Privacy policy

DRAFT — pending professional legal review. Not legally validated.

Controller

[Legal name], [Tax ID], [address], [email]. [Data protection officer, if appointed].

Data we process

• Booking data: name, email, optional phone, booking details.
• Custody data: bag tags, photos of luggage taken at drop-off, custody events.
• Payment data is processed by Stripe; we do not store card details.
• Store and partner accounts: contact, tax and payout details.

Purposes and legal bases

• Providing the booked service (contract).
• Fraud prevention and security of custody (legitimate interest).
• Accounting and tax obligations (legal obligation).

Retention

[Define retention periods: e.g. booking data X years for tax purposes; luggage photos Y days after pick-up unless an incident is open.]

Recipients

The participating store, payment provider (Stripe), email provider (Resend), hosting (Vercel), database (Neon), file storage (Cloudflare R2). [Confirm data processing agreements and international transfers.]

Your rights

Access, rectification, erasure, restriction, portability and objection: write to [email]. You may complain to the Spanish Data Protection Agency (AEPD).

Children and minors

SHEILI is open to travelers of any age; we do not ask for your age or for identity documents to book. Booking data is processed to provide the service you booked (performance of a contract), not on the basis of consent. Optional cookies and any other processing based on consent need you to be old enough to consent in your country (for example 14 in Spain, 15 in France, 16 in Germany, 14 in Italy, 13 in Portugal); if you are younger, a parent or guardian must agree. Parents or guardians can contact us to exercise a minor's rights. [PENDING LEGAL VALIDATION]