
It does not cover processing carried out by hosts on their own account, in particular performing the stay, managing their customers and meeting their legal obligations. In those cases the host is the controller for its own purposes.
Nor does it cover processing carried out by Stripe under its own regulatory obligations (section 9.2).
3. Visitors to the platform
| Categories | pages viewed, referring page, device type, country, IP address (technical logs), searches performed on the site |
|---|---|
| Purposes | display the platform, measure its audience anonymously, ensure its security and prevent abuse |
| Legal basis | legitimate interest (Art. 6(1)(f)): operating and securing a service you request, and measuring its use in a non-intrusive way |
| Retention | technical logs: 13 months · audience statistics: aggregated, with no individual identifier |
| Recipients | Love in Room · OVH (hosting) · Cloudflare (delivery and security) |
Audience measurement is carried out using a tool installed on our own servers, with no cookies and no tracking identifier. See our cookie policy.
4. Travellers — request and booking
4.1 Booking data
| Categories | title, surname, first name, email address, phone number, dates and type of stay, number of guests, selected extras, amount, booking reference, correspondence relating to the booking, IP address and timestamp of acceptance of the terms |
|---|---|
| Purposes | pass the request to the host, form and perform the booking, apply the cancellation policy, inform the traveller, handle refunds |
| Legal basis | performance of the contract entered into with the traveller for the booking service (Art. 6(1)(b)) |
| Retention | 13 months after the end of the stay, then deletion or anonymisation |
| Recipients | the host concerned, sole recipient of the data required to perform the stay · Stripe · Brevo (email delivery) |
The IP address and the timestamp of acceptance of the terms are retained as evidence (section 4.4).
4.2 Payment data
| Categories | transaction identifier, amount, date, status, last four digits and card type, identifier of the saved payment method |
|---|---|
| Purposes | carry out the booking payment, handle failed charges, refunds and disputes |
| Legal basis | performance of the contract (Art. 6(1)(b)) and legal obligation for accounting retention (Art. 6(1)(c)) |
| Recipients | Stripe |
Retention is not uniform: it follows the purpose of each item.
- Accounting records whose retention is legally required (invoices, supporting documents): the applicable statutory period, namely ten years under Article L.123-22 of the French Commercial Code.
- Operational transaction identifiers (payment identifier, status, date): for as long as needed for their purpose — tracking the operation, handling refunds and disputes — then for the applicable limitation periods.
- Identifier of a saved payment method: for as long as it remains necessary to carry out a future payment or related operations, then deleted.
Retaining an invoice for ten years does not entail retaining the technical identifiers of the payment method.
Love in Room never has access to your card number. It is collected and stored by Stripe, in tokenised form.
4.3 Disputes
The elements of a reported dispute (description, documents, correspondence) are processed to facilitate its resolution, on the basis of the legitimate interest of Love in Room and of the parties in resolving the dispute, and retained until the corresponding claims are time-barred.
4.4 Evidence
The elements establishing the request, its acceptance, the version of the terms accepted and the cancellation policy locked in are retained on the basis of the legitimate interest of Love in Room in establishing and keeping evidence of its operations, for the applicable limitation periods.
5. Registered hosts
| Categories | title, surname, first name, email address, phone, address, company name, registration number where provided, login credentials, published content, billing history, support correspondence, activity logs |
|---|---|
| Purposes | create and manage the account, publish and manage listings, bill the subscription and options, provide support, prevent fraud, ensure traceability of operations |
| Legal basis | performance of the contract (Art. 6(1)(b)) · legal obligation for billing and tax reporting (Art. 6(1)(c)) · legitimate interest for fraud prevention and traceability (Art. 6(1)(f)) |
| Retention | account: term of the contract then 3 years after the last activity · billing: 10 years · audit log: 7 years |
| Recipients | Stripe · Brevo · OVH |
5.1 Verification of the registration number
Where a host declares operating under a registered form, the SIRET number provided is checked against the INSEE Sirene public register. This verification is based on Love in Room's legitimate interest in confirming the reality of the declared activity.
5.2 Identity verification for collecting payments
A host who activates online booking is subject to identity verification carried out by Stripe under its anti-money-laundering obligations. Identity documents and bank details are collected directly by Stripe; Love in Room is not a recipient. See section 9.2.
5.3 Reporting obligation
Love in Room is required to report to the tax authorities information about hosts and the amounts they receive through the platform, under the DPI-DAC7 framework.
- Legal basis: legal obligation (Art. 6(1)(c))
- Retention: 10 years
- Recipients: tax authorities
5.4 Account deletion
Data that is no longer necessary is deleted or anonymised.
Data whose retention is required by a legal obligation, or necessary for the establishment, exercise or defence of legal claims, is kept separately for the applicable period.
6. Listings created from publicly accessible information
Some of the accommodation listings presented on the platform were built from publicly accessible business information about establishments: name, address, business contact details, description and photographs of the establishment.
| Categories | business information about an establishment, capable of relating to a natural person where it is operated in their own name |
|---|---|
| Purposes | present an accommodation offer on the platform, allow the operator to claim management of it |
| Legal basis | legitimate interest (Art. 6(1)(f)): building and presenting an accommodation offer, and giving the operator the opportunity to take control of it |
| Retention | until the listing is claimed, or until a removal request |
| Recipients | Love in Room · no third party |
These listings do not allow any contract to be entered into on the platform: they do not offer online booking and give rise to no payment.
Where data has not been collected directly from the operator, Love in Room provides the information required by Article 14 GDPR at the latest at the time of first contact, or within the applicable statutory period, where their contact details reasonably allow it.
