← Back to SnapSpot Paris

Privacy Policy

Last updated: 22 October 2026

1. Introduction

This privacy policy describes how SnapSpot Paris (hereinafter "we", "our" or "the Platform") collects, uses, stores and protects your personal data when you use our service connecting clients and photographers.

We are committed to respecting your privacy in accordance with the General Data Protection Regulation (GDPR - EU Regulation 2016/679) and the French Data Protection Act of 6 January 1978 as amended.

2. Data collected

2.1 Data you provide to us

Category	Data	Purpose
User account	First name, last name, email address; optional password (hashed with scrypt, salted). Sign-in is also possible without a password, with a one-time code sent by email: valid for 10 minutes, stored encrypted, then deleted after use or expiry	Creation and management of your account
Profile picture	Uploaded image (optional)	Profile personalisation, display in the app
Bookings	Date, time, location, chosen pack, price; where your visit came from and country (see 2.4)	Performance of the service contract, history
Messages	Content of conversations between client and photographer	Communication between parties, moderation in case of dispute
Reviews	Rating (1-5), text comment	Service improvement, trust between users
Payment	Card details are processed directly by Stripe (we never store your card numbers)	Secure payment of services

2.2 Additional data for photographers

Category	Data	Purpose
Professional profile	Bio, specialties, languages, availability	Presentation to clients, search
Portfolio	Photographs, captions	Professional showcase
Posts (Snappies)	Photos, captions, tags, locations	Community feed, visibility

2.3 Data collected automatically

• Session data: IP address, browser (User-Agent), date and time of connection — for account security and abuse prevention.
• Authentication cookies: a strictly necessary session cookie that keeps you signed in (valid for 7 days, extended when you use the service) and, for the duration of a sign-in with Google or a two-factor authentication, a temporary cookie lasting a few minutes. These cookies are exempt from consent under CNIL guidelines.

We use no advertising cookies and no third-party analytics (no Google Analytics, no Meta Pixel). Our audience measurement is built in-house and described below.

2.4 Audience measurement (cookie-free)

To know how many people visit the site and how they got here, we measure traffic ourselves, with no third-party analytics tool and no cookie.

• What is measured: the page or screen viewed, certain actions in the app (for example opening a booking, a cancellation, a language change) with minimal context (spot concerned, step), the referring site if any (referrer, utm_* campaign parameters), device type, browser, operating system and country, derived from your IP address at the moment of the visit.
• What is never kept: neither your IP address nor your full User-Agent. To tell two visitors apart within a single day we compute an irreversible fingerprint (SHA-256) from a secret salt that changes every night: today's fingerprint can be linked neither to you nor to yesterday's visit. Since 9 August 2026 this fingerprint is only a fallback: counting relies first on the ss_vid identifier described below.
• No cookie is set, but two items are stored in your browser's local storage (localStorage):
  • ss_vid — a randomly drawn number, kept for 13 months from its creation and then replaced by a new one. It derives from nothing about you: not your IP address, not your account, not any feature of your device. It is sent to our server with each measurement (page view or action) and stored with it: this is what lets us recognise that two visits made on different days come from the same browser, so that we count people rather than trips, and rebuild the path of a visit (sequence of pages viewed) in our statistics tool.
  • ss_attribution — where you first arrived from, when you come from another site or a campaign link (referring site, utm_* parameters, landing page). It has no expiry date. If you book a session, this origin is sent to our server and stored with your booking, together with the country derived from your IP address, so that we know which promotional efforts lead to bookings.
  This information is sent only to our server, never to a third party and never for advertising. You can erase ss_vid and ss_attribution at any time by clearing this site's data in your browser.
• Opting out: open https://snapspotparis.com/?ss_optout=1. Your browser immediately stops sending page-view and action measurements, across every page of the site, and the setting is remembered. To undo it, open the same address with ?ss_optout=0.
• Retention: 25 months for measurements, in line with the French CNIL's recommendation for audience measurement; beyond that, they are deleted automatically. The origin stored with a booking is kept with that booking (section 7).
• Legal basis: legitimate interest (Art. 6.1.f) — knowing the traffic on our own site and how effective our promotional efforts are. We consider that audience measurement falls under the consent exemption provided for by the CNIL (statistical use only, for our own account, with no sharing and no advertising); this is why no banner is imposed on you.
• Your rights: the measurements contain neither your name, nor your email, nor your IP address, and we cannot link them to your account. To exercise your rights over the measurements associated with your browser, write to us (section 8) stating the value of ss_vid: without it, we cannot find them. The origin stored with a booking is part of that booking's data.

