Controller, processor and contact

SYNSETIO, 6 RUE D'ARMAILLE, 75017 PARIS, France, contact@odybook.com, determines the purposes of its own processing: professional accounts, subscription, billing, security, support and business relationship.

For bookings, participants, messages and data collected for an agency or guide, that professional determines the purposes. SYNSETIO then acts as processor on documented instructions.

Data, sources and mandatory fields

Account data comes from the professional or its organization: identity, email, role, settings, company and billing data. Required fields are necessary for the account, contract, security or invoice; branding fields, content and integrations are optional unless needed by an enabled service.

Traveller data comes from the traveller, the professional or a person booking for a group: identity, contact details, dates, participants, messages, preferences and needs shared. Data needed for a booking is distinguished from optional information.

Technical data comes from use of the service: logs, device, browser, errors, security signals, cookie choices and application events.

Purposes and legal bases

Professional account and subscription: contract with an individual customer; legitimate interest to manage representatives, employees or collaborators of a customer organization.
SYNSETIO billing: contract and legal accounting or tax duties.
Traveller bookings and messages: instructions from the professional controller; contract or other basis defined by that professional towards the traveller.
Support, security, abuse prevention and contractual proof: legitimate interest, contract or legal duty depending on context.
Prospecting: consent where required; legitimate interest for certain relevant B2B communications, with simple objection.
Non-exempt analytics or advertising cookies: prior and revocable consent.

Recipients and supplier roles

Data may be processed by Vercel for hosting, Supabase for application data, Stripe as payment provider that may also act as independent controller for regulatory duties, Resend for email, Upstash/Redis for technical functions, Google Calendar if connected by the customer, and analytics or AI tools only if enabled.

SYNSETIO does not sell personal data to advertising networks. Exact regions, contracts and supplier options depend on the active configuration and must remain verifiable.

International transfers

Some suppliers may process data outside the European Economic Area, including in the United States. Where required, transfers rely on an adequacy decision applicable to the recipient or European Commission standard contractual clauses with supplementary measures when necessary. Contact contact@odybook.com for recipients and countries applicable to your use and a copy of safeguards; third-party rights may require redactions.

Retention periods

Professional account: account term, then a reasonable exit period for export, closure and proof, unless legal archive or dispute applies.
Invoices and accounting records: 10 years from the close of the relevant financial year.
Contractual proofs, acceptances, incidents and receivables: period needed for performance, proof and legal defence under applicable limitation periods.
Prospecting: at most three years after collection or the last contact initiated by the prospect, unless withdrawal or objection occurs earlier. A minimal suppression list may be retained to prevent further solicitation.
Technical logs and backups: periods limited by security, diagnostics, continuity and documented technical cycles.

Individual rights

Individuals may request access, rectification, erasure, restriction, objection, portability or withdrawal when these rights apply. Requests go to contact@odybook.com; when they concern a professional seller, SYNSETIO may forward or assist that professional.

SYNSETIO responds within one month. For complex or numerous requests, a reasoned extension of up to two months is notified within the first month. A complaint may be filed with the CNIL: https://www.cnil.fr/.

Cookies, children and AI assistance

Necessary cookies support the service. Non-exempt trackers are set only after a choice, and that choice can be changed from the provided interface.

Odybook is aimed at professionals, but a family booking may contain children's data. Health, disability or allergy needs must be limited to what is necessary for the activity and handled under the professional controller's framework.

AI assistance features must minimize transmitted data and avoid sensitive information until contracts, suppliers and settings allow that processing.