Privacy

Privacy policy

This translation is provided for information only. Only the French version is legally binding.

Website muvia-solutions.fr, application app.muvia-solutions.fr and MUVIA services

Last updated: 23 October 2026

Preamble

The purpose of this privacy policy (hereinafter the "Policy") is to inform the people whose personal data is processed in connection with the website muvia-solutions.fr, the application app.muvia-solutions.fr and the services provided under the MUVIA brand (hereinafter together the "Services"), in accordance with Regulation (EU) 2016/679 of 27 April 2016 (hereinafter the "GDPR") and French Law No. 78-17 of 6 January 1978 on information technology, data files and civil liberties (hereinafter the "French Data Protection Act").

MUVIA is online software for tourist accommodation operators (hereinafter the "Properties"). It provides them with a conversational assistant, which can be embedded on their own website, and a digital welcome book that their guests can view. Terms defined in MUVIA's general terms of sale and of use have the same meaning in the Policy.

1. Controller

The processing described in Articles 3 et seq. is carried out by:

Identity	Contact details
Carl-Marie Miniconi, sole trader (EI), trading under the MUVIA brand SIREN 980 224 471 — Ajaccio Trade and Companies Register (RCS)	Piscia Rossa, San Giovanni, 20167 Appietto, France contact@muvia-solutions.fr

Hereinafter "MUVIA", "we" or "our". MUVIA has not appointed a data protection officer, as this appointment is not mandatory under Article 37 of the GDPR. Any question about the Policy can be sent to contact@muvia-solutions.fr.

2. Data subjects and MUVIA's role

The Policy is addressed to four categories of people:

visitors to the muvia-solutions.fr website;
prospects, i.e. professionals whom MUVIA contacts with a view to offering them its Services;
customers — Properties holding an account — and the members of their team invited to use the application;
guests, i.e. the current or future customers of a Property who view its welcome book or interact with its conversational assistant.

For processing relating to visitors, prospects, customers and the members of their team, MUVIA acts as controller within the meaning of Article 4(7) of the GDPR (Article 3).

For processing relating to guests, MUVIA acts as processor within the meaning of Article 4(8) of the GDPR, on behalf of the Property concerned, which is the controller. This processing is governed by the data processing agreement annexed to the terms of sale. Article 4 of the Policy presents its characteristics for information purposes; the Property remains responsible for informing guests itself and responding to their requests.

3. Processing carried out by MUVIA as controller

3.1 Visitors to the muvia-solutions.fr website

Purpose	Data	Legal basis	Retention period
Providing and securing the website and the application	IP address, date and time, page requested, browser and operating system (server logs)	MUVIA's legitimate interest in operating functional and secure services (Art. 6(1)(f) GDPR)	14 days
Responding to requests sent via the contact form	Last name, first name, email address, phone if provided, type of property, message	Pre-contractual measures taken at the person's request (Art. 6(1)(b) GDPR)	3 years from the last contact
Audience measurement with Google Analytics, loaded through Google Tag Manager	Cookie identifier, pages viewed, technical data, IP address, actions taken on the website (demo started, form sent, plan or trial chosen), without any contact details	Consent (Art. 6(1)(a) GDPR and Art. 82 of the French Data Protection Act)	_ga and _ga_4YDC5VY932 cookies: 13 months maximum; measurement data: 2 months
Measuring the effectiveness of MUVIA's advertising campaigns on Facebook and Instagram, by means of the Meta pixel (website and app)	Cookie identifier, pages viewed, technical data, IP address, actions taken (demo generated, appointment booked, trial account created); for a user signed in to the app, their email address, sent in hashed form	Consent (Art. 6(1)(a) GDPR and Art. 82 of the French Data Protection Act)	_fbp cookie: 90 days; the user's cookie choice: 6 months
Analysing visitors' journeys on the website and the app, by means of PostHog, to improve their use	Cookie identifier, pages viewed, clicks, technical data, actions taken (demo generated, sign-up, onboarding steps, plan chosen), recording of the on-screen navigation, with input fields masked — and, in the app, all displayed text; for a signed-in user, the internal identifier of their account, without email address. The IP address is not sent	Consent (Art. 6(1)(a) GDPR and Art. 82 of the French Data Protection Act)	ph_…_posthog cookie: 1 year; events and recordings: retention period provided by the PostHog plan subscribed to
Online appointment booking (demo)	First name, last name, email address, phone, the property's name, website, type and number of rooms, chosen time slot, any information freely entered	Pre-contractual measures taken at the person's request (Art. 6(1)(b) GDPR)	3 years from the last contact
Free demo built from the visitor's property website (trial assistant and welcome book)	Website address entered and the public information it contains, including a screenshot of its home page shown during the analysis and not kept; questions asked to the trial assistant (five at most), sent to Mistral AI to produce the answers and not kept; a non-reversible fingerprint of the IP address and a random identifier kept in the “muvia_demo” cookie, used only to limit the number of demos and to link the demo to the account the visitor creates	Pre-contractual measures taken at the person's request (Art. 6(1)(b) GDPR); for the fingerprint and the cookie, MUVIA's legitimate interest in preventing abuse (Art. 6(1)(f) GDPR)	7 days; information carried over into an account created afterwards follows the retention period of that account

