This policy describes how Love in Room collects, uses and protects personal data, in accordance with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act.
1. Data controller
The data controller is Nicolas Lipowiez, sole proprietorship (French entreprise individuelle, micro-entrepreneur scheme), SIRET 803 893 809 00043. Full contact details appear in the legal notices.
Any request relating to your personal data can be sent to [email protected] or by mail to the registered office, addressed to the data protection officer.
2. Data collected
Visitors
- browsing data: pages viewed, visit duration (Umami first-party, no third-party cookies);
- technical data: IP address (via Cloudflare, anonymised for stats), user-agent, language;
- no direct personal data is required to browse the Site.
Registered hosts
- email, name, password (hashed with argon2id, never stored in clear text);
- billing information: company name, address, VAT number, processed by Stripe;
- for hosts who have enabled online booking: identity, bank details (IBAN) and tax status (tax ID / SIRET) collected by Stripe during the identity verification (“KYC”) of their Stripe Connect account, required for transfers and for our annual DAC7 reporting obligation;
- login history and audit log of sensitive actions.
Travellers (online booking)
- identity and contact details provided when booking (first name, last name, email, phone), with no account creation (“guest checkout”);
- booking details and history (dates, amount, status) and timestamped proof of acceptance of the General Booking Terms;
- IP address and user-agent at the time of booking (fraud prevention);
- payment token: the card is stored by Stripe in tokenised form, never by Love in Room.
For hosts who have enabled booking, identity data, IBAN and tax status are collected by Stripe during the verification of their Stripe Connect account, required for transfers and for our annual DAC7 reporting obligation (an annual summary of income collected through the platform is provided to each host and to the tax authorities).
3. Hosts listed without registration
Love in Room collects and publishes data about professional hosts from public sources (official websites, commercial listings accessible to the public). These hosts are not required to have a Love in Room account in order to appear in the directory.
The legal basis for this processing is Love in Room's legitimate interest, namely building an editorial directory of added value for travellers, balanced against the rights of the data subjects.
The data processed relates to the establishment's business activity: trade name, address, amenities, photos and descriptions taken from the public sources consulted, together with the contact details published by the establishment (email, phone). Those contact details are used solely to reach the operator about their listing: they are not displayed publicly on the Site. No banking data is collected.
Any host has a right to object within the meaning of article 21 of the GDPR. The removal request is processed within 72 hours maximum, with no justification required. The form is accessible from every listing and every email sent by Love in Room.
4. Purposes of processing
- provide and maintain the directory and partner area;
- bill subscriptions and manage the contractual relationship;
- secure accounts (authentication, fraud prevention);
- measure audience in an anonymised way (Umami, no tracking cookie);
- enable online booking and facilitate payment for the stay (guest-host matchmaking, collection via Stripe, handling of cancellations and disputes);
- comply with our legal and accounting obligations (invoicing, retention, annual DAC7 tax reporting);
- produce and publish promotional content for the accommodations listed in the directory on our social media accounts (photo edits, short videos, animated slideshows), produced with the help of creative tools, some of which rely on artificial intelligence;
- send occasional communications (newsletter, with explicit consent only).
5. Legal bases
- contract performance for host account and subscriptions;
- legitimate interest for anonymous audience measurement and service security;
- legitimate interest, balanced against the rights of the data subjects, for the publication of an editorial directory based on public data of professional hosts;
- performance of the contract (and pre-contractual steps) for booking and payment of the stay;
- legal obligation for invoicing, accounting retention and DAC7 reporting;
- contract performance and legitimate interest (promotion of the directory and of our partners' accommodations) for promotional content published on our social media, hosts being able to object at any time;
- explicit consent for the newsletter and non-essential cookies.
