Privacy policy

1. Data controller

The controller of personal data collected on the sentioo.app site is:
Custodis Tech
2 Rue du commandeur, 75014 Paris, France
Email: contact@sentioo.app

2. Data collected

We collect the following data:

• Registration data: name, email address, password (hashed, never stored in plain text)
• Profile data: phone number, billing address
• Billing data: subscription status and Stripe customer identifier (payment card details are processed exclusively by Stripe and never stored by Sentioo)
• Guest data (on behalf of hosts): guest names, contact details and messages synced from your PMS, processed by Sentioo as a data processor to provide the service: you remain the controller of this data (see Terms of Use)
• Usage data: technical cookies necessary for the functioning of the site
• Optional audience measurement: site and app usage statistics (page views, clicks, journeys) collected through PostHog. Before you choose: no cookie and no storage on your device. After you accept: a measurement identifier is kept in your browser

3. Purposes of processing

• Account management and authentication
• Provision of the Sentioo service (guest messaging automation)
• Communication regarding your account
• Service improvement and audience measurement (only if you accept)

4. Legal basis

• Performance of the contract: processing necessary for the provision of the service
• Consent: audience measurement on the website (choice via the cookie banner)
• Legitimate interest: security, fraud prevention, and audience measurement in the mobile app, where no cookie is used and an opt-out setting is available in the Account screen

5. Cookies

On your first visit, a banner lets you choose which cookies you accept. You can change your preferences at any time by clicking "Manage cookies" at the bottom of the page.

6. Retention period

• Account data: kept as long as the account is active; deleting the account (immediately or scheduled within 30 days from My Account) erases or anonymizes all associated data, with residual copies in technical logs purged within 90 days at most
• Guest data (bookings, messages): kept for the lifetime of the host's account to ensure service continuity, deleted with it (residual copies in technical logs purged within 90 days)
• Technical logs containing personal data (events, security, processing): automatically purged within 90 days at most; administrative audit logs, anonymized upon account deletion, are kept for traceability purposes
• Cookie data: 13 months maximum in accordance with CNIL recommendations

7. Your rights

In accordance with the GDPR, you have the following rights:

• Access: obtain a copy of your data
• Rectification: correct inaccurate data
• Erasure: request the deletion of your data
• Portability: receive your data in a structured format
• Objection: object to the processing of your data
• Restriction: restrict the processing of your data

To exercise these rights, contact us at contact@sentioo.app.

8. Hosting and sub-processors

• Site hosting: Vercel Inc. (United States): data protected by Standard Contractual Clauses (SCC)
• Database: Supabase Inc.: data hosted in the European Union (AWS Frankfurt, Germany), encryption at rest and in transit
• Sentioo reply generation: OpenAI Ireland Ltd (Ireland): guest message content is transmitted to generate replies; any transfers outside the EU to OpenAI, L.L.C. (United States) are governed by Standard Contractual Clauses, with no use for model training (API)
• Application processing: Hetzner Online GmbH (Germany/Finland): servers running the Sentioo processing engine, hosted in the European Union
• Payments: Stripe Payments Europe Ltd (Ireland): subscription and payment card processing
• Emails and SMS: Brevo (Sendinblue SAS, France): transactional emails and notification SMS
• Audience measurement: PostHog Inc.: data processed and hosted in the European Union (EU region, Frankfurt). No guest messaging data is sent there, and session recording is disabled on every page that displays guest data

9. Complaints

If you consider that the processing of your data does not comply with the regulations, you can submit a complaint to the CNIL.