3.2 Prospects

Purpose	Data	Legal basis	Retention period
Contacting visitors who started a free demo from the website again (satisfaction survey, commercial prospecting by phone or email)	Phone number or email address requested before the demo starts, website address entered, page language, date	MUVIA's legitimate interest in developing its business (Art. 6(1)(f) GDPR), in compliance with Article L. 34-5 of the French Postal and Electronic Communications Code	3 years from the demo; if the visitor creates an account from this demo, the life of that account
Electronic marketing to professionals	Last name, first name, job title, name and business contact details of the property, business email address, history of exchanges	MUVIA's legitimate interest in developing its business (Art. 6(1)(f) GDPR), in compliance with Article L. 34-5 of the French Postal and Electronic Communications Code	3 years from the last contact initiated by the prospect
Handling objection requests	Email address, date of the request	Legal obligation (Art. 6(1)(c) GDPR)	3 years from the request

Marketing messages sent to a professional concern services related to their profession. Each message allows them to object, free of charge, at any time and in a simple way, to receiving further messages.

Before starting the free demo, the visitor enters a phone number or, if they prefer, an email address. These details are not passed on to any third party. The visitor may object at any time to being contacted again by writing to the address given in article 1: their details are then deleted. If they create an account from the demo, the details are also used to prefill their sign-up and profile.

3.3 Customers and the members of their team

Purpose	Data	Legal basis	Retention period
Account creation and management, authentication	Last name, first name, email address, password (stored in hashed form), profile photo, phone and date of birth if provided, role, preferences; when signing in with Google or Facebook, the identifier, name, email address and photo provided by that provider	Performance of the contract (Art. 6(1)(b) GDPR)	Term of the contract, then 3 years from the end of the subscription
Proof of acceptance of the general terms	Date and version of the terms accepted, author of the record	MUVIA's legitimate interest in keeping proof of the contract (Art. 6(1)(f) GDPR)	Lifetime of the account, then 5 years (limitation period, Art. L. 110-4 of the French Commercial Code)
Providing the Services (assistant, welcome book, conversations, statistics)	Property details (name, address, phone, email, website, logo, classification, booking and review links), content and images uploaded, settings	Performance of the contract (Art. 6(1)(b) GDPR)	Term of the contract, then 3 years from the end of the subscription
Pre-filling from the sources designated by the customer (website, Booking.com listing, documents)	Text of the sources and information extracted from them, including the phone number and email published on the property's website	Performance of the contract (Art. 6(1)(b) GDPR)	Analysis result: 30 days; uploaded documents: not kept after extraction
Invoicing and subscription management	Identity, billing details, plan subscribed, payment history and invoices. Bank card data is collected and stored by Stripe and does not pass through MUVIA	Performance of the contract and legal obligation (Art. 6(1)(b) and (c) GDPR)	Accounting records: 10 years (Art. L. 123-22 of the French Commercial Code)
Sending service emails (account creation, alerts, reports, invoices, invitations)	Last name, first name, email address, content of the message	Performance of the contract (Art. 6(1)(b) GDPR)	Sending log: 90 days
Support via messaging from the dashboard	Name, email address, plan, role, account identifier, content of exchanges, IP address	Performance of the contract (Art. 6(1)(b) GDPR)	24 months from the last exchange
Logging of team activity and security	Actions performed in the application, author, date	Legitimate interest of MUVIA and the customer in account security (Art. 6(1)(f) GDPR)	24 months
Inviting a team member	Email address of the invited person, proposed role	The customer's legitimate interest in building its team (Art. 6(1)(f) GDPR)	90 days after the invitation expires if it is not accepted
Marketing to customers	Last name, first name, email address	MUVIA's legitimate interest (Art. 6(1)(f) GDPR); services similar to those subscribed	3 years from the end of the business relationship
Handling pre-litigation and litigation	Data necessary for the establishment, exercise or defence of a legal claim	MUVIA's legitimate interest (Art. 6(1)(f) GDPR)	Duration of the proceedings and appeal periods

Data marked as mandatory in the forms is necessary for the conclusion and performance of the contract; without it, the account cannot be created or the service cannot be provided.