6. Retention period
- account data: throughout the contract, then 3 years after the last activity;
- audit log: 7 years (legal traceability obligation);
- billing data and issued invoices: 10 years (accounting obligation, article L. 123-22 of the French Commercial Code);
- payment data (card): not retained by Love in Room (subprocessing by Stripe);
- traveller booking data (identity, contact details, IP): 13 months after the stay, then deletion or anonymisation — except items attached to an invoice or to DAC7 reporting, kept for 10 years for accounting and tax obligations;
- Umami audience measurement: no cookie; server logs retained for at most 13 months as anonymous aggregates.
The audit log (7 years) does not cover billing data. The latter is retained for a longer period for tax and legal reasons (article L. 123-22 of the French Commercial Code).
7. Subprocessors and recipients
Love in Room relies on technical subprocessors, selected for their GDPR compliance:
- Stripe (Ireland/EU): subscription payments and invoicing; for online booking, collection of the traveller’s payment and transfer to the host via Stripe Connect (Stripe acting as a payment institution) and host identity verification (KYC: identity, IBAN, tax status);
- OVH (France): server hosting;
- Cloudflare (EU): CDN, security and bot protection;
- Providers of content creation tools, some of which rely on artificial intelligence (European Union or United States depending on the tool used, which may change): production of the promotional visuals and videos published on our social media, from the listing's photographs, description, trade name and city, excluding any personal contact details of a host or a traveller. Transfers outside the EU are covered by standard contractual clauses, and the list of tools actually in use is available on request from the contact given in section 1;
- Umami (self-hosted on our own servers): first-party analytics, no tracking cookie nor transfer outside the EU, exempt from consent under CNIL deliberation no. 2020-091.
Access by our team. Authorised members of our team may access your partner area, in read-only mode, to diagnose a malfunction or answer a support request. This access is time-limited, allows no change to your account, and every session is recorded in our audit log together with the identity of the person concerned. You may request the history at [email protected].
8. Your rights
Under the GDPR, you have the following rights:
- right of access to your data;
- right of rectification;
- right of erasure (“right to be forgotten”);
- right to data portability;
- right to object to processing;
- right to restriction of processing.
To exercise a right, write to [email protected]. A response will be provided within 30 days maximum, in accordance with article 12 of the GDPR.
9. Profiling and automated decision-making
Love in Room implements no automated decision producing significant legal effects within the meaning of article 22 of the GDPR. Important decisions (validation of a host account, handling of a removal request, moderation of a report) are always made or validated by a human.
Part of the descriptions displayed on listings not yet claimed is generated by an artificial intelligence model, from public information. This generation does not involve any personal data; it is limited to rephrasing the public characteristics of a professional accommodation and is reviewed by a human before publication.
The promotional visuals and videos published on our social media may likewise be produced with the help of creative tools relying on artificial intelligence, from the material of a registered host's listing. Each publication is approved by a team member before release and, where it includes images generated by artificial intelligence, discloses that use. This processing produces no legal effect, and hosts may object at any time under article 12 of the Terms of Sale.
10. Minors
The Site is not intended for minors. No processing is intentionally directed at a person under 15, the age limit of digital consent in France within the meaning of article 8 of the GDPR.
If a parent or legal guardian notices that a minor has provided their personal data (creation of a host account, for instance), they may request its immediate deletion at [email protected]. The request is processed within 72 hours.
11. Listing removal
Any request to remove a listing (host listed without consent, erroneous data, etc.) is handled within 72 hours maximum, in line with our commitment and article 14 of the GDPR. The removal form is accessible from every listing and every email sent by Love in Room.
12. Transfers outside the EU
No systematic transfer of data outside the European Union takes place. When a subprocessor may operate outside the EU, the transfer is covered by the standard contractual clauses adopted by the European Commission.
13. Security
Love in Room implements appropriate technical and organisational measures: TLS encryption across the Site, argon2id password hashing, audit log of sensitive actions, encrypted backups, restricted access to databases.
14. Cookies
Cookie usage is detailed in our cookies policy.
15. Complaint to the CNIL
If you believe your rights are not respected, you may lodge a complaint with the French Data Protection Authority (CNIL), 3 place de Fontenoy, 75007 Paris, cnil.fr.