Siestify Privacy Policy Website and iOS and Android mobile application

Last updated October 1, 2026. This policy describes the processing of the website and the application as of the publication of this version.

1 Who processes your data Gildas Ovono Mba, an individual entrepreneur (EI), operating under the trade name Siestify, is responsible for the processing described in this policy. Registration: RCS Paris 995 150 224. Business address: 50 avenue des Champs-Élysées, 75008 Paris, France.

For any questions or requests regarding your data: team@siestify.com. Phone: +33 6 51 15 84 36. You can also write to the business address above, specifying "Personal Data".

This policy covers https://siestify.com, the Siestify app for iOS and Android, daytime and overnight bookings, accounts, Moments, and our communications with you. It explains Siestify's processing; hotels, stores, mapping applications, and social networks also have their own policies for their processing operations.

The hotel is notably responsible for its own reception, identity check, security, and billing operations. We transmit the information necessary for your booking to them; we do not decide all of their processing operations on their behalf.

2 The essential points Booking information is used to organize your service and contact you about it. Payment is made directly to the hotel: Siestify does not collect your card number or cryptogram (CVC) during this process. The hotel may communicate the realization or payment status of the booking to us for tracking purposes.

The video reviews you choose to publish are public along with the announced presentation information. Camera, microphone, photos, and location are linked to optional features; refusing them does not prevent you from searching for an offer by city or making a booking.

You can exercise your rights, withdraw consent, and request the deletion of your account. However, certain data must be kept separately when justified by a legal obligation, an ongoing booking, or the defense of a right.

3 The data concerned

3.1 Account and contact details We process the information you provide: last name, first name, email address, phone number when requested for the service, login information, preferences, and profile picture if you choose one. Necessary fields are indicated at the time of collection. Without them, the relevant feature may not be available; optional fields can be left blank.

The application also stores data on the device to retrieve your experience, notably certain preferences, favorites, profile information, bookings, and video content references. This local data and the data stored on our servers are not necessarily identical copies.

3.2 Bookings and customer relations We process the establishment, destination, dates, time slots, service category, number of participants, options, price and its currency, reference, accepted conditions, and the statuses of booking, attendance, cancellation, or payment communicated by the hotel.

Special requests, support messages, complaints, and voluntarily submitted supporting documents may also be processed. Avoid submitting unnecessary documents or information, especially full bank details and identity documents.

If you book for someone else, only provide the necessary information and inform them of its transmission and the existence of this policy. When individual information is required for data obtained indirectly, Siestify provides it under legal conditions; this obligation is not fully transferred to the person booking.

3.3 Location and maps When you activate the proximity feature, the application uses the location authorized by your phone to calculate distances and sort the hotels and Moments corresponding to your search, from closest to furthest. Accuracy depends on your settings. Manual selection of a city remains possible if you refuse location services.

The proximity feature is used in the foreground; it does not track your movements in the background. Without location, hotels are sorted by average rating or ascending price, depending on the displayed sorting. Maps and address suggestions use the services described in Article 8. The provider may receive map requests, connection data, and, if the feature requires it and you authorize it, the location useful for the request.

3.4 Reviews and Moments videos When you record and then send a Moment, we process the video file, its audio, visible people or places, its caption, its link to a booking, its publication status, and the information necessary for moderation. An identifiable face or voice constitutes personal data; their presence alone does not mean that biometric identification processing is performed.

The publication shows the video, its caption, your first name, and the relevant hotel, according to the preview screen. Your email, phone number, and booking reference are not intended to be published. Reactions and reporting, if available, are processed for their specific function.

The Siestify team reviews each Moment before publication and makes a decision within 24 hours. A published video cannot be modified; its author can delete it and submit a new video subject to the same review. No reward is currently offered in return.

A recording may exist locally before it is sent. Technical access to the camera or microphone does not, in itself, lead to publication. Files you export to your photo library or share to a social network are separate copies.

3.5 Technical data The operation of the service may produce technical data such as the IP address, dates and times of requests, system, application version, browser, errors, and security logs. Information used for non-essential audience measurement depends on the tools actually activated and your choices.

Remote notifications use a notification token and, for Firebase Cloud Messaging, an installation ID allowing the message to be routed to the correct device. Providers may also process connection data necessary for the security and operation of the service. Data required for maps and address suggestions are described in Article 8. No credit card number is required for these features.