3. Legal bases for processing

Processing	Legal basis (GDPR Art. 6)
Account creation, bookings, payment, photo delivery, communication	Performance of the contract (Art. 6.1.b)
Moderation of messages in case of dispute	Legitimate interest (Art. 6.1.f) — user safety and dispute resolution
Retention of invoices and accounting data	Legal obligation (Art. 6.1.c) — Art. L123-22 French Commercial Code (10 years)
Sending transactional emails (confirmation, reminder)	Performance of the contract (Art. 6.1.b)
WhatsApp notifications (confirmation, reminder, photos delivered) — phone number provided voluntarily	Consent (Art. 6.1.a) — dedicated checkbox, revocable at any time
Account and service security (IP, request rate limiting, abuse detection, technical error monitoring)	Legitimate interest (Art. 6.1.f)

4. Moderation of conversations

In the event of a dispute, report or abusive behaviour, the SnapSpot Paris moderation team may access the messages exchanged between a client and a photographer in order to resolve the matter fairly.

This access is:

• Limited to authorised administrators;
• Strictly necessary to resolve the dispute;
• Logged in our internal records (who accessed, when, why);
• Based on our legitimate interest in ensuring safety and trust on the platform.

By registering, you accept this moderation possibility, which is essential for the proper functioning of the service.

5. Data recipients

Your personal data is accessible only to:

• The SnapSpot Paris team (platform administration);
• Your counterparty in a booking (the client sees the photographer's name/profile and vice versa);

It is processed by the following sub-processors, acting on our behalf:

Sub-processor	Function	Location	DPA
Supabase Inc.	PostgreSQL database	EU-West-3 (Paris, France)	DPA
Stripe Inc.	Online payments	USA (SCC signed)	DPA
Cloudflare Inc.	File storage (R2), backups	USA / EU (SCC signed)	DPA
Hostinger International Ltd	Server hosting (VPS)	EU (Lithuania / France)	DPA
Google (Gmail SMTP)	Sending transactional emails	USA (SCC signed)	DPA
Functional Software, Inc. (Sentry)	Monitoring of technical errors on the server: description of the error (message, route concerned, browser, internal identifier of the account concerned, excerpts of technical logs that may contain an email or IP address). Passwords, cookies, request contents and access tokens are masked before sending.	Data hosted in the EU (Frankfurt, Germany); company established in the USA (Data Privacy Framework, SCC)	DPA
Twilio Inc.	Sending WhatsApp notifications, only if you have enabled them: phone number and message content (names, date, time and location of the session). The message is then carried by WhatsApp (Meta).	USA (Data Privacy Framework, SCC)	DPA

Sub-processors based in the United States have signed the European Commission's Standard Contractual Clauses (SCC), in accordance with article 46 of the GDPR, ensuring an adequate level of protection of your data.

Third-party services contacted directly by your browser

To display some pages, your browser downloads elements directly from third-party services, which therefore receive your IP address and the technical details of the request (browser, originating page):

• Google Fonts (Google): fonts, on every page;
• Cloudflare R2: public photos (profiles, portfolios, posts) and photo uploads by photographers;
• jsDelivr: technical libraries of the map;
• OpenFreeMap: map backgrounds;
• opendata.paris.fr and geo.api.gouv.fr: public geographic data shown on the map;
• Open-Meteo: weather forecast for a spot (spot coordinates and session date);
• Google (lh3.googleusercontent.com): profile photo of an account created with Google.

