PRIVACY POLICY.

The data controller is SARL Braveheart, trading as Hideout, 60 Route des Udrezants, 74110 Morzine, France. Our company details are in our legal notice.

For any privacy question or request, email info@stayhideout.com or call +33 7 68 63 48 21.

Big Fluffy AI builds and runs this website for us and processes personal data only on our instructions.

When you email or call us: the details you choose to give us, usually your name, email address and telephone number, and our correspondence. We use them to answer you and to arrange your stay or table. Legal basis: steps you ask us to take before a contract, or our legitimate interest in replying to enquiries.

When you send a group enquiry: your name, email address, telephone number if you give it, your dates, group size and message. We use them to answer you and to arrange your group's stay. Legal basis: steps you ask us to take before a contract.

When you accept analytics: how you use the website — the pages you view, the website or search engine that sent you, your device type, how quickly pages load, and actions such as starting a room or table booking, tapping our phone number or searching the site. We use this to understand which pages help guests and to improve the website. Legal basis: your consent, which you can withdraw at any time (section 5).

When you chat with Lucky: your messages and Lucky’s replies, the language and page you used, and your approximate location (country, region, city and time zone) derived from your IP address. We use them to answer you, to review and improve Lucky, and to prevent misuse. Legal basis: our legitimate interest in answering visitors and running a reliable, secure assistant (section 3).

When you book a stay: the identity, contact and payment details our booking system needs, and the details of your stay. We use them to provide your stay and to meet our legal obligations, including invoicing, accounting and, for guests from outside the EU, the police registration form (fiche individuelle de police) French law requires. Legal basis: contract and legal obligation.

When you book a table: your name, contact details, party size and any notes you add. Legal basis: contract.

When you visit this website: your IP address and technical request data, used to deliver the website, keep it secure and limit abuse of the chat, the newsletter sign-up and the enquiry form. Legal basis: our legitimate interest in running a secure website.

When you sign up to our newsletter: your email address, and whether you joined our English or French newsletter (chosen from the language of the page you signed up on). We use them to send you news and offers from Hideout by email. Your address is held in our mailing system, HighLevel (GoHighLevel), which sends the emails for us. Legal basis: your consent. You can withdraw it at any time with the unsubscribe link in every email, or by contacting us (section 11). Signing up is never a condition of booking or of using the chat.

We do not sell personal data, and this website does not use it for advertising.

Lucky answers questions about Hideout. It does not ask for your name or contact details, cannot take bookings or payments, and does not make decisions about you that have legal or similarly significant effects. Please do not type personal, sensitive or payment information into the chat.

Each conversation is saved under a random conversation identifier, with your messages and Lucky’s replies, the language, the page you started from and your approximate location (country, region, city and time zone), which our hosting provider derives from your IP address. We also record the processing cost of each reply, without anything that identifies you. The Hideout team can read saved conversations to improve Lucky.

To generate replies, your messages are sent through the Vercel AI Gateway to AI model providers: OpenAI, and Anthropic as a backup.

Saved conversations are stored in our database in Ireland and deleted automatically after 90 days without activity.

Stay bookings are made on the secure booking pages of Cloudbeds, our reservation system. Cloudbeds collects your identity, contact and payment card details for us, and runs its own analytics and cookies on its pages; see the Cloudbeds privacy policy.

Table bookings are made in a ResDiary booking form shown inside our website. ResDiary collects your booking details for us and may set its own cookies inside that form; see the ResDiary privacy policy.

We receive your booking details from them in order to provide your stay or table.

When you first visit, we ask whether you accept analytics. Nothing is measured until you accept, and declining is as easy as accepting. You can change your choice at any time with the cookie settings link at the foot of every page; when you withdraw, we stop measuring and delete the analytics cookies.

Our own statistics. If you accept, the website records page views, the type of site that sent you, your device type, page-loading times and actions such as starting a booking. It sets no cookie and gives you no identifier that follows you between visits. The detailed records are deleted after 48 hours; we keep only totals.

Google Analytics. If you accept, the website also loads Google Analytics through Google Tag Manager. Google Analytics sets two cookies: _ga, which tells visits apart, and _ga_<ID>, which keeps the state of a visit; each lasts up to two years. Google Analytics does not store your IP address. We use Google Analytics only to measure the website, not for advertising, and we keep its data for the period set in our account, at most 14 months. See how Google uses information from sites that use its services.

