Legal information

What we know about you

What data we collect, why, and how you stay in control.

Privacy Policy

Last updated: March 2026

This is a translation of French legal documents provided for information purposes. The French version is the legally binding version.

1. Data Controller

The controller of your personal data is StayTogether SASU, 2 Places d'Armes, 33500 Le Tourne, France. For any questions relating to the protection of your data, you can contact our Data Protection Officer (DPO) at: privacy@stay-together.fr

2. Data Collected

Identification data: first name, last name, email address, provided upon registration or via OAuth.
Connection data: IP address, access logs, browsing and platform usage data.
Transactional data: booking history, amounts, dates. Banking data is processed exclusively by Stripe (PCI-DSS level 1 certified) and is never stored on our servers.
Communications: messages exchanged via the platform's integrated messaging system.
Listing data: descriptions, photos, availability and rates published by owners.

3. Processing Purposes

Managing user accounts and secure authentication.
Connecting owners and guests.
Processing and tracking bookings and payments.
Sending transactional communications (confirmations, reminders, notifications).
Improving the platform and analysing usage.
Compliance with legal obligations (accounting, fraud prevention, responding to judicial requisitions).

4. Legal Basis

The processing of your data is based on the following legal bases: performance of a contract (for managing your account and bookings), your consent (for marketing communications, collected separately), our legitimate interest (for platform security and service improvement) and our legal obligations (for accounting, fraud prevention and retention of billing data).

5. Retention Period

Your account data is retained for the duration of your contractual relationship with StayTogether. Transactional data is retained for 10 years in accordance with legal accounting obligations. Connection data (logs) is retained for 12 months. Upon expiry of these periods, your data is deleted or anonymised.

6. Your GDPR Rights

In accordance with the General Data Protection Regulation (GDPR), you have the following rights:

Right of access: obtain a copy of the personal data relating to you.
Right to rectification: correct inaccurate or incomplete data.
Right to erasure: request the deletion of your data (subject to legal retention obligations).
Right to portability: receive your data in a structured, readable format.
Right to object: object to the processing of your data for legitimate reasons.
Right to restriction: restrict the processing of your data in certain circumstances.

To exercise your rights, contact our DPO at privacy@stay-together.fr. You also have the right to lodge a complaint with the CNIL (www.cnil.fr).

7. Cookies

The platform uses several types of cookies, detailed below.

Strictly necessary cookies

authjs.session-token: user session JWT, deleted upon logout.
st_known_user: stores the first name and masked email to personalise the welcome experience, retained for 1 year including after logout.
oauth_pending_role: used during Google or Facebook login to remember the chosen role, expires after 10 minutes.

Audience measurement cookies (subject to consent)

Google Analytics 4: audience measurement and browsing behaviour analysis. These cookies are only placed after acceptance of the consent banner.

Third-party cookies related to integrated services

Stripe: cookies placed on stripe.com during payment, used for transaction security. No banking data is stored on our servers.
Google / Facebook OAuth: cookies placed on Google and Facebook domains during the OAuth authentication flow.

You can manage or delete cookies via your browser settings. Disabling strictly necessary cookies may cause the platform to function incorrectly.

8. DPO Contact

Data Protection Officer — StayTogether SASU. For any questions relating to the protection of your personal data: privacy@stay-together.fr