VELAPrivacy policy
VELA is an app that gives each luxury rental property one official availability calendar, controlled by its owner and shared with the rental professionals the owner chooses. This policy explains what personal data VELA processes, why, and the rights you have.
Who is responsible
The data controller is KEYSTONE, EURL with a share capital of €1,000, registered office 540 Première Avenue, 06600 Antibes, France, registered with the RCS Antibes under number 101 603 900, represented by its manager Théo Raschiero. For any question about your data, write to support@velacalendars.com.
What we collect
| Data | Examples | Why |
|---|---|---|
| Account | Name, email address, password (stored encrypted by our authentication provider), phone number if you add one, agency name and contact person, your role in an agency team | To create your account, sign you in and show who you are to the people you work with |
| Houses | Name, address, area, number of bedrooms and guests, cover photo | To show the house to the owner, its managers and the invited professionals |
| Calendar and requests | Booked, blocked and optioned dates, requests and their status, client references and notes written by agencies or owners | To run the shared availability calendar |
| Rates | Rate periods, weekly and monthly rates, commission basis | To share reference rates with invited professionals |
| Activity | A log of actions on a house (for example “request approved”), with time and author | So everyone involved can see what changed and when |
| Preferences | Notification choices, language, appearance | To respect your settings |
| Support | Messages you send us from the app or by email | To answer you |
If you turn on Face ID, recognition is performed entirely by your iPhone. VELA never receives or stores any biometric data.
We do not collect your location, your contacts, advertising identifiers or browsing data.
Who can see what
- A house and its calendar are visible only to its owner, the property managers the owner adds, and the agencies the owner invites. The owner can remove access at any time.
- Agencies see availability (available, option, booked, blocked by owner) and the owner’s published rates. They never see which other agency or client booked other dates.
- Client references and notes on a booking are visible only to the agency concerned and to the owner and managers of the house.
- Private references an agency adds to a house are visible only to that agency’s team.
Legal basis
We process your data to provide the service you signed up for (performance of a contract, Article 6(1)(b) GDPR), and to keep the service secure and prevent abuse (legitimate interest, Article 6(1)(f) GDPR).
Service providers
We use a small number of providers who process data on our behalf, under data processing agreements:
| Provider | Purpose | Location |
|---|---|---|
| Supabase | Database, authentication and photo storage | European Union (Frankfurt, Germany) |
| Resend | Sending emails (sign-up codes, password resets, invitations, notifications) | European Union (Ireland). As a US company, Resend may access data from the United States under the EU Standard Contractual Clauses. |
| Microsoft 365 | Our support mailbox | European Union |
| Apple | App distribution and Face ID on your device | Apple’s own terms apply |
How long we keep data
We keep your data for as long as your account exists. When you delete your account in the app (Settings → Delete account), your account and the data linked to it are deleted immediately from our live systems:
- Owner: your houses, their calendars, rates, access and activity.
- Agency admin: the agency, its team logins, requests, options and references. Bookings already confirmed by owners stay on their calendars, without your agency’s details.
- Team member: your login.
Copies may remain in encrypted backups for a short period (up to 30 days) before being overwritten.
Your rights
Under the GDPR you can access, correct, delete or export your data, object to or restrict its processing. Most of this you can do directly in the app (Settings → Personal details, Delete account). For anything else, write to support@velacalendars.com and we will reply within one month. You can also complain to the French data protection authority, the CNIL (cnil.fr).
Security
Data travels encrypted (HTTPS). Access rules are enforced on our servers, so each person only receives the data they are allowed to see. Passwords are never stored in readable form.
Children
VELA is a professional tool and is not intended for anyone under 18.
Changes
If we change this policy, we will update the date at the top and, for important changes, let you know in the app or by email.