Privacy policy

The data controller is Vishnugopy Suthaharan (sole proprietor, EI), 16 rue Degas, 95120 Ermont, France, SIREN 905 044 210. Contact for data protection questions: hello@bagdropin.com.

• Account data: name, email address, password (stored hashed), role (traveller or partner). Partners also provide business name, SIRET, address and phone number.
• Guest sessions: if you book by scanning a QR code without an account, we create an anonymous session with a temporary identifier so that you can see your booking.
• Booking data: spot, number of bags, dates, price, booking code, status and history.
• Luggage photos that you upload when you drop off your bags.
• Payment data: handled by Stripe. We receive the status of the payment and limited information (such as the last digits and brand of the card); we do not store your full card number.
• Technical data: IP address, device and browser information, and security logs.
• Messages you send to our support.

• Provide the service: create bookings, process payments, let partners confirm drop-offs and pick-ups (performance of a contract, art. 6(1)(b)).
• Keep photo evidence of the luggage and handle claims (performance of a contract and legitimate interest, art. 6(1)(f)).
• Prevent fraud, secure the service and verify partners' SIRET (legitimate interest, art. 6(1)(f)).
• Meet accounting, tax and other legal obligations (art. 6(1)(c)).
• Answer your requests (legitimate interest or contract).

We do not sell your data and do not use it for advertising or behavioural tracking.

Your data is shared only as needed with:

• the partner of your booking (name, bags, dates, code, photos);
• Stripe for payment processing and refunds;
• Cloudflare (R2 object storage) for luggage photos;
• MongoDB Atlas and our hosting provider (Vercel Inc.) for the database and application;
• the French national address API (api-adresse.data.gouv.fr): only the business addresses entered by partners are sent, never traveller data;
• CARTO and OpenStreetMap, which serve map tiles: your browser requests them directly when a map is shown;
• authorities when the law requires it.

Full list of processors and agreements: [to complete].

Some providers (for example Stripe, Cloudflare or hosting providers) may process data outside the European Economic Area. In that case we rely on an adequacy decision (such as the EU–US Data Privacy Framework) or on the European Commission's standard contractual clauses. Details: [to confirm per provider].

• Account data: until you delete your account, then [period].
• Guest sessions: [period].
• Booking data: [period], and accounting records for the legal period (currently 10 years for accounting documents).
• Luggage photos: [period, for example a few months after pick-up].
• Support requests: [period].

You can access, correct, delete, restrict or port your data, object to processing based on legitimate interest, and give instructions about your data after your death. To exercise these rights, write to hello@bagdropin.com; we may ask for proof of identity. You can also complain to the CNIL (Commission Nationale de l'Informatique et des Libertés), 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.

We use encrypted connections, hashed passwords, access controls, private storage for photos with short-lived access links, and signed payment notifications. No system is perfectly secure; we will notify you and the authorities of a breach where required.

Photos are visible only to you and to the partner of your booking. Please avoid photographing people, faces, identity documents or other personal information. Photos are used as evidence in case of a dispute about the luggage.

The service is intended for adults. Do not create an account or book if you are under 18 without a parent or guardian.

We may update this policy and will indicate the date at the top. See also our cookie policy.