Odybook.

Privacy Policy

Last updated: February 6, 2026

1. Introduction

Odybook ("we," "our," or "us") is committed to protecting your privacy and personal data. This Privacy Policy explains how we collect, use, store, and protect your personal information when you use our booking management platform.

This policy applies to all users of our platform, including tourism professionals (Agencies and Guides) and their customers who interact with our booking widgets. We process data according to the General Data Protection Regulation (GDPR).

By using our services, you acknowledge the collection and use of your data as described here. Odybook acts as a Data Controller for our customers (professionals) and a Data Processor for their clients' booking data.

2. Data Controller

The entity responsible for your personal data is:

Odybook SAS
[INSERT_COMPANY_ADDRESS], Paris, France
Email: privacy@odybook.com
Phone: [INSERT_PHONE_NUMBER]

For any privacy-related inquiries, please contact our Data Protection Officer at dpo@odybook.com.

3. Data We Collect

We collect and process the following categories of personal data:

3.1 Professional Account Information

  • Full name and professional credentials
  • Business email address and phone number
  • Company name, address, and VAT information
  • Profile images and branding assets

3.2 Booking and Customer Information

  • End-customer names and contact details
  • Reservation dates, participant counts, and preferences
  • Notes on dietary requirements or accessibility (if provided)
  • Gift card issuance and redemption history
  • Communication history between professional and client

3.3 Payment Information

All payment processing is handled by Stripe. We do not store full credit card numbers. We retain:

  • Transaction IDs and billing history
  • Subscription status and plan details
  • Payout bank account details (for professionals)

3.4 Technical and Usage Data

  • IP addresses, browser types, and device identifiers
  • Navigation paths and platform interaction metrics
  • Referral sources and session durations
  • Cookie identifiers and tracking data

4. Legal Basis for Processing

We process personal data based strictly on the following lawful grounds under GDPR Article 6:

  • Contractual Necessity (Art. 6(1)(b)): To execute booking reservations, confirmations, customer messaging, and subscription management.
  • Legal Compliance (Art. 6(1)(c)): To fulfill tax, commercial accounting, and mandatory regulatory record-keeping obligations.
  • Legitimate Interests (Art. 6(1)(f)): For cybersecurity, platform abuse prevention, fraud detection, and technical performance optimization.
  • Explicit Consent (Art. 6(1)(a)): For optional marketing communications and non-essential analytical cookies, with right of withdrawal at any time.

5. How We Use Your Data

Your data is utilized for the following core operations:

  • Service Delivery: Managing accounts, experiences, and calendars
  • Booking Intermediation: Facilitating reservations and confirmations
  • Financial Management: Processing subscriptions and payouts via Stripe
  • Communication: Sending transactional emails and support updates
  • Personalization: Tailoring UI/UX based on language and currency preferences
  • Platform Security: Monitoring for system abuse and unauthorized access
  • Compliance: Maintaining legally required business records

6. Data Retention Schedule

Data is retained strictly for the duration required by its operational and statutory purpose:

  • Customer Booking & Contract Records: Retained for 5 years following experience completion pursuant to commercial limitation periods (French Commercial Code Art. L110-4).
  • Accounting & Transaction Records: Retained for 10 years in compliance with statutory accounting regulations (French Commercial Code Art. L123-22).
  • Technical Logs & IP Addresses: Retained for 12 months for security audit trails and anti-fraud monitoring (LCEN compliance).
  • Marketing Communications: Processed with active consent and retained for up to 3 years from last contact or until consent is revoked.
  • Active Professional Accounts: Maintained for the duration of the active subscription, and anonymized/deleted within 12 months after account termination.

7. Data Sharing & Authorized Sub-processors

We never sell, rent, or trade your personal data to third parties for commercial or advertising purposes. Data is transmitted strictly to vetted sub-processors under rigorous Data Processing Agreements (DPAs):

  • Hosting & Global Edge CDN: Vercel Inc. (Cloud application hosting, global edge delivery, and CDN caching with EEA routing safeguards)
  • Database & Storage: Supabase Inc. (Encrypted cloud database storage in the European Economic Area)
  • Payment Processing: Stripe Payments Europe Ltd (PCI-DSS Level 1 compliant card processing and Connect payouts)
  • Transactional Communications: Resend Inc. (Secure email delivery for confirmations, tickets, and notifications)
  • Calendar Integration: Google LLC (Optional guide calendar synchronization upon explicit user authorization)

All sub-processors are bound by strict confidentiality and GDPR compliance obligations ensuring adequate data security.

8. International Transfers

While primary database storage is located within the European Economic Area (EEA), global edge delivery and certain sub-processors operate distributed infrastructure.

Where international transfers occur, we enforce Standard Contractual Clauses (SCCs) approved by the European Commission and verify adherence to the EU-US Data Privacy Framework (DPF) to guarantee an equivalent level of GDPR protection.

9. Cookies

We use different types of cookies to operate the platform:

Essential Cookies

Required for authentication, security, and basic functionality. Cannot be disabled.

Performance Cookies

Used to understand usage patterns and improve platform performance. Anonymous telemetry.

Preference Cookies

Used to remember settings like language and display preferences.

You can update your preferences via our cookie banner at any time.

10. Security Measures

We protect your data with state-of-the-art measures:

  • Encryption of data at rest and in transit (TLS 1.2+)
  • Multi-Factor Authentication (MFA) for dashboard access
  • Automated vulnerability scanning and security monitoring
  • Strict internal access controls (Least Privilege principle)
  • Regular database backups and disaster recovery protocols

11. Your Rights

Under GDPR, you have the right to access, rectify, or erase your data.

  • Access and portability of your personal dataset
  • Correction of inaccurate or incomplete information
  • Deletion of data ("Right to be Forgotten")
  • Restriction of or objection to specific processing activities
  • Withdrawal of consent for marketing communications

To exercise these rights, email privacy@odybook.com. We respond within 30 days.

You also have the right to lodge a complaint with the CNIL (France) or your local authority.

12. Children

Our services are for professionals and adults. We do not knowingly collect data from children under 16 without parental consent (e.g., as part of a family booking handled by an adult).

13. Updates

We may update this policy periodically. Major changes will be notified via email or a platform banner.

14. Contact

Questions? Reach out to us at legal@odybook.com or via post at our registered address.

We are dedicated to transparent data processing and respect for user privacy.