Privacy Policy — Getstockage

1. Who is responsible for your data

The data controller is Liflio, a French SAS registered with the RCS Bordeaux under number 930 697 339, with its registered office at 18 rue Eugène Le Roy, 33800 Bordeaux, France ("Getstockage", "we"). Getstockage is the trading name of the service operated by Liflio. If the operation of Getstockage is transferred to a dedicated company (Terms, section 30), you will be informed at least 30 days in advance; that company will then become the controller of your data, under the conditions described here.

• Personal data contact: contact@getstockage.com
• Data Protection Officer (DPO): [to confirm — no DPO has been appointed so far; appointment does not appear mandatory, to be validated]

This policy applies to the Getstockage mobile app and the getstockage.com website, under Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act (loi n° 78-17 of 6 January 1978).

2. The data we collect

Identity and account

• first name, last name, profile photo, e-mail address, password (stored encrypted) or Google/Apple sign-in identifier, language;
• phone number (verified by SMS);
• verification status (e-mail, phone, identity), role (Host, Renter), private or professional status.

ID documents and selfie

• photo of an ID document and a selfie, submitted for identity verification, then deleted 30 days after the decision;
• verification result (status, date, document type).

Verification is done by a team member who visually compares the images. No biometric template is created.

Location

• the device's precise location, only if you allow it, to show nearby Spaces. It is used for the search and is not stored on our servers;
• address and GPS coordinates of the Spaces published by Hosts.

Listings, bookings and content

• description, photos, price, availability and access instructions of Spaces;
• bookings (dates, amounts, status, cancellations, withdrawals);
• messages and photos exchanged in the messaging;
• reviews and replies to reviews;
• reports, blocks, disputes and support requests.

Entry photos and Getstockage Guarantee claims

• dated photos of the goods and of the Space taken at drop-off (inventory);
• claims: description, list and value of the goods, photos, proof (invoices);
• for theft, the police report receipt. [TO BE VALIDATED: rules on data relating to criminal offences, article 10 GDPR and article 46 of the French Data Protection Act.]

Payment

• card data is entered and processed directly by Stripe: we never see or store your full card number. We keep technical references (Stripe customer and payment identifiers, card brand and last 4 digits) and the history of payments, refunds and failed payments;
• for Hosts: Stripe Connect account identifier, Stripe verification status and transfer history. The identity and bank information needed to open the account is collected by Stripe.

Hosts' tax data (DAC7)

• identity, address, date of birth, tax identification number (and, for a professional, registration and VAT numbers), bank details, address of each Space, amounts received, commissions charged and number of rentals per quarter. [TO CONFIRM: collection not yet implemented; final list.]

Device and usage

• push notification token, device model and operating system, app version;
• notification preferences;
• crash reports and performance data (Sentry): technical account identifier, device, version, error trace. E-mail addresses and phone numbers are masked before sending;
• login and security logs.

3. Why we use your data (purposes and legal bases)

You can object to processing based on our legitimate interest and withdraw your consent at any time (section 7).

No marketing or targeted advertising. We do not send marketing e-mails at launch. If this changes, we will ask for your consent where the law requires it. [TO CONFIRM]

Automated decisions. No decision with legal effects on you is made solely by automated means. Identity verification, Listing review and Guarantee decisions are made by people. Quality badges are calculated automatically from published criteria and can be corrected by the team.

4. Who receives your data

Other Users, only as needed:

• public profile: first name, photo, verification badges, member since, average rating and reviews;
• for each request, a Host sees the Renter's profile, verification status, reviews and message;
• the Space's access instructions are shared with the Renter only after the Booking is confirmed;
• your phone number and e-mail address are not shown to other Users. [TO CONFIRM]

Authorised Getstockage staff (support, moderation, verification, Guarantee), on a need-to-know basis.

Our processors (article 28 GDPR), which process data on our behalf and on our instructions:

[TO CONFIRM: Google's role for Google Maps Platform (processor or separate controller) under the applicable terms.]

Separate controllers:

• Stripe, for its own obligations (fraud and money-laundering prevention, Host identity checks), under its own privacy policy;
• Google and Apple, if you sign in with your Google or Apple account.

Authorities: tax authorities (DAC7), judicial or administrative authorities where the law requires it.

Getstockage does not sell your data and does not share it for advertising.

5. Transfers outside the European Union

Some providers are based in the United States (Supabase, Expo, Google, Sentry, and Stripe for some processing). Depending on the provider, these transfers rely on:

• the European Commission's adequacy decision for the EU–US Data Privacy Framework, where the provider is certified;
• otherwise, the standard contractual clauses adopted by the European Commission in 2021, with additional measures where needed.

You can get a copy of these safeguards by writing to contact@getstockage.com.

6. How long we keep data

Why 5 years for Guarantee claims. A Renter or a Host may contest a decision or go to court during the general 5-year limitation period (article 2224 of the French Civil Code). We keep the file for that period, with restricted access, to be able to establish, exercise or defend legal claims, and then delete it.

7. Your rights

You have the following rights over your data:

• access: get a copy of your data;
• rectification: correct inaccurate data (most of it can be edited in your profile);
• erasure: ask for your data to be deleted, in particular by deleting your account;
• restriction: ask for processing to be temporarily frozen;
• portability: receive the data you gave us in a machine-readable format;
• objection: object to processing based on our legitimate interest;
• withdrawal of consent at any time (notifications, location), in your device or app settings;
• post-mortem instructions: give instructions about what happens to your data after your death (article 85 of the French Data Protection Act).

Some rights are limited where the law requires us to keep data (for example accounting records or DAC7 data) or where data is needed to defend legal claims.

8. Exercising your rights and complaints

• Write to contact@getstockage.com, or use Support in the app.
• To delete your account: Profile > Settings > Delete my account, or https://getstockage.com/suppression-compte/.
• We reply within one month of receiving the request. This can be extended by two months for complex or numerous requests; we will tell you within the first month. We may ask for proof of identity if we have reasonable doubts; it is deleted as soon as the check is done.

If you believe your rights are not respected, you can complain to the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — www.cnil.fr) or to the data protection authority of your country of residence.

9. Security

We use appropriate technical and organisational measures, including:

• encryption in transit (HTTPS/TLS);
• strict per-User access rules in the database;
• storage of ID documents, entry photos and Guarantee files in private storage, accessible only to authorised staff through temporary links;
• access to admin tools limited to authorised staff;
• payments processed by Stripe, which is PCI-DSS certified;
• automatic deletion of ID documents 30 days after the decision;
• masking of e-mail addresses and phone numbers in crash reports.

In the event of a data breach, we notify the CNIL within 72 hours where the breach poses a risk to your rights, and we tell you without undue delay if the risk is high. [TO CONFIRM: measures actually in place at launch.]

10. Minors

The Platform is for people aged 18 or over. We do not knowingly collect data about minors. If we learn that an account belongs to a minor, it is deleted.

11. Cookies, trackers and SDKs

The app uses no advertising trackers and no audience measurement tools, and does not track you across other apps or websites. It uses only technologies needed for it to work (login session, preferences, notifications) and Sentry for crash reports.

The getstockage.com website sets no analytics or advertising cookies. Details are in the cookies and trackers policy: https://getstockage.com/en/cookies/.

12. Changes

We may change this policy. If there is a significant change, you will be told by e-mail or in the app before it takes effect. The last updated date is shown at the top of this document.