Privacy Policy

Data controller

The data controller for personal data collected through Viestia is the entity publishing the site, whose full identity appears on the Legal Notice page. For any question regarding your personal data, you can use the form available on the Contact page.

Data collected

Depending on how you use the service, Viestia collects:

— For all accounts: email, name, role, preferred language, country, profile picture (optional), phone number (optional). — For organizers: business name and description, address, contact details, photos, and billing information (organizer type, name, address, SIRET and VAT number where applicable) when provided. — For bookings: booking reference, session concerned, number of participants, booking status.

Viestia never collects card data: payments for the organizer subscription are processed directly by Stripe.

Purposes and legal basis

This data is processed to: create and manage accounts (contract performance), connect organizers and participants (contract performance), send service-related emails — booking confirmations, reminders, notifications (contract performance), manage the organizer subscription (contract performance), moderate organizer accounts (legitimate interest), and, where you have consented, send marketing communications (consent).

Recipients of your data

Your data is accessible to the Viestia team within the scope of their duties, and to the organizers of the activities you book (limited to the information needed to manage their session). It is never sold or rented to third parties.

Subprocessors and hosting

Viestia relies on the following providers to operate the service:

— Supabase (database, authentication, file storage); — Vercel (site hosting); — Brevo (transactional email delivery); — Stripe (processing of organizer subscription payments).

Some of these providers are established outside the European Union (Vercel and Stripe, both based in the United States). These transfers are governed by the European Commission's standard contractual clauses or an equivalent safeguard implemented by these providers.

Retention period

Your data is kept for as long as your account is active. If you request account deletion, it is anonymized after a 30-day grace period (see "Account deletion" below). Data required to comply with legal obligations (in particular accounting obligations) may be retained beyond that, within the limits set by law.

Security

Access to data is protected by database-level security rules (each user can only access data they are legitimately entitled to) and by encrypted connections (HTTPS). As no method of transmission or storage is entirely secure, Viestia cannot guarantee absolute security.

Your rights

In accordance with the GDPR, you have the right to access, rectify, erase, restrict, object to, and port your personal data. You can exercise these rights at any time using the form available on the Contact page.

You also have the right to lodge a complaint with the Commission Nationale de l'Informatique et des Libertés (CNIL), the competent supervisory authority in France (cnil.fr).

Account deletion

You can request deletion of your account from your personal space. This request opens a 30-day grace period during which you can cancel it. After this period, your account is permanently anonymized. For organizer accounts, deletion may be delayed while a paid subscription is active or a published activity is ongoing.

Cookies

Viestia's use of cookies is described in the Cookie Policy, available in the site footer.

Minors

Viestia is not intended for minors unaccompanied by a legal guardian. Creating an account requires having the legal capacity to enter into a contract, or acting with a legal guardian's authorization.

Changes to this policy

This policy may be updated to reflect changes to the service or to applicable regulations. The last-updated date appears at the top of this page.