Privacy information

Privacy at a glance

• We use the information needed to run accounts, listings, booking requests, payments, support and security.
• Optional audience measurement remains off unless you consent.
• Hosts and agencies receive only the guest information needed to handle their accommodation booking.
• You can ask about your information or exercise applicable data-protection rights at any time.

Contact the privacy team · Complain to the ICO

Optional address lookup

When you choose to search for your address, we send the search text to Google Maps to suggest addresses. We do not send your name, email or account identifier with that search. Google processes the query under its privacy policy. Google Maps terms apply to the lookup service. We save the address you confirm with your host details; you can instead enter it manually.

Google Maps terms · Google privacy policy

Who is responsible and whose information we use

Gites.co.uk Ltd is the controller for ChezFrance accounts, marketplace administration, security, support and first-party service measurement. A host or agency is normally a separate controller for its accommodation service and guest relationship. If either party processes information solely on the other party’s documented instructions, the required processor terms will apply.

We use information supplied by guests, hosts and agencies to create accounts, review and publish listings, distribute eligible promotional listing content through controlled sister-site placements, process booking requests, provide private booking access and operate optional tools such as messages, contracts, house guides, forms, calendars and team access.

We automatically check booking messages for contact details and external links before confirmation. Authorised ChezFrance staff may read relevant messages for support, safety, dispute handling and enforcement of our terms. Messages are private from the public, but are not hidden from authorised staff. We do not automatically suspend or terminate an account solely because a message check flags it.

Booking records can include names, email addresses, telephone numbers, stay dates, party size, agreed prices and terms, operational messages and transaction status. Guest identity and contact fields and one-time notification access tokens are stored using application encryption; passwords are not stored in readable form.

Information, sources and contexts

If you choose Google sign-in, Google supplies your name, email address and account identifier. We use these to authenticate you and find your own bookings. For linked host accounts we retain a hashed identifier, not your Google password. Google access and refresh tokens are not retained. We do not request access to Gmail, contacts or Drive. Google processes your sign-in under its own privacy policy. Email and password or booking-email links remain available.

Guests provide identity and contact details, dates, party details, messages, form answers, booking choices and optional post-stay reviews. A published verified review shows the rating, review text, an abbreviated guest name and the stay month; it does not show guest contact details. Hosts, agencies and team members provide account and business contacts, roles, listing content, prices, calendars, rules, contracts, guides, public review responses, payout onboarding status and support communications. The service also records timestamps, security and audit events, device or browser details and IP addresses where needed for sessions, terms evidence, intake, rate limiting or security.

Listing data can come directly from a host or agency, from authorised team members, or from Gîtes.co.uk catalogue imports. Imported source snapshots can include property descriptions, locations, facilities, rates, availability and image addresses. Payment status and transaction references come from Stripe; delivery status comes from Google Workspace. Publicly loaded source images may cause the visitor’s browser to contact the image host until the image is stored locally.

Why we use information and our lawful bases

We rely on contract or steps requested before a contract for accounts, booking requests, provider decisions, payments and stay delivery; legal obligation for tax, accounting, regulatory and rights handling; legitimate interests for service security, fraud prevention, support, audit, listing quality and necessary marketplace administration; and consent for optional first-party browsing measurement and any future electronic marketing that requires it.

Our legitimate interests are operating a reliable marketplace, protecting users and systems, preventing misuse, keeping an auditable transaction record and improving listing quality. We balance those interests against the rights and reasonable expectations of the people affected. Refusing required booking or payment information may mean the relevant request or transaction cannot be completed. Optional tools and optional measurement can be declined without preventing an ordinary browse.

How each part of the marketplace uses information

Guests use public search and, when they make a request, a private booking area for approvals, payment, messages, documents, balances, guides, optional pre-arrival forms and a verified review after the stay. Hosts and agencies manage their listings, prices, availability, connected payment account, enquiries, bookings, team permissions, public review responses and optional operational documents. Administrators can access and moderate reviews and other records when necessary for publication, support, security, reconciliation and compliance.

Eligible property content may be displayed in a controlled promotional listing on Gîtes.co.uk that links back to the ChezFrance booking route. Public sister-site distribution does not include guest details, private messages or host or agency telephone numbers, email addresses, payment links or external booking links. Information needed for a booking remains restricted to scoped guest access and authorised host, agency or administrative access.

Payments, email, hosting and other recipients

The property host or agency is the accommodation provider and merchant of record. Stripe processes card payments through that provider’s connected account. ChezFrance stores transaction references, webhook evidence and booking-ledger entries but not full card numbers or security codes. Stripe may carry out authentication, security and fraud screening under its own responsibilities.

Information may be disclosed on a need-to-know basis to the accommodation provider and its authorised team, Stripe, Google Workspace for transactional delivery, DigitalOcean (London, United Kingdom) as the production host, RunCloud for server administration, and professional advisers, insurers, auditors, public authorities or prospective business transferees where lawful. We require processors acting for us to protect the information and use it only for the agreed services.

