Privacy Policy

• Who: Antton Liebaud, a French sole trader trading as BonVoyageur, in Paris. Contact: contact@bonvoyageur.fr.
• What: your account, your itineraries, your purchases and, only if you accept it, the measurement of your browsing.
• Without your agreement: anonymous statistics only, with no identifier and nothing stored on your device.
• Where: in Europe (database in Paris, measurement in Frankfurt, e-mails sent from Ireland). The application is served by Vercel, certified for transfers to the United States.
• Changing your mind: at any time, with the control in the "Your rights" section below or in your account.

The data controller is Antton Liebaud, a French sole trader (entrepreneur individuel, EI), trading as BonVoyageur.

• Address: 1 rue Marguerin, 75014 Paris, France.
• Contact for any question about your data: contact@bonvoyageur.fr.
• No data protection officer is appointed, the activity does not require one. The address above fills that role.

The publisher's full identity is given in the legal notice.

Data you give us:

• Account: e-mail address and password (hashed, unreadable). Required to create an account.
• Without an account: the service opens an anonymous session, with no e-mail or password, and saves your trip under that identifier, within the limits of the free plan. If you create an account later, the trip is attached to it.
• Sign-in with Google: we receive from Google your e-mail address, your name and your profile picture. Google handles that sign-in under its own privacy policy.
• Nationality: given for each trip, required for visa information. Saving it in your profile is optional. The contribution of your itineraries to route patterns is on by default, and you can object to it at any time (see the purposes).
• Itineraries: countries, dates, durations, configuration preferences. An itinerary you publish to the gallery becomes visible to other users, at your initiative.
• Support: the content of your e-mails to contact@bonvoyageur.fr.

Measurement data, only with your agreement (banner on your first visit, changeable at any time):

• Pages visited, clicks and interactions, actions taken in the application, through a service hosted in Europe (PostHog EU).
• For registered users, a few profile properties: nationality, plan and where it came from, language, number of optimised itineraries, sign-up date, choice to contribute data, where the visit in which you accepted measurement came from (referring site, ad campaign if any), and an internal-account marker for the service team.
• A recording of your browsing session (session replay) to diagnose issues. Typed fields and personal data on screen are masked in it.
• Your answers to the questionnaires shown in the application (feedback, post-trip survey), as free text. Do not write personal data in them.

Without agreement, or after a refusal: only anonymous statistics are produced (visits, pages, clicks and interaction areas, rendering performance, technical errors), with no identifier and nothing stored on your device, and never a session recording or a questionnaire.

Purchase data: see the "Payment and purchases" section.

Your data is used to:

• Provide the service: authentication, saving and retrieving your itineraries, visa information based on your nationality.
• Write to you when the service requires it: sign-up confirmation, password reset, e-mail address or password change, purchase confirmation, reminder before a paid access ends. No newsletter, no marketing.
• Improve suggested durations: unless you object, your itineraries are aggregated with those of other travelers into anonymous route patterns (countries, order, typical durations). No individual itinerary is exposed or identifiable in those patterns.
• Measure audience and usage, if you accepted it: understand journeys, what is used and what blocks, to improve the algorithm and the interface. Diagnose an issue by replaying a session. Collect your feedback through the questionnaires.
• Monitor technical errors and secure the service.
• Answer your support requests and the exercise of your rights.

No data is used for advertising or commercial purposes, nor transferred to third parties for such purposes. No decision with legal effects on you is taken automatically: the itineraries proposed are suggestions you remain free to change.

• Performance of the contract: account data, itineraries, e-mails required by the service, purchases and the access they open.
• Consent: audience measurement, journey analysis, session recording and questionnaires. It is given on the banner on your first visit, on each device. You can withdraw it at any time ("Your rights" section), without affecting the lawfulness of past processing.
• Legitimate interest: the aggregation of your itineraries into anonymous route patterns that improve suggested durations, which you can object to at any time ("Your rights" section), server-side technical logs (connections, errors) for the security and stability of the service, and the anonymous measurement of visits, clicks and errors when you have not accepted measurement, which uses no identifier and nothing stored on your device.
• Legal obligation: accounting retention of purchases.

Voyageur access is bought from Creem (Armitage Labs OÜ, Estonia), our payment partner, acting as the legal seller (merchant of record). Your card details never pass through our servers and are never stored by us: they are entered on the payment page hosted by Creem, which processes them as an independent controller under its own terms, and which issues the invoice.

What we receive and keep on our side: your buyer e-mail address, the order identifier, the product bought, the amount, the currency, any discount code, the reference of the affiliate partner Creem credited if any, and the date.

Legal basis: performance of the contract for the purchase and the access it opens, legal obligation for accounting retention.

If you accepted audience measurement, the purchase is also counted there (product and amount, never your card details), so that we can tell which channel produced a sale.

