Privacy policy

1. Data controller

The controller of personal data collected on the sentioo.app site is:
Sentioo SASU
2 Rue du commandeur, 75014 Paris, France
Email: contact@sentioo.app

2. Data collected

We collect the following data:

• Registration data: name, email address, password (hashed, never stored in plain text)
• Profile data: phone number, billing address
• Billing data: subscription status and Stripe customer identifier (payment card details are processed exclusively by Stripe and never stored by Sentioo)
• Guest data (on behalf of hosts): guest names, contact details and messages synced from your PMS, processed by Sentioo as a data processor to provide the service — you remain the controller of this data (see Terms of Use)
• Usage data: technical cookies necessary for the functioning of the site
• Optional audience measurement: anonymized, cookieless visit statistics, enabled only if you accept via the banner

3. Purposes of processing

• Account management and authentication
• Provision of the Sentioo service (guest messaging automation)
• Communication regarding your account
• Service improvement (if audience measurement is accepted)

4. Legal basis

• Performance of the contract: processing necessary for the provision of the service
• Consent: audience measurement (choice via the cookie banner)
• Legitimate interest: security and fraud prevention

5. Cookies

On your first visit, a banner lets you choose which cookies you accept. You can change your preferences at any time by clicking "Manage cookies" at the bottom of the page.

6. Retention period

• Account data: kept as long as the account is active; deleting the account (immediately or scheduled within 30 days from My Account) erases or anonymizes all associated data, with residual copies in technical logs purged within 90 days at most
• Guest data (bookings, messages): kept for the lifetime of the host's account to ensure service continuity, deleted with it (residual copies in technical logs purged within 90 days)
• Technical logs containing personal data (events, security, processing): automatically purged within 90 days at most; administrative audit logs, anonymized upon account deletion, are kept for traceability purposes
• Cookie data: 13 months maximum in accordance with CNIL recommendations

7. Your rights

In accordance with the GDPR, you have the following rights:

• Access: obtain a copy of your data
• Rectification: correct inaccurate data
• Erasure: request the deletion of your data
• Portability: receive your data in a structured format
• Objection: object to the processing of your data
• Restriction: restrict the processing of your data

To exercise these rights, contact us at contact@sentioo.app.

8. Hosting and sub-processors

• Site hosting: Vercel Inc. (United States) — data protected by Standard Contractual Clauses (SCC)
• Database: Supabase Inc. — data hosted in the European Union (AWS Frankfurt, Germany), encryption at rest and in transit
• Sentioo reply generation: OpenAI Ireland Ltd (Ireland) — guest message content is transmitted to generate replies; any transfers outside the EU to OpenAI, L.L.C. (United States) are governed by Standard Contractual Clauses, with no use for model training (API)
• Application processing: Hetzner Online GmbH (Germany/Finland) — servers running the Sentioo processing engine, hosted in the European Union
• Payments: Stripe Payments Europe Ltd (Ireland) — subscription and payment card processing
• Emails and SMS: Brevo (Sendinblue SAS, France) — transactional emails and notification SMS

9. Complaints

If you consider that the processing of your data does not comply with the regulations, you can submit a complaint to the CNIL.