Last updated: 6 November 2026
This policy explains:
- what personal data Vostay collects and why;
- how long it is kept;
- who it is shared with;
- how to exercise your rights.
It complies with the General Data Protection Regulation (GDPR, Regulation (EU) 2016/679) and the amended French Data Protection Act of 6 January 1978.
1. Who we are
Vostay is online software (SaaS) for managing short-term rentals. It is published by Lamine OULD SLIMANE, sole trader (entrepreneur individuel, EI), trading as "Vostay", whose business address is 10 rue de la Paix, 75002 Paris, France (registered domiciliation address), registered with the French National Business Register (RNE) under SIREN No. 890 355 324 ("Vostay", "we").
Contact for any question about your data: contact@vostay.fr
Vostay has not appointed a Data Protection Officer (DPO), as this is not mandatory for its activity.
2. Two different roles depending on the data
a) Vostay is the controller for the data of its visitors, prospects, customers and the users of their accounts. Vostay decides why and how this data is processed. This policy describes that processing.
b) Vostay is a processor (Article 28 GDPR) for the data its customers process in the tool. This covers:
- data about their guests: messages, bookings, calls;
- data about their teams: managers, cleaning staff.
For this data, the controller is Vostay's customer (the property management company or host). Vostay acts only on its instructions, under a data processing agreement (DPA). See section 10 if you are a guest or a member of a customer's team.
3. What data, why, on what legal basis, for how long?
| Who | Data | Purpose | Legal basis (Art. 6 GDPR) | Retention |
|---|---|---|---|---|
| Website visitors | Technical data (IP address, browser, pages viewed) | Run and secure the website | Legitimate interest (security, proper functioning) | Technical logs: 12 months |
| Prospects | Name, email, phone, company, number of properties, exchanges | Answer requests, present the offer, marketing | Legitimate interest (professionals); consent (individuals, see section 4) | 3 years from last contact |
| Customers and users | Identity, email, phone, role, login credentials, preferences (language, theme) | Create and manage the account, provide the service, support | Performance of the contract | Term of the contract, then 3 years for the business relationship |
| Customers | Billing data (name or company name, address, VAT, payment history) | Invoice, collect payment, keep the accounts | Legal obligation + performance of the contract | 10 years (Article L. 123-22 of the French Commercial Code) |
| Customers and users | Login and activity logs in the tool | Security, fraud prevention, traceability | Legitimate interest | 12 months |
| Customers and users | Exchanges with support and with Vostay Assistant | Answer requests, provide the service | Performance of the contract | Term of the contract |
| Customers | Reviews and feedback about Vostay | Improve the product | Legitimate interest | 3 years |
Audience measurement. We count visits to the public pages of our website (page viewed, date and time, the site or search engine the visit came from, language, country and city). The country and city are worked out from the IP address at the time of the visit; the IP address is never stored. Without your consent, no cookie is set and no identifier is created: nothing links two pages or can recognise you (legal basis: legitimate interest, knowing which pages are read). If you accept on the cookie banner, a randomly drawn identifier links the pages your browser reads, to understand how visitors move through the site (legal basis: your consent, which you can withdraw at any time with the "Cookie settings" link). People signed in to the app, and browsers that have already signed in to it, are not counted. This data is kept for 25 months. We use no advertising tools and no third-party measurement tools (see the Cookie policy).
You are never obliged to provide data. However, without the data needed for the contract (identity, email, billing), we cannot open an account.
4. Marketing
- If you are a professional, we may write to you about Vostay when the message relates to your business.
- If you are a private individual, we only send you marketing emails if you have agreed to it. The exception is existing customers: we may write to you about similar services unless you have objected.
Every email contains a one-click unsubscribe link. You can also object at any time by writing to contact@vostay.fr.
5. Artificial intelligence
Vostay uses AI models supplied by third-party providers (see section 6) to:
- draft replies to guests;
- answer the phone (Vostay Voice);
- translate messages;
- run Vostay Assistant.
How we use them:
- These providers act as processors: they process data only to provide the service to Vostay.
- Vostay does not use its customers' data to train artificial intelligence models, neither its own nor its providers'.
- Vostay never sells data.
- Vostay Assistant never takes an action in the tool without the customer's approval.
- No decision producing legal effects concerning you is made solely by automated means within the meaning of Article 22 GDPR.