If you delete your account, the purchase row is kept without any link to you, for the period accounting and tax obligations require.

Your data is never sold or handed over. It is processed by providers acting on our behalf (processors) or, for two of them, under their own responsibility:

• Supabase: database and authentication, on Amazon Web Services infrastructure in Paris (eu-west-3).
• Cloudflare, Inc. (United States): storage of the encrypted database backups, in a space restricted to the European Union jurisdiction, kept for 30 days. Cloudflare does not hold the decryption key.
• PostHog Inc.: audience measurement, session recording and questionnaires under consent, error monitoring without identification. European instance hosted by Hetzner in Frankfurt, data processing agreement signed.
• Vercel Inc. (United States): hosting of the application. Its servers may process connection metadata outside the European Union. Vercel is certified under the EU-US Data Privacy Framework, and the European Commission's standard contractual clauses apply.
• Resend (Plus Five Five, Inc., United States): sending of our e-mails, from its European region (Ireland). It processes your address and the content of the e-mails we send you. Data processing agreement in force.
• Hookdeck (Hookdeck Technologies Inc., Canada, a country recognised as adequate by the European Commission): relay of our payment notifications and of the requests to send your account e-mails (sign-up confirmation, password, change of address). It sees the order identifier, your e-mail address and the link of the requested e-mail in transit, for the time of delivery and of any replay. Data processing agreement in force.
• Creem (Armitage Labs OÜ, Estonia): legal seller of paid access, independent controller for payment and invoicing.
• Google: if you choose to sign in with Google, independent controller for that sign-in.

Beyond these providers, your data is passed to no one, unless the law requires it.

• Account and itineraries: for as long as your account is active. You can delete it at any time from your settings. Deletion is immediate and, at the latest, effective within 30 days.
• Database backups: encrypted, kept for 30 days, then deleted. A deleted account disappears from backups within that period.
• Anonymous sessions: trips created without an account are linked to no identity (no e-mail, no name). They are kept as long as they are neither attached to an account nor deleted.
• Purchases: ten years from the purchase, an accounting obligation (article L123-22 of the French Commercial Code). After account deletion, the purchase row is kept without any link to you.
• Audience measurement, questionnaire answers included: at most twelve months in the measurement service.
• Session recordings: at most thirty days.
• Your answer to the banner: until you change it, or until a new version of this text, which asks you again. The measurement cookie set after acceptance lasts at most 365 days.
• Technical logs (servers, database): short periods set by our hosts, from a few hours to a few days.
• Support e-mails: for the time needed to handle your request, then at most one year.

Without your agreement, no measurement cookie or storage is used. Only your answer to the banner is remembered (key "__bv_consent_v1" in local storage), strictly so that we do not ask again. Your browser's Do Not Track or Global Privacy Control signal is honoured and counts as a refusal.

After acceptance, PostHog sets a cookie ("ph_…_posthog", at most 365 days) and uses your browser's local storage to recognise your device between visits and to allow session recording. Withdrawing your agreement removes them.

The service also uses your browser for its own operation, with no measurement purpose:

• a language cookie ("NEXT_LOCALE"), which remembers the French or English version of the site, cleared when the browser closes.
• your sign-in session (local storage, cleared when you sign out). No authentication cookie is set.
• the identifier of the last account signed in on the device (local storage), to clear another account's cached data on a shared device.
• the display theme you chose.
• the trip being drafted, the purchase in progress, the promo code entered and the intent of a Google sign-in, for the time of your visit.
• a cache of your own data, so that the application works offline and between reloads.

No third-party or advertising cookies are used.

Under the GDPR and the French Data Protection Act, you have the following rights:

• Access: obtain a copy of your data.
• Rectification: update your information in your account settings, or on request.
• Erasure: delete your account directly in the application, or on request.
• Portability: receive your itineraries in a structured, commonly used format.
• Objection and restriction: object to processing based on legitimate interest, or ask for it to be restricted, on grounds relating to your situation.
• Withdrawal of your agreement to audience measurement and session recording: with the control below, available to everyone, or in your account. That choice applies to the device it is made on. You can object to the data contribution at any time, without giving a reason, through the "contribute data" setting of your account, or on request if you use the service without an account.
• Post-mortem directives: decide what happens to your data after your death (article 85 of the French Data Protection Act).

To exercise these rights: contact@bonvoyageur.fr. We answer within one month. You may also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).

Communications between your browser and the service are encrypted (HTTPS/TLS). Passwords are hashed and never stored in plain text. Data access is controlled by database-level security policies (Row Level Security).

In the event of a data breach likely to affect your rights, you will be notified within the timelines the GDPR sets.

To exercise your rights or for any question about your personal data: contact@bonvoyageur.fr. We answer within one month at most.

If your request is not resolved, you may contact the French data protection authority (CNIL): Commission Nationale de l'Informatique et des Libertés, 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.