Privacy Policy

Data controller

The data controller is the publisher of JARI, a private individual. Data-related requests should be sent to the dedicated email address.

Data collected

The following data is collected.

• Email address
• Phone number (optional)
• Account data: profile, language, saved items
• Posted content: listings, messages, comments, place suggestions
• Uploaded photos
• Technical data: IP address, connection logs, browser information, pages viewed

Purposes and legal basis

Each processing operation relies on the following legal basis.

• Account and listings: performance of the contract
• Marketing emails: consent (withdrawable at any time)
• Security and fraud prevention, legitimate interest
• Retention of connection logs, legal obligation

Retention periods

Data is kept only for the following periods.

• Account: kept while in use, then deleted X months after the last sign-in.
• Listings: X months after publication
• Connection logs: 1 year, under French legal obligation

Processors

The following providers are used to run the service. This list reflects the technologies actually in place.

• Lovable: website hosting and deployment (Cloudflare infrastructure)
• Supabase: database, account authentication, authentication emails, photo storage
• OpenStreetMap Foundation: map tiles for the Map (your IP address is sent when the map loads)
• Google Fonts: web fonts (your IP address is sent when pages load)
• Analytics: no third-party analytics tool is used. Visit statistics are stored in our own database and shared with no one.

Transfers outside the EU

Some of these providers (Lovable/Cloudflare, Supabase, Google Fonts) are established outside the European Union, notably in the United States. Those transfers rely on the European Commission's standard contractual clauses together with the providers' additional safeguards. The OpenStreetMap Foundation is based in the United Kingdom, covered by an adequacy decision.

My rights

Under the GDPR you have the rights of access, rectification, erasure, portability, objection and restriction. Send your request to the dedicated email address: you will receive a reply within one month.

• Access my data: view the information stored about you.
• Edit my data: correct it directly from your profile.
• Delete my account: the request is made through the contact page.
• Export my data: the export is provided manually on request.
• Objection and restriction: you can object to processing based on legitimate interest or ask for it to be restricted.

Complaint to the CNIL

If you believe your data is not processed lawfully, you can lodge a complaint with the French data protection authority, the CNIL: www.cnil.fr (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07).

Security

Traffic is encrypted in transit (HTTPS). Passwords are stored hashed and are never readable. Database access is restricted by row-level security rules, and admin rights are limited to authorised administrators.

Minimum age

A minimum age applies to account creation; no data from children below that age is knowingly collected.