Privacy on the venue portal

The portal business.vibefinder.com is run by VibeFinder SAS, 60 rue François 1er, 75008 Paris, which decides how your data is used. Contact: privacy@vibefinder.com. This page covers the portal only. For the guest app, the website and your rights in full, see our full privacy policy.

One VibeFinder account opens both this portal and the guest app at go.vibefinder.com. Your name and photo are the same in both: change your name here and it changes there. The portal also keeps your business profile (role, phone if you give one, language, whether you want product emails) and, for each venue, your claim, the draft you are working on and a record of who published what and when.

If you answer "Yes, contact me" to our question about connecting your booking system, we send your sign-in email and your booking link to our team so we can reply.

Why

To run your account and the listings you manage.

Legal basis

Providing the service you signed up for (GDPR Article 6(1)(b)).

How long

As long as your account exists. Deleting it removes your account, profile, claims and drafts in both apps. What you published about the venue (hours, photos, menu) stays with the venue, because it describes the business.

When you claim a venue you type its SIRET. We look it up in our copy of the public SIRENE register, or else through the State's Recherche d'entreprises service (recherche-entreprises.api.gouv.fr), which then receives the number. If the establishment is active and its address matches the venue, the claim is confirmed automatically. When we ask Recherche d'entreprises, we also compare the name on your account with the public list of directors it sends back. That result is recorded but decides nothing today. We do not keep the list of directors, and it never reaches your browser. From the comparison we keep only the result and the number of directors. The initials of a director who matched appear on your screen and are not saved.

The check refuses a claim on its own in three cases only: the number is not a valid SIRET, it is not in the register, or the register lists the establishment as closed. You can then enter another number or write to us. Whenever the answer is less clear (an address the register hides, one too far from the venue, a different postcode), a person on our team looks at the claim and emails you the decision. If you disagree with an automatic result, ask and a person will review it. We never ask for a selfie or an identity document.

Why

To stop people claiming a business that is not theirs and to protect the venues listed on VibeFinder.

Legal basis

Our legitimate interest, stated on the line above (GDPR Article 6(1)(f)). You can object to it.

How long

The record of the check is kept with your claim (next section).

For each claim we keep the venue, the SIREN and registered name, the status, the checks that ran and their outcome, the date, and any decision our team made, with who made it. While that record exists, a claim our team removed cannot be reopened by typing the SIRET again.

Why

To know who may manage each venue, and to explain a decision if it is challenged.

Legal basis

Our legitimate interest, stated on the line above (GDPR Article 6(1)(f)). You can object to it.

How long

As long as your account exists. Deleting your account deletes your claims with it.

A verified owner can invite a colleague by email as Admin or Staff. We keep the colleague's email address, the role, the language of the email, who sent it and the dates. The link in the email is stored only as a hash, a fingerprint we cannot turn back into the link. It works once and expires after 7 days.

If you were invited: we got your address from the person who invited you, not from you. If you were not expecting the email, ignore it and nothing happens.

Why

To let a business run its listing with the people it works with.

Legal basis

Our legitimate interest, stated on the line above (GDPR Article 6(1)(f)). You can object to it.

How long

The invitation is deleted 30 days after it is accepted, cancelled or expired.

An agency that runs listings for a brand can ask to manage its venues. It types the email address of a contact at the brand, on the brand's own domain, sometimes with a name, and confirms that it is allowed to act. We email that contact, who can confirm or report a mistake. The link is stored only as a hash and expires after 7 days.

If you are that contact: we got your address from the agency, not from you.

Why

To make sure an agency only manages venues the brand agreed to.

Legal basis

Our legitimate interest, stated on the line above (GDPR Article 6(1)(f)). You can object to it.

How long

The confirmation is deleted 30 days after it is answered, replaced or expired. An agency's access ends on the end date set for it, or when the brand or the venue's owner removes it.

If you connect an Instagram account, Meta gives us the account's id and username and an access key, which we store encrypted. We read the list of your videos. Only a video you pick is copied to our storage, with its preview image, to play on the venue's card. Videos you upload from your phone are stored the same way.

