Privacy Policy

1. Data controller

PaddockMate is run from France by an independent two-person team (a non-profit project, with no commercial entity to date). For any question about your personal data, contact us at contactyabri@gmail.com.

2. Data we collect

Account: email address, first name (optional), password (never stored in plain text — managed by Supabase Auth).

Content you publish: reviews (rating + comment), reports, community listings (freecamp, business, hostel), personal "My spots" points (these stay on your device only, never sent to our servers).

Service usage: employer listings you've viewed (to show you the "already viewed" badge and apply an anti-abuse limit), display preferences (language, night mode) stored on your device.

Technical data: IP address and standard technical logging information, processed by our hosting provider and Supabase as part of normal website operation.

3. Why we use it (purposes and legal bases)

Providing the service (creating your account, showing full employer listings, saving your reviews and listings) — legal basis: performance of the contract between us and you as a user.

Moderating community content (report system, automatic hiding after 5 distinct reports) — legal basis: legitimate interest in keeping the platform reliable and safe.

Audience measurement (Google Analytics and/or Microsoft Clarity, only if you consent via the cookie banner) — legal basis: your consent, revocable at any time.

4. Who we share your data with

Supabase (database and authentication hosting) — technical processor. Your data is hosted in Australia (Sydney region); this transfer outside the European Union is covered by standard contractual clauses in accordance with the GDPR.

Brevo (transactional email sending: account verification, notifications) — a processor based in France, which processes your email address to deliver these messages.

Google Analytics and Microsoft Clarity, only if you've accepted audience-measurement cookies — these services may involve data transfers outside the EU; they're only activated after your explicit consent.

We never sell your data to third parties, and we never share it with anyone else.

5. Retention period

Account and associated content (reviews, listings): kept as long as your account is active, deleted within a reasonable period after account deletion (on request at contactyabri@gmail.com).

Employer listing view history: kept for as long as needed for the "already viewed" badge and anti-abuse limit to work, purged periodically.

6. Cookies and trackers

Strictly necessary cookies (login session, language preference): always active, required for the site to work.

Audience-measurement cookies (Google Analytics, Microsoft Clarity): off by default, only activated if you click "Accept" on the cookie banner. You can change your mind at any time via the "Manage cookies" link at the bottom of the page.

7. Your rights

Under GDPR, you have the right to access, rectify, erase, restrict, port, and object to the processing of your personal data.

To exercise these rights, write to us at contactyabri@gmail.com — we respond within one month at most.

You can also file a complaint with your country's data protection authority (in France, the CNIL — www.cnil.fr) if you reside elsewhere in the European Union.

8. Security

Authentication and password storage are handled by Supabase Auth (encryption, never plain-text passwords). Data access is protected by strict database-level security rules (Row Level Security), limiting each user to their own sensitive data.

9. Changes to this policy

We may update this policy to reflect changes to the service or to regulations. The last-updated date is shown at the top of this page.