Privacy policy
What data we process, why, for how long, and how to exercise your rights — whether you are in the European Union, the United States or elsewhere.
Who is responsible for your data?
The data controller is Assima Host, LLC, a limited liability company organized under the laws of the State of Delaware, United States. For any question about your data: contact@assimahost.com.
The data we process
| Purpose | Data | Legal basis (GDPR) | Retention |
|---|---|---|---|
| Replying to your message or estimate request | Name, email, phone (and whether you can be reached on WhatsApp), subject, message; for an estimate or management request, the property's address and municipality, type, capacity, size, standard, amenities and any photos you attach | Pre-contractual steps taken at your request, or legitimate interest in answering messages | 12 months, photos included |
| Managing a booking | Name, email, phone, country, dates, number of guests, message, amounts | Performance of the contract, then accounting and tax obligations | For the duration of the relationship, then as long as our accounting and tax obligations require |
| Taking online payment for a stay | Card details are entered on Stripe and never reach us; we keep the amount and the payment reference | Performance of the contract | Same as the booking |
| Measuring website traffic (Google Analytics) | Pages viewed, visit duration, traffic source, device type, cookie identifier | Your consent; in the United States, enabled unless you opt out | Cookies: 13 months; data: 14 months at most |
| Keeping proof of your cookie choices | Random identifier, choice, date, country, GPC signal — no IP address or browser details | Legal obligation (Article 7 GDPR) | 13 months |
| Protecting the website against abuse | IP address linked to a form submission; hosting provider's technical logs | Legitimate interest (security) | IP address: 24 hours; logs: a few days |
| Securing the admin area (team only) | Name, email, hashed password, sessions, login attempts with IP address | Legitimate interest (security) | Sessions: 14 days; attempts: 7 days (failed) to 30 days (successful logins) |
| Managing a client's file — prospect or owner —, their account and management agreement. A prospect's file is created by our team when it prepares the estimate they requested. | Name, email, phone, language, hashed password, sessions and login attempts; estimates viewed and the date they were first opened; for an owner, the address stated in the agreement, homes entrusted, stays (without guests' names), statements, payouts and adjustments, uploaded documents — including those attached to the agreement: ID document, title deed, insurance certificates, bank details (RIB) —, our team’s review of each and, where applicable, the reason for rejecting it, and, for signing the agreement, the typed name, date and time, IP address, browser and fingerprint of the signed text | Pre-contractual steps taken at your request, then performance of the agreement and accounting and tax obligations; legitimate interest for evidence of the signature and account security | File of a client who has not entrusted any property to us: deleted one year after their last sign-in — or after its creation, if they never opened their account; owner: term of the agreement, then the period required by our accounting and tax obligations and by limitation periods; sessions: 14 days; access links: 7 days at most |
No automated decisions are made about you, and no profiling takes place.
Who receives your data?
Only the team members handling your request have access to it, along with our service providers, to the extent necessary for their work:
- Cloudflare — website hosting, database, photo and document storage, protection against attacks;
- Stripe — online payment, under its own privacy policy;
- Resend — sending emails (booking confirmations, forwarding your messages to the team);
- Google — traffic measurement, only when allowed, with advertising features turned off; address suggestions in the contact form, where our server sends it the letters typed in the address field, never your IP address.
The owner of the home you book sees your stay dates, the number of guests, the booking channel and the amounts due to them — never your name or contact details.
We do not sell or rent your data, and we do not share it for advertising purposes. Fonts are hosted on our own website: viewing a page does not send your IP address to any third party.
Transfers outside the European Union
Assima Host, LLC is based in the United States, as are several of our service providers, so your data is processed there. When a provider transfers data, these transfers are covered by the European Commission's standard contractual clauses or by the EU–U.S. Data Privacy Framework, depending on the provider.
Cookies
Strictly necessary cookies are always active. Other cookies are only set with your consent — or, in the United States, unless you opt out or your browser sends a GPC signal.
| Cookie | Purpose | Category | Duration |
|---|---|---|---|
ah_consentement | Remembers your cookie choices | Necessary | 6 months |
ah_session | Login to the admin area, for the team only | Necessary | 14 days |
__cf_bm | Tells visitors apart from bots, if set by our hosting provider | Necessary | 30 minutes |
_ga, _ga_* | Google Analytics traffic measurement | Analytics | 13 months |
During payment, you are on Stripe's website, which sets its own cookies. You can change your choices at any time:
Your rights
Wherever you are, you can ask us to access, correct or delete your data. If you are in the European Union, the United Kingdom or Switzerland, you also have the following rights:
- to restrict or object to processing, in particular when it is based on our legitimate interest;
- to receive your data in a reusable format (portability);
- to withdraw your consent at any time, without affecting what was done before;
- to lodge a complaint with the data protection authority in your country — in France, the CNIL.
To exercise your rights, write to contact@assimahost.com or use the contact form (subject “My personal data”). We reply within one month; we may ask you to verify your identity.
United States residents
This section applies to residents of California (CCPA, as amended by the CPRA) and of other states with comparable laws. In the past twelve months, we may have collected the following categories of personal information, directly from you, from your device or from our payment provider:
- identifiers: name, email address, phone number, IP address;
- commercial information: bookings and amounts paid;
- internet activity: pages viewed, when analytics is active;
- approximate geolocation: country inferred from the IP address;
- information about a property, when you entrust it to us;
- professional information about an owner: signed management agreement, statements, payouts and the documents they entrust to us.
This information is used for the purposes described above. We do not sell your personal information or share it for cross-context behavioral advertising; the only sensitive personal information we may hold is the identity document an owner chooses to entrust to us for their agreement, and we use it for that purpose only.
You have the right:
- to know what personal information we hold about you and to access it;
- to have it deleted or corrected;
- to opt out of its sale or sharing;
- not to be discriminated against for exercising these rights.
The Global Privacy Control (GPC) signal sent by your browser is honored as an opt-out: it turns off analytics. The “Your Privacy Choices” link at the bottom of each page also lets you turn it off. For any request, write to contact@assimahost.com; we respond within 45 days after verifying your identity, and an authorized agent may act on your behalf.
Children
This website is not intended for people under 16, and we do not knowingly collect their data: bookings and management agreements are entered into by adults.
Security
The website is served exclusively over HTTPS. Team passwords are hashed, sessions can be revoked, and repeated login attempts are blocked. Access to data is restricted to the team members who need it.
Changes
We may update this policy to reflect changes to the website or to regulations. The date below shows the latest version.
Last updated: October 9, 2026.