6. Who we share data with
Data is accessible only to authorised Vostay staff and to our processors, to the extent they need it:
| Processor | Role | Data location | Safeguards for transfers outside the EU |
|---|---|---|---|
| OVH SAS (OVHcloud) | Server hosting and file storage | France | No transfer |
| Scaleway SAS | Nightly encrypted backups | European Union | No transfer |
| Beds24 GmbH (Berlin, Germany) | Channel manager: syncing bookings, calendars and messages with Airbnb, Booking.com and Vrbo | European Union | — |
| OpenAI Ireland Ltd (Dublin, Ireland) | AI: drafting replies, Vostay Assistant, voice conversation and call transcription (Vostay Voice) | May be processed in the United States by OpenAI, L.L.C. | European Commission standard contractual clauses, included in OpenAI's data processing agreement |
| Google Cloud (Cloud Translation) | Message translation | Possibly outside the EU | EU–US Data Privacy Framework and standard contractual clauses |
| Twilio Ireland Ltd (Dublin, Ireland), subsidiary of Twilio Inc. | Telephony: receiving and transferring calls (Vostay Voice) | May be processed in the United States | EU–US Data Privacy Framework and standard contractual clauses |
| Stripe Payments Europe Ltd (Ireland) | Subscription payments | European Union and United States | EU–US Data Privacy Framework and standard contractual clauses |
| Brevo (Sendinblue SAS, Paris) | Sending emails (accounts, alerts, invoices) | European Union | No transfer outside the EU |
Stripe. Stripe may also act as an independent controller, for example for fraud prevention and its regulatory obligations.
Authorities. We may share data with authorities where the law requires it.
Booking platforms (Airbnb, Booking.com, Vrbo) are not Vostay's processors. They are independent controllers with which our customers have their own relationship.
7. Transfers outside the European Union
Our servers and backups are hosted in France and the European Union. Some providers listed above may process data outside the EU, in particular in the United States. In that case, the transfer is covered by:
- an adequacy decision of the European Commission (EU–US Data Privacy Framework), where the provider is certified;
- and/or standard contractual clauses adopted by the European Commission.
You can obtain a copy of these safeguards by writing to contact@vostay.fr.
8. Security
We implement appropriate technical and organisational measures to protect data, including:
- encrypted connections (HTTPS);
- strict separation of data between customers;
- role-based access rights;
- protection against repeated login attempts;
- two-factor authentication for Vostay administrators;
- daily encrypted off-site backups.
The detailed list is in Annex 2 of our data processing agreement.
9. Your rights
You have the following rights over your data:
- access: obtain a copy of your data;
- rectification: correct inaccurate data;
- erasure: ask for your data to be deleted;
- restriction: temporarily freeze the use of your data;
- portability: get your data back in a reusable format;
- objection, in particular to marketing, at any time and without giving reasons;
- withdrawal of consent at any time (marketing), without affecting prior use;
- post-mortem instructions: decide what happens to your data after your death.
To exercise your rights, write to contact@vostay.fr. We reply within one month, which can be extended by two months for complex requests. We may ask you to prove your identity if we have reasonable doubts.
If you believe your rights are not respected, you can lodge a complaint with the CNIL (www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France).
10. Are you a guest, or a member of a Vostay customer's team?
This section applies to you if:
- you booked a property managed with Vostay; or
- you work for a Vostay customer (cleaning staff, manager).
In both cases, the controller of your data is the host or property management company you deal with. Vostay processes your data on its behalf, as a processor.
This may involve:
- your booking data: your name, the contact details passed on by the booking platform, your stay dates, your messages and reviews. This data is kept for no more than 3 years after the end of your stay;
- your written messages: they may receive replies drafted by an automated assistant (artificial intelligence). You are told about this in the assistant's first reply. Sensitive matters (refunds, complaints, emergencies) are always passed to a person;
- your calls: if you call the host's number handled by Vostay Voice, an automated assistant answers.
- The conversation is processed in real time by artificial intelligence, then transcribed and summarised for the host. The call is recorded (audio) so the host can listen to it again.
- You are told about this at the start of the call.
- You can ask to speak to a person: the assistant passes your request to the host, who calls you back. In case of danger, a blocking problem you confirm is urgent, or if you are calling for Airbnb, the call is put through to the host: before connecting you, the assistant tells them your first name, your stay and what the problem is. Access codes and wifi given to you on the phone are also sent in writing to your booking messages.
- The recording, the full transcript and your number are kept for 6 months after the call, then deleted automatically; the summary and your requests, like your messages.
- To identify you, the assistant may send a code or a link to your booking messages;
- if you are cleaning staff: the property photos you take are kept for 12 months.
To exercise your rights, please contact your host or employer first. You can also write to contact@vostay.fr. We will forward your request to our customer and help them answer it.
11. Changes
We may change this policy, for example when we add a provider. The date of the last update is shown at the top of the page. If a change is significant, we inform our customers by email or in the application.