Privacy

Who we are

ROOMONKEY is run by YAY Hotel Growth (Yahya Hilali, micro-entreprise, France), the data controller. Contact: yahya.hilali10@gmail.com.

What we collect

Your email address, and your name if you sign in with Google.

Your answers to the welcome step (18 or older, terms accepted, video rights accepted, email updates yes or no).

The videos and captions you upload, and the link to your post if you share it.

When a poster or card is scanned: the time, the browser type and a scrambled code made from your IP address (a keyed hash with a key that changes every day, so it cannot be turned back into your IP).

If you connect Instagram: your account id, username and an access token, stored encrypted.

Why we use it

To run the campaign you joined: check your video, tell you the result and send your reward code.

So the hotel can reshare approved videos with credit to you (the reuse licence in the terms).

To improve how we review videos, including training a helper tool on past review decisions and on approved or rejected clips. People still make every decision.

To email you about new campaigns, only if you ticked that box. You can untick it any time.

To see where the site is confusing and fix it, from visit statistics without cookies (our legitimate interest in a site that works).

Who else handles it

Supabase (database, sign-in and file storage, EU region), Vercel (website hosting), Resend (emails), PostHog (visit statistics, EU region), and Meta, only if you connect Instagram. Each works under a data processing agreement.

Hotels see counts and the videos we approved for their campaign. They never get your email address unless you agree.

How long we keep it

Rejected, expired and deleted videos: removed after 30 days.

Approved videos: kept while the hotel's reuse licence runs.

Scan and click records: deleted after 90 days.

Review decisions are kept without any personal details, so they cannot be linked back to you.

Cookies and storage

We use no advertising or analytics cookies, so there is no cookie banner.

We use PostHog (EU servers) to count visits and see where pages are confusing. It sets no cookies and stores nothing on your device. Text you type is hidden, and your IP address is not kept.

Your browser stores only what the app needs to work: your sign-in session (so you stay signed in) and which poster you scanned (for this visit only). These are strictly necessary, which is why they need no consent under the CNIL rules. Signing out removes the session.

The map loads map tiles from OpenFreeMap; that request includes your IP address, like any web page. No tracking is added.

Children

ROOMONKEY is for adults. You must confirm you are 18 or older before uploading, and we delete accounts we learn belong to anyone younger.

Your rights

You can see, correct, export or delete your data. Use Delete my account in the app, or email us. We act within 30 days.

Deleting your account removes your videos, profile and connected accounts. Reward codes already issued stay in the hotel's records without your name.

You can complain to the CNIL (cnil.fr) if you think we got something wrong.