GuardTrailsData controller
Matthieu Silbermann, as a private individual. Reachable through the contact form.
What we collect
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Audience measurement | understand what is read | consent | per the tool's settings, after your consent |
| Message sent through a form, and the address to reply to | reply to you | handling your request | 12 months |
| Error reports from the site (page, browser, error message) | fix the site | legitimate interest | 90 days |
| Anonymous audience measurement, without cookies (pages viewed in a visit and their order, time on each page, site or search engine you came from, device type: phone, tablet or computer) | understand how the site is used | legitimate interest; exempt from consent | 13 months |
| E-mail address and early-access choices | notify you when an offer opens; learn what to build first | consent | until withdrawn, 24 months at most |
| Contact: address, type (individual, or agency and travel professional), language, agreement to news with its date, date of the last exchange | send you our news | individual: consent (the box); agency: legitimate interest | 3 years after the last exchange |
| An individual's travel request, reduced to anonymous data | internal insights | legitimate interest | no limit: nothing identifies anyone any more |
| An agency circuit submitted for checking, and its report | carry out the check you asked for; internal insights | handling your request; legitimate interest | 3 years, kept apart from your address |
News e-mails
Individual: only if you ticked "I would like to receive GuardTrails news". The box is never ticked in advance, and nothing else signs you up.
Agency or travel professional: within a business relationship, we may write to you about GuardTrails. You can object at any time.
Every news e-mail will include an unsubscribe link. None has been sent yet: until then, one word through the contact form is enough.
Audience measurement
This site uses Google Analytics 4, enabled only after your consent given in the consent banner. Without that consent, no browsing data is collected. No other tracker is used. Messages and error reports are stored by our processor Supabase Inc., in the European Union (Paris region).
Independently of Google Analytics, which only loads if you click “Accept”, the site counts page views in an anonymous way that needs no consent: no cookie, no IP address and no browser identifier is stored. A random number, kept only while your tab is open, links the pages of a single visit; it is never reused for a later visit. We keep the page address (without anything after “?”), the language, the domain of the site you came from, the device type and the time spent on the previous page, for 13 months, for the site editor only; this data is never combined with anything else. If your browser sends “Do Not Track” or Global Privacy Control, nothing is sent.
You can withdraw your consent at any time from the banner.
Early access
Your address is used to tell you when one of the offers you ticked opens. No transfer to any third party.
Itineraries you describe to us
Individual. The text of your request is used to reply to you, and it is deleted with your message. Beyond that, we keep only anonymous, structured data: number of people, whether children travel, length, country, month, how you get around, accommodation, type of trip. Never the text, never a quotation, never a name.
Agency. The circuit you submit and its report are kept internally, apart from your address. An operator's itinerary contains personal and pricing data: names, dates, accommodation addresses, sometimes amounts. Three commitments.
Anonymisation before any reuse. If we ever publish figures, they will be aggregated and anonymous: we never name a checked circuit, nor the agency that built it.
No republication without written agreement, separate from the sending.
No transfer to any third party without specific consent.
Guide requests and orders
When you request a trip guide, or order one, we process the following.
| Data | Purpose | Legal basis | Retention |
|---|---|---|---|
| Guide request: destination, length, month, pace, accommodation, way of getting around, wishes, e-mail address, language, page of origin | calculate your guide and deliver it to you | handling your request | 12 months, then automatic purge |
| Order: the request, the delivered guide and the route chosen, successive versions, the state of the order and the rights remaining | deliver, follow the order and honour your change rights | performance of the contract | for as long as your rights are valid (6 months after delivery), then minimal archiving |
| Payment | collect the price, when the order is paid | performance of the contract; legal obligation | see Stripe below |
No bank card data passes through us. Payment is made with Stripe, which is responsible for that data.
Minimal archiving. When your rights expire, we keep only what is needed to justify the order (reference, date, amount, state) and to answer a complaint or a legal obligation. The content of your request and of your guide is no longer kept in a form that identifies you.
Who processes this data for us.
- Supabase, Paris region (European Union): storage of requests and orders.
- Stripe: card payment, when the order is paid. Stripe acts on its own account for payment data; see its privacy policy.
- Google Vertex AI: part of the calculation of the guide. We use the professional Vertex AI offering.
- Resend: the e-mail that notifies us of a request, and the one that delivers your guide.
This data is used for nothing other than calculating, delivering and following your order, and is never resold. Your rights (see below) apply to this data: to exercise them, write to us through the contact form. The terms of the order are in the terms of sale.
Hosting
The site is hosted by Google Ireland Limited (Firebase Hosting), Gordon House, Barrow Street, Dublin 4, Ireland. The host processes the connection data that is technically necessary.
Each form submission is notified to us by an e-mail sent through Resend, which acts on our behalf.
Your rights
Access, rectification, erasure, restriction, portability, objection, withdrawal of consent, unsubscribing. To exercise one, write to us through the contact form, giving the address concerned: reply within one month. You may also lodge a complaint with a data protection authority, in particular in the country where you live; ours is the French CNIL.
Cookies
The only non-essential cookie is the audience-measurement one, set after your consent. The consent banner remembers your choice.