Mailgun receives and routes replies to ChezFrance support emails into the support desk. The support team may use the shared Gîtes.co.uk administrative desk to handle those requests. Support messages and contact details are private and are not included in public property distribution.

Optional AI assistance

If you choose to use the AI assistant, we send your message, up to six recent chat messages and, on a public property page, a limited set of public property facts to Anthropic to generate a response. We do not automatically send private booking records, host account details, payment information or other dashboard content. Do not include personal guest details, passwords, card details or private access links in your messages.

This optional service provides guidance and drafts at your request. It cannot send messages, change listings, make bookings or process payments. Review its answers before relying on them. Ordinary search, booking and support remain available without AI. We use legitimate interests to provide this requested assistance and protect it against misuse.

To learn what guests are looking for, we keep the questions asked to the guest assistant and the searches made on ChezFrance (place, dates, party size, filters and how many homes were found), without your name, account, IP address or any cookie identifier. Email addresses, links and phone numbers typed into a question are removed before it is kept, and these records are deleted after 18 months. Host conversations with the assistant are not kept. The rest of the conversation is held in the open page and is cleared when you clear the chat or reload the page. Usage counters and necessary security metadata are retained separately. Anthropic normally deletes API inputs and outputs within 30 days, subject to contractual arrangements, abuse-prevention and legal exceptions; its own privacy information explains those exceptions. Clearing the chat on ChezFrance does not delete information already received by Anthropic.

International transfers

Some suppliers may process information outside the United Kingdom or European Economic Area. Where this is a restricted transfer, we use an applicable lawful safeguard, such as a UK or EU adequacy decision, the UK extension to the EU-US Data Privacy Framework, standard contractual clauses with the UK Addendum, or another safeguard permitted by data-protection law.

Stripe and our other suppliers publish information about their processing locations and transfer arrangements. Contact hello@chezfrance.com if you would like more information about the safeguard relevant to your information.

Retention and deletion

Essential sessions normally expire after 120 minutes of inactivity; a “keep me signed in” choice can retain a remember token for up to 400 days; and cookie choices are kept for 180 days. Consented first-party browsing attribution and funnel events are retained for 395 days and older records are pruned. Guest access links and payment windows expire according to their security purpose. Optional guest form answers can be assigned a deletion date from departure up to two years later.

Account and listing records are kept while the account or listing is active and for a reasonable period afterwards for support, disputes, fraud prevention and legal claims. Booking agreements, accepted terms, payments, refunds, invoices and ledger evidence are normally kept for six years after the end of the financial year to which they relate. Security and administrator audit records and listing-source snapshots are kept only for as long as reasonably necessary for their purpose. A legal hold, active dispute or longer statutory duty may extend a period. When retention ends, information is deleted, anonymised or allowed to age out of protected backups.

Your rights and complaints

Depending on the law and circumstances, you may ask for access, correction, deletion, restriction or portability, object to processing based on legitimate interests or direct marketing, and withdraw consent without affecting earlier lawful processing. Contact hello@chezfrance.com. We may need to confirm identity and determine whether ChezFrance or the accommodation provider is responsible for the request.

You can complain to the UK Information Commissioner’s Office at ico.org.uk or, where applicable, another competent European data-protection authority. A request may not require deletion of records that must be kept for legal obligations, security, accounting or the establishment, exercise or defence of legal claims.

Security, children and sensitive information

ChezFrance uses access controls, scoped guest links, password hashing, application encryption for selected identity and evidence fields, encrypted session payloads, rate limits, audit records and restricted administration. No internet service can promise absolute security. Please do not send card details, passwords, access tokens or unnecessary sensitive information in messages or forms.

The service is designed for adult guests and accommodation providers and is not directed to children. An adult may supply the age or needs of a child travelling in their party where necessary for the stay. The service does not intentionally request special-category information. If accessibility or health-related information is genuinely necessary, we limit it to what is needed, restrict access and apply the relevant lawful basis, special-category condition and deletion period.

Marketing, measurement and automated processing

Current account, booking, payment and service messages are transactional. ChezFrance does not currently describe a general email-marketing programme or third-party advertising trackers. Any future marketing list must have its own transparent sign-up, lawful basis and unsubscribe route rather than reusing booking contact details silently.

Optional first-party measurement is off until allowed in cookie choices. When allowed, ChezFrance records searches, property views and booking-funnel outcomes using opaque references and sanitised campaign or referring-host information, without raw IP addresses, contact details, full card data or raw Stripe identifiers. Automated checks also support availability, price calculation, request expiry, payment state, rate limiting and fraud prevention. Instant Book may progress an eligible booking automatically; otherwise the accommodation provider decides whether to approve it. Contact hello@chezfrance.com to question a significant outcome.