At the end of the 3-year period following the end of the subscription, the account and property data is deleted, except for data whose retention is required by law. The customer may at any time, without waiting for this deadline, export its data and delete its account from its customer area.

4. Guest data processed on behalf of the Properties

When a guest uses a Property's conversational assistant or welcome book, MUVIA processes their data as processor, on the instructions of that Property, which is the controller. This article describes its characteristics for information purposes.

Processing	Data	Period applied by MUVIA
Answering questions through the conversational assistant	Content of the messages exchanged, language, technical conversation identifier	24 months from the last exchange
Putting the guest in touch with the Property's staff	First name, last name, email address, phone if added by the Property, content of exchanges, attachments, the Property's internal notes	24 months from the last exchange
Sending the guest a copy of their conversation, at their request	Email address, content of the conversation	24 months; sending log: 90 days
Rating of the service	Satisfaction rating, rating of each answer	24 months
Measuring use of the welcome book and the assistant	Visit identifier, device type, language, visit duration, sections and pages viewed, clicks to booking or review pages	24 months

Guests who wish to exercise their rights (Article 10) are invited to contact the Property concerned, whose contact details appear on its welcome book or website. MUVIA forwards without delay to the Property any request it receives directly and assists it in responding.

The content of messages is freely written by the guest. It is recommended not to share sensitive information (health, opinions, family situation) that is not necessary for the request.

5. Recipients of the data

Data is accessible, within the limits of their duties, to MUVIA and, for the data of its account and its guests, to the customer Property and the members of its team according to the rights conferred by their role. MUVIA only accesses a Property's data for the purposes of providing the Services, support and security; these accesses are logged.

MUVIA uses the following processors, which provide sufficient guarantees within the meaning of Article 28 of the GDPR:

Provider	Role and data concerned	Data location
Hostinger International Ltd	Hosting of the website, the application, the database, uploaded files and local backups — all categories of data	France (Paris)
IONOS SARL	MUVIA's email service (address contact@muvia-solutions.fr), which receives in particular messages from the contact form and requests to exercise rights — name, contact details, content of messages	European Union
Backblaze, Inc.	Storage of database backups, encrypted before sending with a key the provider does not hold	European Union ("EU Central" region); company established in the United States, certified under the EU-U.S. Data Privacy Framework
Mistral AI	Generating the assistant's answers and analysing the sources designated by the Property or by the visitor requesting a demo — content of messages, knowledge base, text of sources	France / European Union
Brevo (Sendinblue SAS)	Sending of service and authentication e-mails, and forwarding of messages from the site's contact form — name, e-mail address, telephone number if provided, content of the messages, copy of the conversations requested by the traveller	France / European Union
Stripe Payments Europe, Ltd	Payment and invoicing — the customer's identity, contact details and means of payment	Ireland; transfers to the United States (Article 6)
Crisp IM SAS	Support messaging in the dashboard — name, email, plan, role, account identifier, exchanges, IP address	European Union (Netherlands, Germany)
Apify Technologies s.r.o.	Reading the public Booking.com listing designated by the Property; the result includes reviews published by Booking.com customers, which MUVIA removes before any reuse	European Union and United States; standard contractual clauses
Google Ireland Ltd / Google LLC (Google Places)	Address autocompletion and search for nearby places, including for demos — the property's address or name	United States (Article 6)
Google Ireland Ltd / Google LLC (Google Analytics, Google Tag Manager)	Audience measurement of the muvia-solutions.fr website, subject to the visitor's consent	United States (Article 6)
Meta Platforms Ireland Ltd / Meta Platforms, Inc. (Meta pixel)	Measuring MUVIA's advertising campaigns on Facebook and Instagram, subject to the visitor's consent	Ireland; transfers to the United States (Article 6)
PostHog Inc. (PostHog Cloud EU)	Analysing visitors' journeys on the website and the app, subject to the visitor's consent	European Union (Germany); company established in the United States (section 6)
Cal.com, Inc.	Booking appointments from the site — name, email, phone, the property and its website, time slot	United States; certified under the EU-U.S. Data Privacy Framework

Google Ireland Ltd and Meta Platforms Ireland Ltd are also recipients, where the person chooses to use them, for signing in to the account with a Google or Facebook account. These providers then act as controllers of their own processing.

Supabase, Inc., which hosted the database until 20 October 2026, keeps a copy of the database as of that date, stored in France and Ireland, until it is deleted; it has received no data since that date.