4 Uses and their legal bases The management of your account, favorites saved at your request, the booking, its confirmation, its modification, and the communications necessary for the service are based on the execution of the contract or pre-contractual steps you request. Optional location and map requests are used to search for an offer or address; their use respects your choices and the necessary permissions.

Support related to a booking is based on the contract. The follow-up of a complaint, fraud prevention, securing the service, and the defense of rights can be based on our legitimate interest, after considering your rights and the proportionality of the processing. This interest does not allow undifferentiated collection of your activities.

Accounting obligations and legally mandated responses to authorities are based on corresponding legal obligations. Keeping evidence for a dispute is based, depending on the case, on the relevant obligation or the legitimate interest to defend our rights.

Optional access to location for proximity, commercial prospecting you accept, and non-essential trackers are based on your consent when required. You can withdraw it without affecting legally performed processing beforehand.

The publication of a Moment and the broadcasting of your image or voice in this context are subject to a specific choice before sending. Consent to this broadcast is separate from the general use of the account. The technical processing necessary for sending, managing the requested content, and moderation relies, depending on the operation, on the execution of the requested service, the legitimate interest in ensuring its security, or a legal obligation.

Any use of a Moment by Siestify for advertising purposes or on its own social networks requires a separate agreement specifying the media, uses, and duration. Accepting the general terms and conditions does not authorize this reuse.

To avoid continuously presenting the same Moments, we use the references of videos already seen in the feed. This sorting falls under our legitimate interest to make discovery useful and diversified; it remains limited to this purpose. You can exercise your right to object under the conditions of Article 14. No advertising profile is created from this history.

5 Phone permissions The camera is used to take a profile picture or record a video review. The microphone is used to record the sound of the review. Photo access is used to select a profile picture or, when you request it, to save a copy of your video. Location is used for the proximity feature.

Requests appear when the feature needs them. You can refuse or change them in the system settings. Refusing the microphone or camera prevents the corresponding recording, without conditioning a booking.

An iOS or Android permission provides technical access to a resource. It does not automatically constitute consent for all uses of that resource. When separate consent is necessary, it is requested separately along with its objective.

Service notifications are used for confirmations, booking changes, and useful reminders. They are routed by Google Firebase Cloud Messaging and, on iOS, by the Apple Push Notification service when necessary. You can disable them in the phone settings. Technical authorization for notifications does not automatically authorize promotional messages: these require a separate choice adapted to that purpose.

6 Commercial and service communications Messages essential for a booking, a major modification, or security are not newsletters. Refusing a newsletter does not block these service communications.

The newsletter and promotional offers are sent according to your choice, with a simple unsubscribe method. Consent to email does not automatically mean consent to SMS, WhatsApp, or partner prospecting. The channels actually used and their service providers must be indicated before activation.

A withdrawal or objection can be sent to team@siestify.com. We keep minimal information allowing us to respect your objection and prevent involuntary re-subscription.

7 Visibility and recipients Persons authorized to process your bookings, assist you, and ensure security only access the information useful for their missions.

The chosen hotel receives in its Siestify professional space and by email the essential information for your stay: last name, first name, dates, and booked time slot. Only additional elements essential to the chosen offer, such as the reference or the number of participants, are associated with the booking follow-up. Account details, favorites, and viewing history are not transmitted to them for this reason alone. A special request is transmitted only to the extent necessary for its processing. Access is restricted to authorized personnel of the establishment. Transmission to a hotel located outside the European Economic Area is governed by Article 9.

Hosting, messaging, and technical service providers intervene in their effectively defined roles. When they are subcontractors, their obligations regarding confidentiality, security, assistance, and deletion must be contractually framed. A provider or partner who determines their own purposes cannot automatically be qualified as a subcontractor.

Published Moments are accessible to visitors of the spaces where they are broadcast. Avoid any data you do not wish to make public. The social networks chosen during sharing receive the transmitted content and apply their own rules. Siestify does not automatically publish your video on these networks merely because it was sent to the Platform.

Data may be communicated to authorities when required by law, or to legal counsel and stakeholders to the extent necessary for a dispute, under appropriate guarantees. Listing a hotel does not authorize it to receive all data of Siestify users.

