Privacy Policy
Version dated October 20, 2026
Controller, processor and contact
SYNSETIO, 6 RUE D'ARMAILLE, 75017 PARIS, France, contact@odybook.com, determines the purposes of its own processing: professional accounts, subscription, billing, security, support and business relationship.
For bookings, participants, messages and data collected for an agency or guide, that professional determines the purposes. SYNSETIO then acts as processor on documented instructions.
Data, sources and mandatory fields
Account data comes from the professional or its organization: identity, email, role, settings, company and billing data. Required fields are necessary for the account, contract, security or invoice; branding fields, content and integrations are optional unless needed by an enabled service.
Traveller data comes from the traveller, the professional or a person booking for a group: identity, contact details, dates, participants, messages, preferences and needs shared. Data needed for a booking is distinguished from optional information. It also includes the optional answer to "How did you hear about us?" and, only if the traveller accepts "Booking source" in the storefront's cookie choices, or audience measurement in the booking page's cookie choices, how the traveller found the professional: the campaign tags of the link followed (UTM parameters), the referring website and the first page visited. The professional uses this, on the basis of that consent, to see which channels bring bookings; without consent none of it is read.
Technical data comes from use of the service: logs, device, browser, errors, security signals, cookie choices and application events.
Purposes and legal bases
- Professional account and subscription: contract with an individual customer; legitimate interest to manage representatives, employees or collaborators of a customer organization.
- SYNSETIO billing: contract and legal accounting or tax duties.
- Traveller bookings and messages: instructions from the professional controller; contract or other basis defined by that professional towards the traveller.
- Support, security, abuse prevention and contractual proof: legitimate interest, contract or legal duty depending on context.
- Prospecting: consent where required; legitimate interest for certain relevant B2B communications, with simple objection.
- Non-exempt analytics or advertising cookies: prior and revocable consent.
Recipients and supplier roles
Data may be processed by Vercel for hosting, Supabase for application data, Stripe as payment provider that may also act as independent controller for regulatory duties, Resend for email, Upstash/Redis for technical functions, Functional Software Inc. / Sentry GmbH for technical error tracking and application stability (data hosted in the European Union), Google Calendar if connected by the customer, OpenAI for AI assistance features, Cloudflare for encrypted database backups (prepared on GitHub's job runners), and analytics tools only if enabled.
SYNSETIO does not sell personal data to advertising networks. Hosting locations are listed in the next section.
Where data is hosted
Locations below were checked in production on October 8, 2026.
- Application: Vercel, Paris region (France).
- Request routing and static files: Vercel's global network. Your IP address, the requested address and technical request headers are handled at a Vercel location, usually the one nearest to you; it can be outside the European Economic Area, in particular when you browse from outside it. On account pages (sign-in, registration, dashboard and administration), that location also checks your session with the database, so your account identifier and email address pass through it briefly without being stored there.
- Database, authentication and stored files: Supabase, Frankfurt (Germany).
- Temporary sign-in codes, cache and abuse limits: Upstash, Frankfurt (Germany).
- Transactional email: Resend, sent from its Ireland region.
- Error monitoring: Sentry, data hosted in Germany.
- Technical logs: Vercel, whose main processing facilities are in the United States.
- Payments: Stripe Payments Europe Ltd (Ireland); Stripe may also process data in the United States.
- Database backups: prepared on GitHub job runners (GitHub, Inc., United States), then encrypted and stored on Cloudflare R2.
- AI assistance, when used: OpenAI (United States). Google Calendar, if connected: Google (United States).
International transfers
Most of these suppliers belong to groups based outside the European Economic Area, mainly in the United States, so data hosted in the European Union may still be accessed from outside it, for example for support, security or legal requests. Safeguards: Vercel is certified under the EU-U.S. Data Privacy Framework and its data processing addendum includes the European Commission standard contractual clauses; Supabase Pte. Ltd (Singapore) relies on the standard contractual clauses; Sentry relies on the Data Privacy Framework and the standard contractual clauses; other suppliers rely on an adequacy decision or the standard contractual clauses under their data processing terms, with supplementary measures when necessary. Contact contact@odybook.com for recipients and countries applicable to your use and a copy of safeguards; third-party rights may require redactions.
Retention periods
- Professional account: account term, then a reasonable exit period for export, closure and proof, unless legal archive or dispute applies.
- Invoices and accounting records: 10 years from the close of the relevant financial year.
- Contractual proofs, acceptances, incidents and receivables: period needed for performance, proof and legal defence under applicable limitation periods.
- Prospecting: at most three years after collection or the last contact initiated by the prospect, unless withdrawal or objection occurs earlier. A minimal suppression list may be retained to prevent further solicitation.
- Technical logs and backups: periods limited by security, diagnostics, continuity and documented technical cycles.
- Error and performance reports (Sentry): 30 days, then deleted automatically.
- Unfinished bookings (drafts): 30 days after the last change.
- Waitlist entries: 90 days after the requested date.
- Product usage statistics and AI usage metering: 25 months. AI prompts and answers are not kept.
- Storefront visit statistics (daily totals per page, device type and country, without visitor identifiers or traffic sources): 25 months.
- Booking source (campaign tags of the link followed, referring website and first page visited): 25 months after the booking, then removed. The answer to "How did you hear about us?" stays with the booking. Erasing a traveller's data removes both.
- Guide Companion app notifications: 90 days.
- Team permission audit trail: 2 years.
- Contact requests: 3 years after the last exchange.
Individual rights
Individuals may request access, rectification, erasure, restriction, objection, portability or withdrawal when these rights apply. Requests go to contact@odybook.com; when they concern a professional seller, SYNSETIO may forward or assist that professional.
SYNSETIO responds within one month. For complex or numerous requests, a reasoned extension of up to two months is notified within the first month. A complaint may be filed with the CNIL: https://www.cnil.fr/.