Services you choose to use

• Sign in with Google: Google authenticates you and sends us your name, email address and profile photo.
• Payment: you enter your card details on the payment page hosted by Stripe.
• Push notifications: if you enable them, they go through your browser's notification service (for example Google, Apple or Mozilla), which receives their content in encrypted form.
• Calendars: adding a session to Google Calendar from an email sends Google the session details (photographer, date, location, package); a photographer who subscribes a calendar service to their SnapSpot calendar makes that service read their upcoming sessions (client name, date, location).

6. Transfers outside the EU

Some data may be transferred outside the European Economic Area (EEA), exclusively to the sub-processors and services listed above. These transfers are governed by:

• The Standard Contractual Clauses (SCC) approved by the European Commission;
• The EU-US Data Privacy Framework for certified sub-processors.

7. Retention period

Data	Retention period	Justification
Active user account	As long as the account is active	Performance of the contract
Account after deletion	Anonymised immediately, accounting data kept 10 years	Art. L123-22 French Commercial Code
Phone number (WhatsApp notifications)	Until consent is withdrawn or the number erased; deleted when the account is deleted	Consent (Art. 6.1.a)
Delivered session photos	While the account is active; after 12 months of inactivity: email warning then deletion 30 days later; deleted immediately when the account is deleted	Performance of the contract, data minimisation
Messages	Deleted when the account is deleted	Right to erasure
Session data (IP, user-agent)	Until session expiry	Security
Invoices / bookings	10 years (anonymised if account deleted)	Legal accounting obligation
Encrypted backups (R2)	30-day rolling window	Disaster recovery

When the photographer delivers your photos through their own gallery service, those photos are hosted by that service, under the photographer's responsibility; SnapSpot Paris only keeps the delivery date and, if one was given to you, the gallery link (erased when your account is deleted).

8. Your rights

In accordance with the GDPR, you have the following rights over your personal data:

• Right of access (Art. 15): obtain a copy of all the data we hold about you. Available directly from your profile > "Download my data".
• Right to rectification (Art. 16): correct inaccurate or incomplete data. Editable in your profile settings.
• Right to erasure (Art. 17): request the deletion of your account and personal data. Available directly from your profile > "Delete my account".
• Right to portability (Art. 20): receive your data in a structured, machine-readable format (JSON). Same button as the right of access.
• Right to object (Art. 21): object to processing based on legitimate interest.
• Right to restriction (Art. 18): request the suspension of the processing of your data in certain cases.

To exercise your rights, contact us at: snapspotparis@gmail.com

We will respond within a maximum of 30 days of receiving your request.

9. Data security

We implement the following technical and organisational measures to protect your data:

• Encryption in transit (HTTPS/TLS on all communications);
• Encryption at rest (Supabase database, Cloudflare R2 backups);
• Password hashing (salted scrypt, irreversible);
• Rate-limiting against brute-force attacks;
• HTTP security headers (Helmet.js: X-Frame-Options, X-Content-Type-Options, etc.);
• Row Level Security (RLS) enabled on all database tables;
• Administrator access restricted by role and authentication;
• Automatic daily backups with 30-day retention.

10. Data breach

In the event of a personal data breach likely to create a risk to your rights and freedoms, we undertake to:

• Notify the CNIL within 72 hours (Art. 33 GDPR);
• Inform you as soon as possible if the risk is high (Art. 34 GDPR);
• Take all necessary corrective measures.

11. Complaint

If you believe that the processing of your data does not comply with the regulations, you have the right to lodge a complaint with the CNIL:

12. Changes

We may update this privacy policy at any time. In the event of a substantial change, we will inform you by email or in-app notification. The date of the last update appears at the top of this document.