8 Providers and external services Google Cloud hosts the platform, its database, photos, and videos in the Paris region, France. It processes account data, bookings, content, and technical data necessary for the service. Booking confirmation emails and receipts are sent using the messaging infrastructure used by Siestify; the recipients, content, and necessary deliverability information are processed for this sending. Google Cloud's processing terms are available at https://cloud.google.com/terms/data-processing-addendum.

Cloudflare is involved in site and access protection, security, caching, and configured authentication features. It may process the IP address, connection characteristics, requests, and data necessary for security checks. Its notice is available at https://www.cloudflare.com/privacypolicy/.

Mapping relies on Apple Maps on iOS, Google Maps on Android, and OpenStreetMap on the Web. Google also provides address suggestions. These services may receive search terms, coordinates useful for the map, and technical connection data. Opening the phone's map application constitutes a separate use of this service. Notices: https://www.apple.com/legal/privacy/ ; https://policies.google.com/privacy ; https://osmfoundation.org/wiki/Privacy_Policy.

Google Firebase Cloud Messaging ensures the routing of notifications using tokens and installation IDs. On iOS, this routing may also involve the Apple Push Notification service. These technical services are distinct from an advertising or audience measurement tool. Firebase privacy information is available at https://firebase.google.com/support/privacy.

The site uses an internal visit attribution tool described in Article 10. The mobile application does not use any advertising cookies or third-party trackers for advertising or audience measurement purposes. However, it does use the third-party technical services above for maps, security, and notifications.

The Siestify team and providers access only the data useful for their missions. When a provider acts as a subcontractor, their intervention is governed by a data processing agreement. A service that determines certain specific purposes also applies its own privacy policy for these processing operations.

Apple and Google process certain data for app distribution and their own services according to their policies. Publication on a store does not imply the transmission of all booking data to its operator. Stripe is not involved in the booking process with payment at the hotel described here.

9 Hosting and international transfers The main hosting of the platform, its database, and its photos and videos is configured in the European Union, in the Google Cloud Paris region. This main storage location does not mean that all technical processing by providers is performed exclusively in the European Union.

Mapping, connection protection, and notification services may rely on international infrastructures or support access outside the European Economic Area, particularly in the United States. Google describes Firebase Cloud Messaging as a service relying on its global infrastructure. The data concerned are those necessary for these functions, such as technical identifiers, requests, and connection data. Transfers are subject to the guarantees applicable to the service and the recipient: an adequacy decision when it effectively covers the flow, or standard contractual clauses of the European Commission with the required assessment and supplementary measures. A provider's establishment in Paris is not sufficient to guarantee the absence of transfer.

When you book in a hotel located outside the European Economic Area, for example in Morocco or Ivory Coast, we only transmit the essential information for the execution of the stay: last name, first name, date, and time slot, along with elements strictly necessary for following up on the booked offer. Exchanges with these partner hotels are governed by the standard contractual clauses of the European Commission, according to the role of the parties and the concerned flow. This framework authorizes neither excessive transmission nor prospecting by the hotel without its own legal basis.

You can obtain information about the recipients, the countries involved, and the guarantees, as well as a copy of or access to the communicable guarantees, by writing to team@siestify.com. Confidential information unrelated to your request may be protected.

10 Cookies and storage on your device The site uses technical cookies strictly necessary for the session, security, authentication, and the retention of your choices. These cookies are not used to establish an advertising profile. Their duration depends on their function: session cookies expire when the session is closed; those necessary to remember a choice remain limited to this purpose.

An internal visit attribution tool identifies the source of a visit, notably a link or campaign that led to the site. The associated tracker is kept for a maximum of thirty days. Since it is not essential for booking, it is subject to your prior consent. Its qualification as an internal tool does not, on its own, exempt it from consent.

The banner allows you to accept or refuse optional trackers with equivalent simplicity. Refusal does not block navigation or booking. You can change your preferences or withdraw your consent at any time via the site's cookie manager. Accepting the general terms or continuing navigation does not constitute consent. Acceptance and refusal choices are remembered for a maximum of six months before a new request, unless a change of purpose requires a new choice earlier.

The mobile application does not drop advertising cookies and does not use third-party advertising or audience measurement trackers. It may store local information necessary for the requested functions, such as the session, preferences, and favorites. Technical identifiers for notifications, map requests, and security checks remain data processing operations, described in this policy. Technical permission does not equal general consent to additional uses.

