Privacy policy

1. What we collect

• City visitors (no account): no personal data. Only aggregated, anonymous attendance statistics (e.g. how many visits a district gets), with no individual identifier and no reconstructable browsing profile.
• Brands with an account: email, password (stored hashed, never in plain text), brand name, information needed for identity verification and billing (processed by our payment provider, see "Subprocessors").
• Facade content: logo, visuals, copy and links voluntarily supplied by the brand for its storefront.

2. Why we process it

• To perform the subscription contract (create and display the facade, handle payment and renewal).
• To verify brand identity to fight impersonation and phishing (see our Safety & trust page).
• Aggregated statistics to improve the city (popular districts, districts to create) — never individual tracking.
• To answer your requests (support, reports) sent to [email protected].

3. Legal basis

Processing a brand's data is based on performance of the subscription contract (Terms of Use / Terms of Sale). Aggregated statistics are based on Webopolis's legitimate interest in understanding site usage, in a form that does not allow identifying an individual.

4. Retention period

A brand account's data is kept for the duration of the subscription, then for as long as required to meet our legal obligations (accounting in particular), before deletion or anonymisation. Aggregated statistics, containing no personal data, are not subject to a GDPR retention period.

5. Subprocessors

• OVH SAS — hosting of the site and database (France).
• Resend (Plus Five Five, Inc.) — sending transactional emails (account verification, password reset) (United States).
• Cloudflare, Inc. — storage of storefront images and videos, via Cloudflare R2 (United States).
• Stripe — card payment processing; Webopolis never sees or stores card numbers.
• Transfers of data to subprocessors located outside the European Union (Resend, Cloudflare) rely on the European Commission's Standard Contractual Clauses.

6. Your rights

Under GDPR, you have the right to access, rectify, erase, restrict processing of, port and object to your data. You can exercise these rights at any time by writing to [email protected]; we respond within the statutory one-month period. You also have the right to lodge a complaint with the French data protection authority, the CNIL (cnil.fr).

7. Data protection officer

Given the size of the organisation, Webopolis has not appointed a Data Protection Officer (DPO) to date; any question about your data can be addressed to [email protected].

8. Our commitment

Webopolis never resells data to third parties and never tracks city visitors individually. This is a contractual commitment, not just a marketing line — see also our "Our commitment" page.