Why

To show videos of your venue on its card.

Legal basis

Providing the service you signed up for (GDPR Article 6(1)(b)).

How long

The access key until you disconnect, when we delete it. Videos stay until you remove them, 12 per venue at most. To cut access on Instagram's side too, remove the app in Instagram's settings.

When you type your venue's website, in the demo or at sign-up, our server reads its home page and a few pages of the same site, following its robots.txt: name, kind of place, address, hours, contact details, prices, its own description, up to four photos, and the SIRET from its legal notice, which we only offer as a suggestion. It works by fixed rules, never with an AI model. The demo needs no account.

Why

To fill in the demo or your sign-up for you, when you ask.

Legal basis

Our legitimate interest, stated on the line above (GDPR Article 6(1)(f)). You can object to it.

How long

A reading is deleted after 24 hours. If you create a venue from it, the details go into your draft and the photos are held for up to 30 days until you add them. The vfv-demo and vfv-site cookies that remember it last 24 hours.

When you ask, Mistral AI, a French company, writes your venue's description from your answers. It also translates the description from our catalog into your language so you can read it. These texts are marked as written by an AI, on screen and in the page's code, and you can change every word before you publish.

Why

To help you write your listing.

Legal basis

Providing the service you signed up for (GDPR Article 6(1)(b)).

How long

The text stays in your draft and, once published, with the venue.

You can import your menu from a file, a web page, pasted text or photos. Photos are read inside your browser: the picture never leaves your device, and only the text read from it reaches us. The reading engine (Tesseract) is downloaded from jsDelivr, which sees your IP address when it sends it. A web page you give us is fetched once by our server. No AI model is involved.

Why

To put your menu on your listing without retyping it.

Legal basis

Providing the service you signed up for (GDPR Article 6(1)(b)).

How long

Your menu stays until you replace or delete it.

The Feedback button sends your message, its type, the page you are on, your language, your browser and screen size, and your email address if you type one. We do not attach your account. The message is stored and emailed to our team.

Why

To fix and improve the portal.

Legal basis

Our legitimate interest, stated on the line above (GDPR Article 6(1)(f)). You can object to it.

How long

12 months, then deleted automatically. Write to us and we will delete yours sooner.

The portal sets only the cookies it needs to work, so none of them asks for your consent:

• sb-…: keep you signed in (the Supabase session cookies).
• vfv-locale: the language you read the portal in, for one year.
• vfv-demo: which demo you chose, for 24 hours.
• vfv-site: the website you typed at sign-up, for 24 hours.
• vfv-connect-instagram: a one-time code, for 10 minutes while you connect Instagram, to check that the answer comes from your own request.

Your browser also keeps vfv-theme (light or dark) in its own storage.

None is used for advertising or to measure audience.

These services receive data from the portal, each for one task:

• Vercel Inc.: hosts the portal. US company, servers in Paris.
• Supabase Inc.: database, sign-in and file storage. US company, data stored in Paris.
• Mistral AI: AI writing and translation. France.
• AhaSend: sends the emails (account emails, invitations, claim decisions, feedback). European company (Austria), data stored in the European Union.
• Meta Platforms Ireland: only if you connect Instagram. Ireland. Meta is also responsible for its own service.
• jsDelivr: delivers the menu reading engine to your browser. Poland, with servers worldwide.
• recherche-entreprises.api.gouv.fr: the State's business register service (DINUM), which receives the SIRET you type. France.

Where a company is based in the United States, any access from there relies on the EU-US Data Privacy Framework or on the European Commission's standard contractual clauses.

You can ask for access to your data, for it to be corrected or deleted, for a limit on how we use it, and for a copy in a reusable format. You can object to anything we do on the basis of our legitimate interest.

In your account you can export your data (a readable copy and a JSON file) and delete your account, for the portal and the guest app together.

For anything else, write to privacy@vibefinder.com. We answer within one month.

If our answer does not satisfy you, you can complain to the CNIL, the French data protection authority: cnil.fr.