1. Who is responsible
The controller of your personal data is LDC LMT DIGITAL CREATIONS, publisher of Amoenia (full details in the legal notice). For anything about your data, write to info@amoenia.com.
2. What we collect and why
| Data | Why | Legal basis | Kept for |
|---|---|---|---|
| Early access list (amoenia.com): your email address, the language of the page and the date you signed up | To tell you when Amoenia opens and offer you the early price | Your consent | Until you ask us to remove you, and at most 3 years after our last contact with you |
| Account (app.amoenia.com): your name, email address and Google account identifier, sent by Google when you sign in | To create your account and keep it secure | Performance of our contract with you (the terms of use) | As long as your account exists |
| What you enter in the app: retreats, costs, prices, guests and payments | To provide the service | Performance of the contract | As long as your account exists; deleted when you delete your account |
| Usage events (app.amoenia.com): when you sign up, create a retreat, complete a budget, add a guest, record a payment or start a purchase, and the days you open the app. Never the content you enter | To understand how Amoenia is used and improve it | Our legitimate interest in improving the service | As long as your account exists; deleted with it |
| Billing (if you subscribe or buy): your Stripe customer identifier, your plan, the status and renewal date of your subscription. Never your card details | To manage your plan | Performance of the contract | As long as your account exists |
| Technical data: IP address and browser information | To protect the form and the app against abuse | Our legitimate interest in keeping the service secure | Early access form: a shortened hash of the IP address, for 1 hour. App: in memory, for 1 minute. Our host's server logs: according to the host's own retention |
| Advertising measurement (amoenia.com and app.amoenia.com), only if you accept cookies: that you came from one of our Google ads, the pages you visit and that you created an account. Never your name, your email address or what you enter in the app | To know which ads bring sign-ups, and to show our ads again to people who visited Amoenia (remarketing) | Your consent, which you can withdraw at any time | Your choice: 6 months. Google Ads cookies on amoenia.com: up to 90 days. Google's own cookies: according to Google's policy |
We do not sell or rent your data to anyone. Apart from the Google Ads measurement above, which needs your consent, we do not use it for advertising, and what you enter in the app is never shared with any advertiser.
3. Your guests' data
When you record guests in the app, you decide what is recorded and why. You are the controller of that data; we process it on your behalf, as a processor, under the data processing terms in our terms of use.
This means you are responsible for informing your guests and for having a legal basis to record their data. If a guest contacts us about their data, we will refer them to you and help you answer.
4. Who receives the data
- Hostinger International Ltd. (Cyprus) hosts the website, the application and the database, on servers in the European Union.
- Google (Firebase Authentication, provided by Google Ireland Limited and Google LLC) handles "Continue with Google" and stores your account identifier, email address and name. Google may process this data in the United States. These transfers rely on the EU–US Data Privacy Framework, under which Google LLC is certified, and on the European Commission's standard contractual clauses.
- Stripe (Stripe Technology Europe Limited and its affiliates) handles payments and sells your purchase through Link, its merchant of record. Stripe receives your name, email address, billing address and payment details directly on its checkout page; we never see your card number. For that data Stripe acts as an independent controller under its own privacy policy.
- Google Ads (Google Ireland Limited and Google LLC), only if you accept cookies, receives the data described under "Advertising measurement" above. Google uses it to measure our ads and, for remarketing, to show you our ads on other sites; for that use Google acts as an independent controller under its own privacy policy. Transfers to the United States rely on the same EU–US Data Privacy Framework and standard contractual clauses.
Your guests' data is stored only with Hostinger and is never sent to Google or Stripe. Nobody else receives your data, except an authority when the law obliges us to disclose it.
5. Cookies and browser storage
Before any advertising cookie, amoenia.com and app.amoenia.com ask for your consent. If you click Accept, the Google Ads tag loads: it sets its cookies (_gcl_au and, after a click on an ad, _gcl_aw) on amoenia.com, and Google sets its own cookies on its domains, to measure our ads and show them again to people who visited Amoenia. If you click Reject, or do not answer, nothing from Google Ads is loaded.
Your choice is kept for 6 months in a cookie named amoenia_consent, shared by amoenia.com and app.amoenia.com; after that we ask again. You can change it at any time with the "Cookies" link at the bottom of every page of amoenia.com, or in the app under Profile, Account. When you withdraw your consent, the Google Ads cookies on amoenia.com are deleted.
app.amoenia.com also keeps your sign-in session in your browser's storage, through Firebase. This is strictly necessary to keep you signed in, so it does not require consent.
6. How long we keep it
The retention periods are listed in the table above. When data is deleted, it may remain for a short time in our host's backups until they are overwritten.
7. Security
- Every page and every request is served over HTTPS.
- The early access list is stored outside the public part of the web server, so it cannot be reached from the internet.
- The production database only accepts connections from our server.
- Every request to the app checks that the retreat or guest belongs to the signed-in account.
- We never see or store your Google password: Google handles the sign-in.
8. Your rights
You can ask to access, correct or delete your data, to restrict or object to its processing, and to receive it in a portable format. You can withdraw your consent to the early access list or to cookies at any time. You can also leave instructions about what happens to your data after your death.
Write to info@amoenia.com. We answer within one month. You can delete your account yourself at any time, in the app under Profile: the account and all its retreats, guests and payments are deleted at once, and any subscription is cancelled. You can also write to us from the email address of the account, and we delete it within 30 days.
If you think we are not respecting your rights, you can complain to the French data protection authority, the CNIL (www.cnil.fr, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07), or to the authority of the EU country where you live.
9. Age
Amoenia is made for adults who organize retreats. It is not intended for anyone under 18.
10. Changes to this policy
When this policy changes, we update this page and its date. If a change is significant, we tell account holders by email before it applies.