Finally, data may be disclosed to administrative or judicial authorities where required by law. It is not sold, rented or transferred to third parties for commercial purposes.

6. Data transfers outside the European Union

Some data is transferred to countries outside the European Economic Area. These transfers are governed by Chapter V of the GDPR:

United States — Google, Stripe and Meta: European Commission adequacy decision of 10 July 2023 on the EU-U.S. Data Privacy Framework, for certified companies, and, failing that, standard contractual clauses adopted by the European Commission. Cal.com and Backblaze are also certified under this framework.
PostHog — the data is hosted in the European Union (Frankfurt); as PostHog Inc. is established in the United States, access from that country remains possible, governed by the standard contractual clauses adopted by the European Commission and included in its data processing agreement.
Brazil — the Nebulang translation module, loaded by the browser of visitors to the welcome book and the assistant, receives their IP address and the address of the page viewed in order to check its licence: adequacy decision adopted by the European Commission in January 2026 under Article 45 of the GDPR.
United States — this module uses the Google Translate service, which receives the visitor's IP address as soon as the page opens and, when the visitor chooses another language, the text of the page displayed. Google Fonts fonts and icons, loaded by the browser when displaying the pages of the application, the welcome book and the assistant, as well as YouTube videos that the Property chooses to embed in its welcome book, also cause the visitor's IP address to be sent to Google.
United States — when a welcome book opens, the flags of the language menu are loaded from flagcdn.com, served by Cloudflare, Inc., and the sample photographs the Property has not replaced from Unsplash, served by Imgix, Inc.; these providers receive the visitor's IP address. The map of the surroundings (OpenStreetMap) and the local weather (Open-Meteo) are, when displayed, loaded under the same conditions from their providers.

A copy of the applicable safeguards can be obtained on request sent to contact@muvia-solutions.fr.

7. Cookies and other trackers

7.1 muvia-solutions.fr website

The website keeps the visitor's cookie choice in their browser for 6 months, by means of a "muvia_consentement" cookie set on the muvia-solutions.fr domain and shared by the website and the app; this operation is strictly necessary and does not require consent. The appointment booking page embeds the Cal.com service, whose security provider sets a short-lived technical cookie ("__cf_bm", 30 minutes) used to tell visitors from robots, which is also exempt from consent.

It also uses the Google Analytics audience measurement service, provided by Google Ireland Ltd, which sets the _ga and _ga_4YDC5VY932 cookies, kept for 13 months maximum. These cookies are used to produce traffic statistics (pages viewed, visit duration, origin) and to count the actions taken on the website — demo started, form sent, plan or trial chosen — without any name, email address or phone number being sent. Google Analytics is loaded through Google Tag Manager, a Google Ireland Ltd tool that sets no cookie of its own. These cookies are only set, and these tools only loaded, with the visitor's consent, obtained through a banner allowing them to accept or refuse with equal ease. Refusing has no effect on access to the website.

With the visitor's consent, the website and the app also use the Meta pixel, provided by Meta Platforms Ireland Ltd, to measure the effectiveness of MUVIA's advertising campaigns on Facebook and Instagram: pages viewed, demo generated, appointment booked and trial account created. It sets the _fbp cookie, kept for 90 days. When the user is signed in to the app, their email address is sent to Meta in hashed form, to match these measurements with their Facebook or Instagram account; it is never placed in a page address or in the details of an event. This data may be transferred to the United States (section 6). Meta's script is only loaded, and this cookie only set, once the visitor has consented, together with audience measurement through the banner's "Accept" button, or separately through "Customise". Declining has no effect on access to the website or the app. No advertising tracker is used on the welcome booklet or on the conversational assistant, which the guests of client properties consult.

With the consent given for audience measurement, the website and the app also use PostHog, provided by PostHog Inc. and hosted in the European Union (Frankfurt), to understand visitors' journeys and improve the website and the app: pages viewed, clicks, actions taken (demo generated, sign-up, onboarding steps, plan chosen) and recording of the on-screen navigation. In these recordings, input fields are always masked; in the app, all displayed text is masked as well. It sets the ph_…_posthog cookie, kept for 1 year. The data passes through MUVIA's servers, which do not send the visitor's IP address. When the user is signed in to the app, their visits are linked to the internal identifier of their account, never to their email address. PostHog is used neither on the welcome booklet, nor on the conversational assistant, nor on the administration console.

The visitor can change their choice at any time through the "Manage cookies" link on the website and in the app (sign-in and sign-up pages, demo, Profile tab of the dashboard). The choice made on the website applies to the app, and vice versa. Withdrawing consent immediately stops the measurement and deletes the cookies concerned. The visitor can also delete cookies from their browser settings.

