Last updated 30 October 2026
Privacy Policy
This policy explains how Carcassonne Stays handles personal information submitted through enquiries, listing claims, partner applications, promotions and purchases.
1. Who is responsible
Carcassonne Stays is responsible for deciding how information submitted to this website is used. Privacy enquiries and rights requests may be sent to hello@carcassonnestays.com.
The legal name, registered or business address, registration details and telephone number of the site operator must be inserted here before the commercial site goes live.
2. Information we collect
- Name, email, telephone number and message content.
- Business or property information submitted in a listing application or claim.
- Evidence supplied to verify that a person represents a listed business.
- Plan selection, transaction reference and payment status.
- Technical security information and, when activated, basic page and listing interaction analytics.
3. Why we use it
- To answer enquiries and provide requested information.
- To review, verify, publish and maintain listings.
- To administer Premium, Showcase and quoted marketing services.
- To prevent fraud, protect the service and keep required business records.
- To measure listing performance where analytics are offered.
4. Legal bases
Depending on the activity, processing is based on steps requested before a contract, performance of a contract, consent, compliance with a legal obligation or legitimate interests in operating and protecting the marketplace. Marketing messages requiring consent will provide a way to withdraw it.
5. Payments and service providers
PayPal processes payment information under its own privacy terms. Carcassonne Stays does not receive or store complete payment-card details. Website hosting, email and technical service providers may process limited information only as needed to provide their services.
Cloudflare Turnstile: When configured, we use Cloudflare, Inc. as a data processor to protect our claim, manual-verification and enquiry forms from bots and abuse. The widget processes technical signals such as your IP address, browser and device information, and the site origin. Our server sends the challenge token to Cloudflare for verification; we do not include your name, email address, business claim details or enquiry text in that verification request. The widget is not loaded and these forms cannot accept submissions until both server-side keys are configured. Cloudflare also describes separate processing to improve its bot detection in its Turnstile Privacy Addendum. For privacy questions about our use of Turnstile, contact hello@carcassonnestays.com.
6. Public listing information
Business names, public addresses, public business telephone numbers, official websites and factual descriptions may be displayed in the directory. Owners may request correction, claim or removal review. Public business information is not treated as a private customer message.
7. Retention
Our scheduled worker applies the following rules before attempting email delivery:
| Data | Automated retention rule |
|---|---|
| Queued or retrying mail older than 30 days | Expired and its body removed; it will not be sent late. |
| Bodies of sent, bounced, failed, suppressed or expired mail | Removed 30 days after the last status update. Delivery metadata is retained separately. |
| Held, review, undeliverable or expired enquiries | Deleted after 60 days from creation. |
| All other enquiries | Deleted after 180 days from creation. |
| Claims never verified | Deleted after 30 days from creation. |
| Manual verification requests | Deleted after 180 days from creation. |
Ownership, delivery and permission records, including event dates and relevant contact identifiers, are retained separately for account administration, security and permission review. These records do not have an automatic deletion schedule in the current system; you may request a review or erasure at hello@carcassonnestays.com. Suppression records remain to prevent unwanted email. A deletion request does not automatically re-enable email.
Private database backups keep the newest 14 snapshots on the hosting account. Once nightly backups are scheduled, expired content may remain in older snapshots until rotation removes them. A restored database is subject to the same retention purge before mail is sent. Hosting-provider backups may have a separate retention policy.
8. Your rights
Subject to applicable law, you may request access, correction, deletion, restriction, portability or objection, and may withdraw consent where consent is the basis used. You may also complain to the French data-protection authority, the CNIL.
9. Cookies and external services
The local preview does not intentionally use advertising cookies. PayPal or another external service may set cookies when its embedded features are loaded. Any non-essential analytics or marketing cookies must remain disabled until an appropriate consent mechanism is implemented.
10. International transfers and security
Some providers may process information outside France or the European Economic Area using legally recognized safeguards. Reasonable technical and organizational measures are used, but no online transmission is completely risk free.
11. Changes
This policy may be updated as forms, analytics, payments and partner services are activated. The updated date will appear at the top of this page.