11 Retention periods The periods below constitute the retention rules of this version. Data is not kept in everyday tools for the sole reason that evidence must be archived: only necessary information is then kept in a space with limited access.

Account and preferences: during the use of the account, then deletion after three years without significant activity, after prior information when the contact remains available, or earlier upon admissible request. A future booking or a dispute may justify the limited retention of essential information, without keeping all account data.

Bookings: during their management, then probationary archiving of necessary information for five years from the end of the service or cancellation, unless a different legal timeframe or a dispute justifies a limited extension. When the legal archiving of an electronic contract imposes a different timeframe, only the documents concerned are kept for that duration.

Accounting documents: the documents that Siestify is required to keep are kept for the applicable legal duration, notably ten years from the end of the financial year for the relevant accounting documents. This period does not apply indistinctly to profiles, videos, and navigation data.

Support: during the processing of the request, then a maximum of two years after its closure for ordinary follow-up. In the event of litigation, necessary elements are isolated and kept for the applicable prescription or procedural periods.

Prospecting: for prospects, a maximum of three years after collection or the last active contact originating from the person; for customers, during the commercial relationship then three years after its end or the last relevant active contact. Withdrawal of consent or objection stops the sending without waiting for this period. A simple email opening is not considered a new active contact. A minimal objection list is kept for three years, then re-evaluated if necessary to durably respect the refusal.

Approved Moments: a maximum of twelve months from their first publication, then automatic removal and deletion from active systems. Deletion by the author or of the account leads to their removal and earlier deletion. This duration aims to present recent reviews and is not automatically renewed. Rejected videos are deleted thirty days after notification of the refusal, the period provided to contest the decision. Only elements necessary for an ongoing contestation, a legal obligation, or a dispute may be isolated for the justified duration, without remaining public. Backups follow the rule below.

References of already seen Moments: kept to diversify the feed during the availability of the concerned Moment, for a maximum of twelve months from its publication, and deleted earlier with the account or when the Moment is deleted. They are not used to establish an advertising profile.

Proximity position: use during the session necessary for the function, without creating a movement history by Siestify. Map providers apply their rules to requests and technical data received; their notices are indicated in Article 8.

Technical logs: a maximum of six months for standard operation; retention of up to twelve months may apply to justified security logs. Elements related to an incident may be isolated for the time necessary for its analysis or the defense of a right. The periods imposed by a specific text remain applicable to the data it targets.

Proof of consent: during the period of the concerned use then during the period necessary for proof, within the limit of five years after its end when this period is justified. Minimal proof does not allow the processing you objected to to continue.

Attribution of site visits: a maximum of thirty days for the tracker and the associated individual attribution information. Statistics made irreversibly anonymous can be kept beyond this, without the possibility of tracing back to an individual.

Notifications: tokens stored by Siestify are kept as long as they are used for authorized notifications and are deleted from active systems with the account or when the service is no longer used. The deletion of the corresponding installation identifiers must also be requested from Firebase. Google states that their deletion from its active systems and backups can take up to one hundred and eighty days after this request. This specific period for Firebase identifiers does not apply to photos or videos hosted by Siestify.

Siestify technical backups: copies of data deleted from active systems are erased within a maximum period of thirty days after this deletion. They are isolated and are not reused for a new purpose. In the event of restoration, the deletions already made are reapplied. This period does not replace the durations of legally kept archives nor the period specific to Firebase notification identifiers described above.

12 Account and content deletion You can delete your account directly in the app from "Profile", "Settings", "Delete my account". You can also send a request to team@siestify.com or from https://siestify.com/contact-us, without reinstalling the app. Proportionate confirmation or re-authentication may be requested to prevent fraudulent deletion.

Once the deletion is validated, the account and its photos and videos are immediately deleted from the active platform. Copies in Siestify's technical backups are erased within a maximum of thirty days. The removal also covers the public broadcasting of the Moments concerned; it does not consist of temporarily hiding the profile.

The only data that remain necessary for an ongoing booking, a legal obligation, or the defense of a right are kept separately, with restricted access, according to the periods in Article 11. Notification service identifiers follow their own procedure and timeframe, also described in this article. Information useful for handling a booking or a request remains accessible to support for the necessary time.