Where such individual information proves impossible or would involve disproportionate effort within the meaning of Article 14(5)(b) GDPR, Love in Room implements the appropriate measures provided for by that provision, in particular making this information publicly available.
Right to object. The operator of an establishment may at any time request rectification or removal of the listing concerning it, without having to give reasons, using the form available from each listing or at [email protected]. Admissible requests are reviewed as promptly as possible.
7. Prospecting and communications
7.1 Prospecting accommodation professionals
| Categories | name, business email address, business phone, listing concerned, send and open history |
|---|---|
| Purposes | inform an operator that a listing concerning it exists and can be claimed, present Love in Room's services |
| Legal basis | legitimate interest (Art. 6(1)(f)), the prospecting being addressed to professionals for a service directly related to their activity |
| Retention | 3 years from the last contact, or until an objection is received |
| Recipients | Brevo (message delivery) |
Every message includes a means of objecting to any further approach. An objection is recorded and final: it excludes the recipient from any later campaign.
7.2 Newsletter
| Categories | email address, date and evidence of consent, subscription status |
|---|---|
| Purposes | send the requested newsletter |
| Legal basis | consent (Art. 6(1)(a)), obtained through a two-step sign-up confirmation |
| Retention | until unsubscription, then 3 years as evidence of consent and its withdrawal |
| Recipients | Brevo |
Consent may be withdrawn at any time using the link in each message.
7.3 Service messages
Messages necessary to perform a booking or a subscription (confirmation, payment reminder, cancellation, invoice) are sent on the basis of performance of the contract and do not constitute prospecting. They cannot be unsubscribed from.
8. Support and messaging
Correspondence with support, including the messaging in the host area, is processed for performance of the contract and retained for 3 years from the last exchange, or longer where a dispute requires it.
9. Recipients and service providers
Love in Room does not sell, rent or exchange any personal data.
9.1 Providers acting on instructions (processors)
| Provider | Role | Location |
|---|---|---|
| OVH SAS | hosting of servers and databases | France |
| Cloudflare, Inc. | delivery, protection against attacks and bots, image storage | United States, European data centres for European traffic |
| Brevo SAS | email delivery | France |
| Anthropic PBC | editorial generation of accommodation descriptions from information about the establishment, at Love in Room's request | United States |
Audience measurement and the internal search engine run on our own servers and involve no disclosure to any third party.
9.2 Stripe — a dual role
Payments are operated by Stripe group entities established in the European Union, in particular Stripe Payments Europe Limited (Ireland) and Stripe Technology Europe Limited, an electronic money institution authorised by the Central Bank of Ireland (C187865).
Depending on the processing concerned, the Stripe entities involved may act as a processor for Love in Room or as an independent controller, in particular where they determine the purposes and means necessary for fraud prevention, compliance with their regulatory obligations, identity and anti-money-laundering checks, and the management of their financial services.
For processing they carry out as an independent controller, Love in Room determines neither the purposes nor the means and has no access to the documents collected. The corresponding information is set out in Stripe's privacy policy: stripe.com/privacy.
9.3 Other recipients
Data may be disclosed to the competent administrative or judicial authorities, in the cases and in the manner provided for by law.
In the event of a transaction concerning Love in Room's business, data may be transferred to the acquirer, subject to compliance with this policy.
10. Transfers outside the European Union
Love in Room's main infrastructure is hosted in the European Union.
The use of certain providers — in particular Cloudflare, Inc. and Anthropic PBC, established in the United States — may involve access or transfers of data to third countries.
Such transfers are governed by the mechanisms provided for in Chapter V GDPR applicable to the provider concerned, as set out in the contract entered into with it. These mechanisms are specified by each provider in its own data protection documentation.
11. Retention periods — summary
| Data | Period |
|---|---|
| Technical and audience logs | 13 months |
| Traveller bookings | 13 months after the end of the stay |
| Host account | term of the contract, then 3 years after the last activity |
| Support and messaging | 3 years after the last exchange |
| Business prospecting | 3 years after the last contact |
| Evidence of newsletter consent | 3 years after withdrawal |
| Operational transaction identifiers | as long as needed for their purpose, then the applicable limitation periods |
| Identifier of a saved payment method | as long as needed for a payment or related operations |
| Audit log | 7 years |
| Accounting records and billing | 10 years |
| Information reported to the tax authorities | 10 years |
At the end of these periods, data is deleted or irreversibly anonymised.
12. Security
Love in Room implements appropriate technical and organisational measures: encryption of communications, secure hashing of passwords using a suitable derivation function, compartmentalised data access at database level, logging of sensitive operations, encrypted backups, and access limited to what is strictly necessary.
As no measure can guarantee absolute security, Love in Room undertakes to notify any data breach in accordance with Articles 33 and 34 GDPR.
13. Your rights
You have the rights of access, rectification, erasure, restriction and portability, as well as the right to object to processing based on legitimate interest and the right to withdraw your consent where processing is based on it.
You may also give directions as to what happens to your data after your death.
These rights may be exercised at [email protected]. A response is provided within one month, extendable by two months where the request is complex. Proof of identity may be requested in case of reasonable doubt.
These rights are exercised subject to statutory retention obligations, in particular accounting and tax obligations, which may prevent immediate erasure.
Complaint. You may lodge a complaint with the French data protection authority: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — cnil.fr.
14. Minors
The platform is not intended for persons under 18. No account may be created and no booking may be made by a minor.
If data relating to a minor were sent to us, it would be deleted without delay upon report to [email protected].
15. Changes
This policy may change. The applicable version is the one published on the platform. Any substantial change is brought to the attention of registered users.