Privacy policy

What we collect, why, and for how long.

1. Data controller

CHIC RENTALS SAS, 540 avenue Henri Barbusse, 06220 Vallauris, France

Privacy contact: support@chicstays.fr. Telephone: +33 6 09 87 58 47.

2. Bookings

Data
Name, email, phone, stay dates, party size, payment status, and identity details required for guest registration.
Purpose
Taking and performing the booking, payment, check-in and accounting.
Legal basis
Contract; legal obligation (accounting, guest police registration).
Retention
Accounting documents: 10 years. Guest identity documents for police registration: deleted at the end of the applicable legal retention period. We do not state a number of months here because we have not verified it.

3. Contact form

Data
Name, email, subject and message.
Purpose
Answering your enquiry.
Legal basis
Our legitimate interest in answering enquiries, or pre-contractual steps at your request.
Retention
3 years after the last contact.

4. Owner enquiries and estimates

Data
Contact details, property details and message you provide.
Purpose
Preparing an estimate or management proposal.
Legal basis
Pre-contractual steps at your request.
Retention
3 years after the last contact.

5. Newsletter

Purpose: sending news and offers you asked for, through Brevo where that service is active. Legal basis: your consent, withdrawable at any time. Retention criteria: until you unsubscribe or withdraw consent, or until 3 years after your last interaction with us, whichever comes first. This site has no signup form at the time of writing; the operational status of the newsletter tool is not verified here and is stated only when a form is offered.

6. Chat and messaging

Messages you send through the chat launcher or messaging channels are used to answer you. Purpose: answering your question and handling any resulting booking. Legal basis: our legitimate interest in answering visitors, or pre-contractual steps and contract performance when you book. Retention criteria: while the request or booking is being handled and until 3 years after the last contact, unless a longer legal period applies (for example accounting documents for a booking); earlier on a valid request. What the chat provider itself stores is governed by its own policy and is not verified here. Automated replies, where used, may be handled by HostBuddy.

7. Providers and international transfers

We use the providers below. Not every provider is active at all times: each applies only when its service is switched on for the feature you use (for example Clarity only after consent and configuration, Brevo only if a newsletter is sent, Resend only when an email is attempted). Statements come from each provider's own public documents, checked on 1 October 2026; they do not describe the configuration of our specific accounts.

  • Guesty — Property management and booking records

    Processes data in the United States, Israel and other countries; relies on Standard Contractual Clauses or other recognised mechanisms, and on the EU-US Data Privacy Framework where applicable.

    Source: Guesty

  • Stripe — Card payments

    Providers mostly in the EU, United States and India; adequacy decisions and contractual safeguards including Standard Contractual Clauses.

    Source: Stripe

  • Formspree — Contact and owner enquiry forms

    Processes data in the United States and other countries and says transfers outside Europe happen only where legally permitted with appropriate protections. We have not verified the exact mechanism for our account.

    Source: Formspree

  • HostBuddy — Guest messaging assistant

    Its data processing agreement says guest data is generally stored and processed in the United States and that it participates in the EU-US Data Privacy Framework. We do not claim Standard Contractual Clauses for this provider.

    Source: HostBuddy

  • Replit — Website hosting

    US-based; its data processing addendum incorporates EU Standard Contractual Clauses. The exact hosting region of this site is not established by its public documents.

    Source: Replit

  • Brevo — Email and newsletter service, where used

    Operates in the EU and United States; its US entity states it is certified to the EU-US Data Privacy Framework.

    Source: Brevo

  • Resend — Transactional email attempts (owner estimate support and acknowledgement messages)

    Stores data in the United States. Its data processing agreement incorporates EU Standard Contractual Clauses, and the provider states it is certified to the EU-US Data Privacy Framework. Delivery has not been confirmed in every test; we describe only emails actually attempted.

    Source: Resend

  • Microsoft Clarity — Session analytics, only if enabled and accepted

    Not active unless a project is configured and you accept analytics. Data is stored in Microsoft Azure in the United States; Microsoft Ireland has Standard Contractual Clauses with Microsoft Corporation.

    Source: Microsoft Clarity

  • Google Search Console — Search performance statistics, where configured

    Receives search-performance data from Google, not data entered in our forms. We have not verified a transfer mechanism and do not claim one.

    Source: Google Search Console

  • Google Maps — Contact-page embedded map, only after you request it

    When you choose to load the map, Google receives the map request and technical information such as your IP address and browser or device details. Google's privacy policy applies. We have not verified the exact configuration or transfer mechanism for this map.

    Source: Google Maps

8. Your rights

Write to support@chicstays.fr to exercise these rights. You may also lodge a complaint with the CNIL.

  • Access
  • Rectification
  • Erasure
  • Restriction
  • Objection
  • Portability

CNIL

9. Cookies

Cookie policyLegal notice

Last updated: