Privacy Policy

1. Data controller

PaddockMate is run from France by an independent two-person team (a non-profit project, with no commercial entity to date). For any question about your personal data, contact us at contactyabri@gmail.com.

2. Data we collect

Account: email address, first name (optional), password (never stored in plain text — managed by Supabase Auth).

Consents: the date and time you accepted the Terms of Service, and your newsletter choice (an explicit checkbox — never pre-ticked).

Content you publish: reviews (rating + comment), reports, community listings (freecamp, business, hostel), personal "My spots" points (these stay on your device only, never sent to our servers).

Service usage: employer listings you've viewed (to show you the "already viewed" badge and apply an anti-abuse limit), job listing links opened for free (limited to 5, counted only on your device — never sent to our servers), display preferences (language, night mode) stored on your device.

Donations: if you choose to support us financially (Stripe or Ko-fi), the payment is handled entirely by these providers — we never receive or store your bank details.

Technical data: IP address and standard technical logging information, processed by our hosting provider and Supabase as part of normal website operation.

3. Why we use it (purposes and legal bases)

Providing the service (creating your account, showing full employer listings, saving your reviews and listings) — legal basis: performance of the contract between us and you as a user.

Moderating community content (report system, automatic hiding after 5 distinct reports) — legal basis: legitimate interest in keeping the platform reliable and safe.

Sending the newsletter and promotional offers — legal basis: YOUR EXPLICIT CONSENT (a checkbox at sign-up, never pre-ticked), revocable at any time via the unsubscribe link at the bottom of each email or from your account.

Processing your donation (Stripe or Ko-fi) — legal basis: performance of the contract formed by your voluntary contribution. The payment itself is handled entirely by these providers, off our servers.

Audience measurement (Google Analytics and/or Microsoft Clarity, only if you consent via the cookie banner) — legal basis: your consent, revocable at any time.

4. Who we share your data with

Supabase (database and authentication hosting) — technical processor. Your data is hosted in Australia (Sydney region); this transfer outside the European Union is covered by standard contractual clauses in accordance with the GDPR.

Brevo (sending transactional emails: account verification, notifications — and newsletter emails if you've consented) — a processor based in France, which processes your email address to deliver these messages. Every promotional email contains a working unsubscribe link.

Stripe (card payment processing for one-off or monthly donations) — a PCI-DSS certified processor: we never receive your card number, only confirmation that the payment succeeded.

Ko-fi (donation button and widget shown on the site) — an independent third-party service: clicking it takes you to ko-fi.com, governed by its own privacy policy, outside our control.

Google Analytics and Microsoft Clarity, only if you've accepted audience-measurement cookies — these services may involve data transfers outside the EU; they're only activated after your explicit consent.

We never sell your data to third parties, and we never share it with anyone else.

5. Retention period

Account and associated content (reviews, listings): kept as long as your account is active, deleted within a reasonable period after account deletion (on request at contactyabri@gmail.com).

Employer listing view history: kept for as long as needed for the "already viewed" badge and anti-abuse limit to work, purged periodically.

Contact requests and reports: kept for as long as needed for moderation and to resolve the exchange, then deleted.

Technical data (IP address, logs): kept for a maximum of 12 months for security and diagnostic purposes, then deleted or anonymised.

Newsletter preference: kept until you unsubscribe (link at the bottom of each email or from your account) or until your account is deleted — sending stops as soon as we receive your request.

6. Cookies and trackers

Strictly necessary cookies (login session, language preference): always active, required for the site to work.

Audience-measurement cookies (Google Analytics, Microsoft Clarity): off by default, only activated if you click "Accept" on the cookie banner. You can change your mind at any time via the "Manage cookies" link at the bottom of the page.

7. Your rights

Under GDPR, you have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data.

You can also object at any time to receiving our promotional emails: an unsubscribe link appears at the bottom of every email, and you can change this choice in the "Data" section of your account.

To exercise these rights, write to us at contactyabri@gmail.com — we respond within one month at most.

You can also file a complaint with your country's data protection authority (in France, the CNIL — www.cnil.fr) if you reside elsewhere in the European Union.

8. Security

Authentication and password storage are handled by Supabase Auth (encryption, never plain-text passwords). Data access is protected by strict database-level security rules (Row Level Security), limiting each user to their own sensitive data.

Your newsletter choice is treated as sensitive consent data: only you (via your account or a signed unsubscribe link) can change it, never a third party.

9. Changes to this policy

We may update this policy to reflect changes to the service or to regulations. The last-updated date is shown at the top of this page.

10. Newsletter and promotional emails

You only receive our news and offers if you ticked the "newsletter" box at sign-up (never pre-ticked) or if you subscribe later from your account. Without this consent, no promotional email is sent — only emails essential to the service (address confirmation, password reset).

Every promotional email contains a working unsubscribe link: one click is enough, the effect is immediate and requires no account. You can also change this choice in the "Data" section of your account, or write to contactyabri@gmail.com.

Emails are sent via Brevo (a processor in France): your data is processed in line with its privacy policy, and Brevo manages unsubscribes from its own mailing lists.

Subscribing never conditions access to PaddockMate: the map, employer listings, reviews and all other services remain free and complete, subscribed or not.

11. Donations (Stripe and Ko-fi)

Making a donation on /dons is entirely optional and unlocks no feature: the map, employer listings, job listings and all other services remain free, whether you donate or not.

Card payment (Stripe): the donation form redirects to a secure Stripe payment page. We never see or store your card number — only the payment confirmation (amount, date) comes back to us.

Ko-fi: a button and a floating widget, shown across the site, take you to ko-fi.com if you click them — an independent third-party service. Any data you enter there is governed by Ko-fi's privacy policy, not ours.