When a client is signed in to the application, the application places on the muvia-solutions.fr domain a cookie “muvia_connecte”, valid for 30 days, which only indicates that a session is open and contains no identifying data. It allows the site to show direct access to the dashboard instead of the sign-in and sign-up buttons; it is deleted when the user signs out.

7.2 Application app.muvia-solutions.fr

The application stores in the user's browser the elements necessary for their session and preferences (login token, display language, draft of a welcome book or assistant being created). The Crisp support messaging service sets cookies lasting 6 months in the browser of the user signed in to the dashboard, which are necessary for the continuity of their exchanges with support, a service provided under the contract.

The app shows the same cookie banner as the website, and the choice is shared (7.1). The Meta pixel is used there under the same conditions, with the user's consent.

PostHog is used there under the same conditions, with the user's consent to audience measurement.

The free demo available from the site places a cookie “muvia_demo”, valid for 30 days, which contains a random identifier and is only sent to the demo's addresses. It is used only to limit the number of demos per visitor and to link their demo to the account they create afterwards.

7.3 Welcome book and conversational assistant

No cookies are set when the welcome book or the assistant opens. When the guest chooses to display the page in another language, the Google Translate service sets a "googtrans" session cookie, which remembers the chosen language and disappears when the browser is closed.

The welcome book and the assistant also use the browser's local storage to:

ensure the continuity of the conversation (session identifier, message history, status of a handover to staff) and remember the chosen language, operations strictly necessary for the service requested;
produce, on behalf of the Property, anonymous usage statistics using a randomly generated visit identifier, kept for 13 months maximum and used exclusively for this purpose;
where the Property has entered a review link, count the times the welcome book is opened in order to invite the guest, from their second visit, to leave a review; this information stays in the browser and is not sent to MUVIA.

8. Retention periods

Data are kept for the periods stated in articles 3 and 4, then deleted or anonymised. A daily automatic purge deletes in particular conversations 24 months after the last exchange, audience measurements and the activity log after 24 months, the email sending log after 90 days, source analysis results after 30 days, demos requested from the website after 7 days, and the details left to start a demo by a visitor who did not create an account after 3 years.

Deleted data may remain in backups until they are overwritten: 7 days for copies kept on the server and around 31 days for encrypted copies kept off the server, without it being possible to extract it individually in the meantime.

9. Security

MUVIA implements appropriate technical and organisational measures within the meaning of Article 32 of the GDPR, in particular:

encryption of exchanges between browsers and the server (HTTPS protocol);
confirmation of the email address when the account is created and storage of passwords in hashed form;
separation of each Property's data, checked on every request, and access rights that differ according to the role of each team member;
no direct exposure of the database to the Internet and restricted administrative access, via an encrypted connection;
daily backups, including an encrypted copy kept off the server, and tested restorations;
logging of MUVIA's access to the Properties' data;
antivirus scanning of uploaded documents.

In the event of a personal data breach, MUVIA makes the notifications provided for in Articles 33 and 34 of the GDPR and, when acting as processor, informs the Property concerned as soon as possible.

10. Data subjects' rights

In accordance with Articles 15 to 22 of the GDPR, any person has, under the conditions laid down in those provisions, the right to access, rectify, erase and restrict the processing of their data, the right to data portability, and the right to object, in particular to marketing, which they may exercise at any time and without giving reasons. Where processing is based on consent, it can be withdrawn at any time, without affecting the lawfulness of processing based on consent before its withdrawal.

Any person may also set out instructions regarding the retention, erasure and disclosure of their data after their death, in accordance with Article 85 of the French Data Protection Act.

Customers can, from their customer area, view and edit their information, download a copy of their data in a structured format and delete their account. Any other request can be sent to contact@muvia-solutions.fr. MUVIA responds within one month of receipt, a period that may be extended by two months given the complexity or number of requests. In case of reasonable doubt about the identity of the requester, proof of identity may be requested.

Guests exercise their rights with the Property, which is the controller, under the conditions of Article 4.

Any person may lodge a complaint with the French data protection authority, the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — www.cnil.fr.

11. No automated decision-making

The Services do not give rise to any decision based solely on automated processing producing legal effects concerning people or similarly significantly affecting them, within the meaning of Article 22 of the GDPR. The conversational assistant's answers are generated automatically from the information provided by the Property and are purely informative.

12. Changes to the Policy

MUVIA may amend the Policy to take account of changes to the Services or regulations. The version in force is the one published on the website, with its update date. Customers are informed of any substantial change by email or in their customer area.