Privacy Policy

1. Data controller

Synerova
Email: info@capdirect.io
Responsible: Arnaud Cardinal
This policy applies to the capdirect.fr website and to the CapDirect and Livret Numérique iPhone apps.

2. Data collected

We collect the following data:

• Registration data : last name, first name, email address, password (hashed)
• Profile data : phone number (optional)
• Property data : name, address, description, photos, rates
• Booking data : traveler name, dates, email, phone
• Technical data : IP address, browser type, pages visited
• Mobile app data : messages exchanged between hosts and travelers, reviews, photos selected from your photo library, welcome booklet content
• Notifications : your device's notification token, only if you allow notifications
• Camera : used only to scan a welcome booklet QR code, no image is stored or sent
• Livret Numérique app subscriptions : subscription status and renewal date, without any bank details (payment processed by Apple)

3. Processing purposes

• Creation and management of your user account
• Provision of the direct booking service
• Sending transactional emails (welcome, booking confirmation)
• Service improvement and usage statistics
• Customer support
• Sending push notifications (new request, booking confirmed, new message)
• Management of Livret Numérique app subscriptions

4. Legal basis

The processing of your data is based on:

• Contract execution : provision of the CapDirect service
• Consent : for marketing communications (if applicable)
• Legitimate interest : service improvement, security

5. Data sharing

Your data is never sold. It is only shared with:

• Supabase (database hosting, EU servers)
• Vercel (website hosting)
• Resend (transactional email sending)
• Stripe (secure payment, if paid subscription)
• Crisp (online support chat)
• Apple (payment and management of subscriptions purchased in the Livret Numérique app)
• Expo (delivery of push notifications to the mobile apps)

6. Hosting and security

Data is hosted in the European Union (Supabase — AWS eu-west infrastructure). Communications are encrypted via HTTPS/TLS. Passwords are hashed (bcrypt).

7. Retention period

• Account data : kept as long as the account is active, deleted within 30 days after account deletion
• Booking data : kept for 3 years (accounting obligations)
• Technical logs : 12 months maximum
• Notification token : deleted when you sign out of the app or delete your account
• Subscription data : kept as long as the account is active

8. Cookies

CapDirect uses cookies for:

• Essential cookies : authentication, language preferences (necessary for operation)
• Analytics cookies : anonymized visit statistics
• Third-party cookies : Crisp (support chat)

You can manage your preferences via the cookie banner displayed during your first visit.

9. Your rights (GDPR)

In accordance with GDPR, you have the following rights:

• Right of access : obtain a copy of your data
• Right of rectification : correct your inaccurate data
• Right of deletion : request the erasure of your data
• Right to portability : retrieve your data in a standard format
• Right to object : object to the processing of your data
• Right to withdraw consent : at any time
• Account deletion from the apps : Menu or Account, then “Supprimer mon compte”

To exercise these rights: info@capdirect.io

You can also file a complaint with the CNIL: CNIL : www.cnil.fr

10. Modifications

This policy may be modified at any time. Users will be informed of any significant change by email or notification on the platform.