Privacy Policy

This Privacy Policy covers the processing operations for which TALARIA acts as data controller: browsing of the Site, management of user accounts and the customer relationship, billing, B2B commercial prospecting, and support.

It does not cover the processing of the personal data of hotels' guests (reviews, bookings) carried out on behalf of the hotels in the course of the Service: for that processing, TALARIA acts as a processor and the hotel (the Customer) is the controller — such processing is governed by the Data Processing Agreement (DPA, Article 28 GDPR).

TALARIA SASU — R.C.S. Paris 105 647 119 — registered office at 1 rue de Chazelles, 75017 Paris, France — represented by Hermès Coutureau, President. Data protection contact: hermes@khelys.dev.

Depending on the context, we process the following categories of personal data:

• Browsing of the Site — connection data (IP address, date/time, browser) and navigation data, for the operation and security of the Site and audience measurement. Legal basis: legitimate interest (Art. 6(1)(f)); consent for non-essential cookies.
• Contact / demo request form — first name, last name, email, telephone, company, message, to respond to the request. Legal basis: pre-contractual measures (Art. 6(1)(b)) / legitimate interest (Art. 6(1)(f)).
• User account — identity, professional email, role, credentials, hotel(s) attached, for account creation and management and the provision of the Service. Legal basis: performance of the contract (Art. 6(1)(b)).
• Billing / accounting — billing details, payment data (via Stripe), history, for billing, debt recovery and accounting obligations. Legal basis: legal obligation (Art. 6(1)(c)) / performance of the contract (Art. 6(1)(b)).
• B2B prospecting — professional contact details, for commercial outreach to professionals. Legal basis: legitimate interest (Art. 6(1)(f)), with a right to object.

No special-category data (Article 9 GDPR) is requested.

Data is processed by TALARIA and, for the purposes set out above, by technical providers acting as processors (in particular Vercel — hosting and cookieless audience measurement (Web Analytics, Speed Insights), Supabase — EU database and authentication, Resend — emails, Stripe — payments, PostHog — EU-hosted product analytics (Frankfurt, consent-based), Sentry — error monitoring). Each is bound by an agreement compliant with Article 28 GDPR. Data is never sold or rented to third parties for commercial purposes without consent.

Certain providers are established in the United States. The corresponding transfers are framed, in order of priority:

• by the adequacy decision of the European Commission (EU-U.S. Data Privacy Framework) where the provider is certified thereunder (Article 45 GDPR) — Commission Implementing Decision (EU) 2023/1795 of 10 July 2023;
• failing that, by the Standard Contractual Clauses of the European Commission (Implementing Decision (EU) 2021/914 of 4 June 2021) together with supplementary measures (Article 46 GDPR).

• Accounts and contractual data: duration of the contractual relationship + 5 years (limitation period, Article 2224 of the French Civil Code / Article L.110-4 of the French Commercial Code);
• Accounting records and invoices: 10 years (Article L.123-22 of the French Commercial Code);
• Prospects: 3 years from the last contact (CNIL recommendation);
• Cookies: consent record (khelys_consent) 180 days; other cookies 13 months maximum (CNIL cap).

Under Article 5(3) of the ePrivacy Directive (Article 82 of the French Data Protection Act) and the CNIL guidelines, consent is required to read or write information on your device unless the tracker is strictly necessary to provide a service you explicitly requested, or is used solely for anonymous, cookieless audience measurement that meets the CNIL exemption criteria. Consent, where required, is collected under Articles 6(1)(a) and 7 GDPR.

The Site and the application use:

• Supabase authentication / session (sb-*) — login and session management. Strictly necessary, EU hosted, no consent required.
• khelys_consent — stores your cookie consent choices (180-day lifetime). Strictly necessary, first-party, no consent required.
• Vercel Web Analytics and Vercel Speed Insights — aggregate, anonymous audience and performance measurement. Cookieless, no personal data (anonymous daily hash), no consent required.
• PostHog — product analytics and optional session replay (inputs masked). EU-hosted (Frankfurt). Off by default — requires consent and is active only if you opt in via the banner.
• Sentry — error monitoring. No cookie by default, session replay disabled, no personal data, no consent required.

A cookie banner lets you accept all, reject non-essential (essential only), or customise per category (Analytics, and Session replay which requires Analytics). Your choice is stored in the first-party khelys_consent cookie. Only PostHog requires consent and is gated by the banner; the strictly necessary cookies, the cookieless Vercel measurement and Sentry are not gated. You can change or withdraw your consent at any time by clearing the khelys_consent cookie (which re-displays the banner) or by configuring your browser. Withdrawal stops PostHog and does not affect processing carried out beforehand.

In accordance with Articles 15 to 22 GDPR, every individual has the rights of access, rectification, erasure, restriction, objection, and portability, as well as the right to give post-mortem instructions. These rights may be exercised with hermes@khelys.dev. Any individual may lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr).

TALARIA implements appropriate technical and organisational measures (encryption in transit and at rest, access control, tenant isolation) within the meaning of Article 32 GDPR.