Deleting the account does not automatically cancel a booking. If you wish to cancel it, use the cancellation procedure or contact support with the reference. Recipients are informed of deletion requests under the conditions provided by law; the hotel's own obligations may justify keeping certain elements with them.

You can delete a Moment independently of the account. It is not possible to modify an already published video: you can delete it and then submit a new video, which will be moderated again. A copy exported to your phone or shared on a social network must be deleted separately with the concerned service. Uninstalling the app does not delete the server account.

Requests sent to support, especially those relating to data kept separately, receive a response within the deadlines of Article 14. These response times do not extend the publication of a deleted account or Moment.

13 Security and incidents Siestify must apply measures adapted to the risks: access limitation, communication protection, authorization management, controlled backups, and incident handling. The nature of the measures evolves with the service; no absolute security is guaranteed.

In the event of a data breach, Siestify evaluates its obligations to notify the supervisory authority and, when the risk requires it, to inform the people concerned. You can report an incident to team@siestify.com without transmitting a password or full bank details.

14 Your rights and how to exercise them You have, under applicable conditions, the rights of access, rectification, erasure, restriction, and portability. You can object to processing based on our legitimate interest for reasons relating to your situation; objecting to prospecting is possible at any time, without justification.

You can withdraw consent as easily as it was given, without affecting the lawfulness of prior processing. You can also define directives relating to the fate of your data after your death under the conditions of French law.

Send your request to team@siestify.com or by mail. Specify the right requested and the information useful for finding your data. An identity document is only requested if a reasonable doubt about your identity justifies it, in a proportionate manner; it is not systematically required.

We generally respond within one month of receipt. If the complexity or number of requests justifies an extension of up to two additional months, we will inform you within the first month along with the reasons. If we cannot comply, we will explain why and indicate the available remedies.

The exercise of rights is free of charge, subject to legal exceptions, particularly for certain manifestly unfounded or excessive requests. You can file a complaint with the CNIL at https://www.cnil.fr/fr/plaintes or the competent supervisory authority, and seek a judicial remedy. It is not mandatory to wait for an agreement from Siestify to file a complaint with an authority.

15 Ranking and human decisions Hotels are filtered according to the search. With your location authorization, the proximity ranking is based on increasing distance; without location, the ranking is based on the average rating, from highest to lowest, or ascending price, depending on the displayed sorting. A chosen sort applies according to its title.

The Moments feed takes search criteria into account. Without geolocation, videos you have not yet seen are prioritized, and hotels and cities alternate to diversify discovery within the searched perimeter. Viewing a Moment does not constitute a booking or a guarantee of availability. Currently, no hotel pays to be placed at the top of the results.

These sorts do not, on their own, constitute a decision producing legal effects or similarly and significantly affecting you within the meaning of Article 22 of the GDPR. You can search by city without authorizing location and exercise your rights over the data used for the ranking.

Booking requests are accepted or rejected by the hotel or the Siestify team, without automatic confirmation. Each Moment is reviewed by the team before publication, within twenty-four hours. Suspensions, account blocks, and bans are also subject to a human decision. You can request a review of a decision at team@siestify.com.

Technical controls may temporarily limit the frequency of actions against abuse, notably to two bookings per day, or filter a suspicious connection. These temporary limits are not automatic bans. Support can be contacted when they prevent legitimate use.

The use of artificial intelligence tools for editorial content does not authorize sending your bookings, messages, or videos to these tools. Any processing of this type must be identified, justified, and subject to appropriate information prior to its activation.

16 Minors and sensitive information Creating a booking account and publishing Moments are intended for people aged 18 or older. Information regarding accompanying children is limited to what is necessary for an offer that accepts them, for example, their number or an age range useful for the rate.

Do not indicate health data, opinions, ethnic origin, or other sensitive information in free text fields and videos. An accessibility request may sometimes reveal health data: prefer wording that describes the practical need without a diagnosis. If sensitive data is essential, a specific legal basis and an adapted channel must be defined prior to its collection; these terms do not constitute general explicit consent.

17 Policy evolution The policy is updated when features or processing operations evolve. Significant changes are brought to your attention by appropriate means. A new version does not replace consent when new consent is required.

In the event the activity is transferred to another entity, notably a future company, the identity of the new controller and the consequences on processing will be communicated to you before or at the time required by regulations. The current policy designates the individual entrepreneur who effectively operates Siestify.