We also store preferences in your browser: your analytics choice and, if you choose one, your light or dark display setting.

The ResDiary table-booking form and the Cloudbeds booking pages may set their own cookies (section 4). Staff who sign in to the website's management area use a sign-in cookie; public visitors do not.

Our database, including saved chat conversations, is hosted by Supabase in its Ireland (EU) region.

Newsletter subscribers are held by HighLevel, which hosts its service in the United States.

The website is hosted by Vercel. Its server functions run in London, and pages are delivered through Vercel’s global network, which keeps short-lived request logs.

Rate limiting for the chat and the newsletter sign-up uses Upstash, which briefly processes your IP address as a counter.

Our own website statistics are stored in our database in Ireland. Google Analytics data is processed by Google.

We share personal data only with service providers who process it for us under contract, and with authorities where the law requires it:

Cloudbeds: stay bookings and payments

ResDiary (The Access Group): table bookings

Supabase: database, Ireland

Vercel: website hosting and AI gateway

OpenAI and Anthropic: Lucky’s replies

Upstash: chat and newsletter rate limiting

HighLevel, Inc. (GoHighLevel): newsletter mailing list and emails

Big Fluffy AI: website build, operation and support

Our accountants and bank, and public authorities such as the police or tax office, where the law requires it.

Google Ireland Limited (Google Analytics and Google Tag Manager): website analytics, only if you accept

Vercel, Supabase, Upstash, OpenAI, Anthropic, Cloudbeds, HighLevel and Google are US-based companies or part of US-based groups, so some personal data may be processed in the United States. Where personal data leaves the European Economic Area, we rely on the European Commission’s Standard Contractual Clauses or the provider’s certification under the EU-US Data Privacy Framework. Transfers to the UK rely on the European Commission’s adequacy decision for the UK.

Lucky conversations: as set out in section 3.

Invoices and accounting records: 10 years, as French commercial law requires.

Police registration forms for guests from outside the EU: six months, as French law requires.

Newsletter subscription: until you unsubscribe.

Booking records and email correspondence: kept for as long as we need them to provide your stay and meet our legal and accounting obligations, then deleted.

Website request logs: a short period, set by our hosting provider.

Group enquiries: for as long as we need them to answer you and arrange your stay, then deleted.

Our own website statistics: detailed records 48 hours; totals without personal data are kept.

Google Analytics: the period set in our Google Analytics account, at most 14 months; its cookies last up to two years unless you withdraw consent.

You have the right to:

be informed about how we use your data (this policy);

access your data and get a copy of it;

have inaccurate or incomplete data corrected;

have your data erased;

restrict how we use your data;

receive the data you gave us in a portable format;

object to processing based on our legitimate interests, and to direct marketing at any time;

withdraw any consent you have given, without affecting processing before you withdrew it;

give instructions about what happens to your data after your death (French Data Protection Act, article 85);

complain to a data protection authority (section 12).

We do not make decisions about you based solely on automated processing, including profiling, that have legal or similarly significant effects.

Email info@stayhideout.com or call +33 7 68 63 48 21. We may ask you to verify your identity. We will reply within one month, and tell you if a complex request needs longer, as the GDPR allows.

Lucky conversations are not linked to your name, so to delete one, tell us roughly when you chatted and what about. For booking data, we also act in our booking systems, subject to the records the law requires us to keep.

If you are unhappy with how we handle your data, please contact us first. You can also complain to the French data protection authority, the CNIL: 3 Place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France; www.cnil.fr.

If you live in the UK, you can also contact the Information Commissioner’s Office (ico.org.uk). If you live elsewhere in the EU, you can complain to your local data protection authority.

Our hotel rooms and dorms are for adults. This website is not aimed at children under 15, and we do not knowingly collect their data. If you think a child has given us personal data, contact us and we will delete it.

If a personal data breach happens, we will notify the CNIL within 72 hours where the law requires it, and tell you without undue delay if the breach is likely to put your rights and freedoms at high risk.

We will update this policy whenever the way we use personal data changes, for example before we add a new way of collecting your details, and change the “last updated” date at the top of this page.