Privacy Policy

1. Data controller

Elsewhere, Sole proprietorship (French "micro-entreprise"), 63 rue de la République, 59360 Le Cateau-Cambrésis, France, is the data controller for the personal data described below. Contact: bonjour@elsewheretrip.com.

2. Data collected

Depending on how the Platform is used, the following data may be collected:

• Account data: name, email address, password (stored encrypted), role (traveler / artist-host / organization), preferred language.
• Profile data: biography, nationality, artistic categories, photo, intro video, phone number (visible to the other party only if the user has explicitly enabled it, and only as the stay approaches).
• Booking data: dates, number and age of travelers, declared gender, messages exchanged via the internal messaging system, reviews left.
• Host check-ins: a free-form note, submitted at any time at the Host's own initiative, about how hosting travelers has affected their artistic path or day-to-day life.
• Public-quote consent: on reviews and check-ins, an optional checkbox records whether the author has authorized Elsewhere to quote that content publicly, with attribution, in its own communications — distinct from the content's normal visibility on the Platform.
• Payment data: processed directly by Stripe (payment provider); Elsewhere neither stores nor sees credit card numbers.
• Subscription data (Hosts): tier subscribed to, status (trial, active, cancelled...), trial and renewal period dates, pricing country, associated Stripe customer and subscription identifiers.
• Identity verification data: ID document and selfie submitted to Stripe Identity, which handles verification on Elsewhere's behalf; supporting documents submitted by Hosts (diplomas, portfolio, proof of accommodation), stored in a private space.
• Browsing data: technical cookies (session, language), and anonymized traffic statistics via Vercel Analytics, a tool that does not set an individual tracking cookie.
• Tax and billing data (Hosts): private individual or professional status, name or company name, billing address, SIREN and VAT numbers where applicable; for DAC7 reporting, tax identification number and date of birth, collected and verified by Stripe.

3. Purposes and legal bases

The data is processed in order to:

• Perform the contract for use of the Platform and manage bookings (legal basis: performance of a contract).
• Comply with applicable accounting and tax obligations (legal basis: legal obligation).
• Ensure the security of the Platform and prevent fraud (legal basis: legitimate interest).
• Send the newsletter, upon voluntary sign-up (legal basis: consent, withdrawable at any time).
• Produce aggregated, anonymized statistics on travel habits and artistic practices, drawn from stays that actually took place (legal basis: legitimate interest) — no individual result is identifiable, as groups that are too small are always merged before being viewed.
• Publicly quote, with attribution, a review or check-in, only when its author has explicitly consented (legal basis: consent, withdrawable at any time by writing to bonjour@elsewheretrip.com).
• Enforcing access restrictions arising from international sanctions: the country (and, where relevant, the region) a connection comes from is derived from its IP address by our host Vercel, on each request, in order to block registration, booking and payment from the territories concerned (see Terms and Conditions §4). This information is neither recorded nor retained by Elsewhere (legal basis: legal obligation and legitimate interest).
• Issuing commission invoices and reporting each year to the tax authority the income Hosts received through the Platform (articles 242 bis and 1649 ter A et seq. of the French General Tax Code — legal basis: legal obligation).

4. Data recipients

Data is shared, strictly to the extent necessary, with the following providers acting as processors: Supabase (database and authentication hosting), Stripe (payments, subscriptions, identity verification), Resend (transactional email delivery), DeepL (automatic translation of listings), Mapbox (listing geolocation), Vercel (site hosting and traffic statistics).

Some of these providers are located outside the European Union (notably in the United States); the corresponding transfers rely on the safeguards provided for by the GDPR, in particular standard contractual clauses.

Information about Hosts and the amounts they received is also sent each year to the French tax authority (DGFiP), which may exchange it with the tax authorities of other EU Member States (DAC7 directive).

5. Retention period

Account data is retained for as long as the Platform is actively used. An account with no login for 18 months receives a warning email; without a new login within the following 14 days, it is permanently deleted, along with all data specific to it. Accounting documents are retained for the legal period of ten years, in accordance with applicable accounting obligations, regardless of the status of the associated account.

Information collected for DAC7 reporting is kept for the period required by that regulation, and at most ten years.

6. User rights

In accordance with the GDPR, every user has a right of access, rectification, erasure, restriction, portability and objection over their personal data. These rights can be exercised by writing to bonjour@elsewheretrip.com. In the event of a persisting disagreement, a complaint may be lodged with the CNIL (cnil.fr).

7. Security

Access to data is restricted by database-level security rules (row-level security), limiting each user to their own data, or to data strictly necessary for the performance of an ongoing booking.

8. Cookies

The Platform uses cookies strictly necessary for its operation (keeping the session, remembering the chosen language) and the audience measurement tool Vercel Analytics, which does not set an individual tracking cookie and does not allow a visitor to be re-identified.

9. Amendments to this policy

This policy may be updated; the date of the last update appears at the top of this page.