Privacy Policy
Last updated: [date]
1. Data controller
The controller of your personal data is ELEOR, publisher of WeshareTrip, [address]. For any question about your data: contact@wesharetrip.com.
2. Data we collect
| Category | Data | Source |
|---|---|---|
| Account | Username, email, password (hashed), role | Provided by you at signup |
| Trip profile | Trips created/joined, destinations, dates, budgets, members | Generated by your use of the Service |
| Shared content | Chat messages, poll votes, expenses, packing lists, uploaded documents and photos | Provided by you |
| Payment | Purchase history (plan, amount, date) — never your bank details, handled directly by Stripe/PayPal | Generated on purchase |
| Referral | Referral link, number of referrals | Generated by your use of the Service |
| Technical | IP address, connection logs, cookie preferences | Automatic |
3. Purpose of processing
We use this data to:
- Provide the Service (creating and managing trips, splitting expenses, etc.).
- Process your purchases and prevent fraud.
- Send account-related emails (email verification, password reset, automatic reminders you can configure).
- Keep the Service secure (anomaly detection).
- Respond to your support requests.
We never sell your data to third parties.
4. Legal basis (GDPR)
- Performance of a contract: providing the Service you subscribed to by creating an account.
- Legitimate interest: security, fraud prevention, improving the Service.
- Consent: non-essential cookies (see section 8), marketing communications where applicable.
- Legal obligation: retention of certain billing data.
5. Recipients and processors
Your data may be shared with the following providers, strictly as needed to operate the Service, each acting as a data processor under the GDPR:
| Provider | Role | Data involved |
|---|---|---|
| Stripe, PayPal | Payment processing | Transaction data (never your full bank details) |
| Cloudinary | Hosting of uploaded photos and documents | Files you share |
| Brevo (or equivalent SMTP provider) | Sending transactional emails | Email address, message content |
| MongoDB Atlas | Database hosting | All data listed in section 2 |
| Sentry | Technical error detection and diagnostics | Technical logs (no account content) |
| OpenWeatherMap, Frankfurter (ECB exchange rates) | Weather forecasts and exchange rates shown in the Service | Trip destination/dates viewed (no identifying data) |
None of these providers is authorized to use your data for any purpose other than the one for which we engage them.
6. Transfers outside the European Union
Some of our providers (notably Stripe, PayPal) may process data outside the European Union. Such transfers are governed by the European Commission's standard contractual clauses or an equivalent mechanism ensuring an adequate level of protection.
7. Retention period
- Active account: retained for as long as you use the Service.
- Inactive account: deleted after [duration, e.g. 3 years] of inactivity, following prior notice.
- Billing data: retained for 10 years under legal accounting obligations.
- Account deletion: see the Terms of Service ("Account deletion") for exactly what is deleted, kept, or transferred.
8. Cookies
The Service uses:
- Essential cookies (keeping you signed in) — do not require consent.
- Non-essential cookies, subject to your consent, manageable at any time via the banner at the bottom of the page.
9. Your rights
Under the GDPR, you have the right to access, rectify, erase, restrict, object to, and port your data. You can:
- Export your data directly from your Account settings (machine-readable format).
- Delete your account directly from your Account settings.
- Contact us at contact@wesharetrip.com for any other request.
You also have the right to lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), if you believe your rights are not being respected.
10. Security
Your passwords are hashed and never stored in plain text. Communications between your device and our servers are encrypted (HTTPS). Our team's access to data is limited to what is strictly necessary to operate the Service.
11. Contact
For any question about this policy or your personal data: contact@wesharetrip.com.