Privacy Policy
Last updated: June 28, 2026
DJOBA VENTURES SAS (hereafter "CasaGiga") respects your privacy and protects your personal data in accordance with the General Data Protection Regulation (GDPR) and applicable French law.
1. Data Controller
DJOBA VENTURES SAS SIREN: 104 888 094 — RCS Paris Registered office: Bureau 326, 59 rue de Ponthieu, 75008 Paris, France Contact: [email protected]
2. Data Collected
When you use CasaGiga, we collect: • Identity: first and last name, email, phone number • Account: login credentials, preferred language, profile picture • Bookings: history, dates, communication with hosts • Payment: handled directly by Stripe (CasaGiga never accesses your banking data) • Technical: IP address (anonymized for analytics), login logs, browser type • Cookies: see section 7 below
3. Purposes and Legal Bases
We process your data for the following purposes:
| Account and booking management | Performance of contract |
| Payment and invoicing | Performance of contract + legal obligation |
| Transactional emails (confirmation, reminders) | Performance of contract |
| Marketing emails / newsletter | Consent (opt-in) |
| Audience measurement (Google Analytics) | Consent |
| Targeted advertising (Google Ads, Meta) | Consent |
| Platform security and fraud prevention | Legitimate interest |
4. Retention
Your data is retained for the following durations:
| Active user account | As long as you use the service |
| Inactive account | 3 years after last login |
| Booking data (payment, invoicing) | 5 years (accounting / tax obligation) |
| Server logs | 1 year maximum |
| Unconfirmed email (abandoned signup) | 1 year |
| Cookie consent | 13 months (CNIL maximum) |
5. Data Sharing
Your data is never sold. It may be shared in the following cases: • With the relevant host upon confirmed booking (contact details) • With our technical subprocessors (see list below), each bound by a GDPR-compliant data processing agreement • If required by law or a competent authority
6. Subprocessors
We use the following providers to operate CasaGiga. Each is bound by a GDPR-compliant Data Processing Agreement (DPA):
| Subprocessor | Role | Country | Safeguards |
|---|---|---|---|
| Stripe | Traitement des paiements | USA / Irlande | Clauses contractuelles types + chiffrement bout-en-bout |
| Brevo (ex-Sendinblue) | Emails transactionnels | France (UE) | RGPD natif, certifié ISO 27001 |
| Anthropic (Claude) | Génération des descriptions d'annonces (à partir du texte fourni par le propriétaire) | USA | Clauses contractuelles types |
| OpenAI | Mise en forme d'avis clients importés | USA | Clauses contractuelles types |
| OVHcloud | Hébergement serveur | France (UE) | RGPD natif, hébergement souverain UE |
| Cloudflare | CDN et protection DDoS | USA | Clauses contractuelles types + DPA |
| Mapbox | Affichage de cartes et géocodage | USA | Clauses contractuelles types |
| Google (Analytics, Ads, Tag Manager) | Mesure d'audience et publicité — uniquement avec votre consentement | USA | Clauses contractuelles types + Consent Mode v2 + IP anonymisée |
| Microsoft (Clarity) | Analyse comportementale — heatmaps, enregistrements de sessions, uniquement avec votre consentement | USA | Clauses contractuelles types + Consent API v2 (cookies posés uniquement après consentement) |
| Meta (Pixel, Ads) | Publicité ciblée — uniquement avec votre consentement (à activer) | USA | Clauses contractuelles types |
7. Cookies and Trackers
On your first visit, a banner allows you to accept, reject or customize cookies. You can change your choices at any time via the "Cookies" link in the footer. We use the following categories:
Necessary cookies (always active)
Essential to operate the site and ensure security. Exempt from consent (article 82 of the French DPA). Includes our in-house audience measurement, which stays on our servers: no third party can access it and it never follows you to another website.
| Name | Purpose | Duration |
|---|---|---|
| laravel_session | Identification de votre session de navigation | 2 heures |
| XSRF-TOKEN | Protection contre les attaques CSRF | Session |
| casagiga_locale | Mémorisation de votre langue | 1 an |
| cg_consent | Mémorisation de vos choix sur les cookies | 13 mois |
| cg_referrer | Suivi parrainage (si vous arrivez via un lien parrain) | 30 jours |
| cg_vid | Mesure d'audience interne : compter les visiteurs uniques. Aucune donnée transmise à un tiers, aucun suivi sur d'autres sites | 13 mois |
| cg_attr | Mémorise par quel canal vous êtes arrivé (moteur de recherche, publicité, assistant IA, lien partenaire) | 13 mois |
| cg_sess_ping | Stockage local — évite de compter deux fois votre visite dans la même journée | 1 jour |
Audience measurement (with consent)
Help us understand how you use the site to improve it. Aggregated and anonymized data (Google Analytics 4 with Consent Mode v2).
| Name | Purpose | Duration |
|---|---|---|
| _ga, _ga_* | Google Analytics 4 — mesure d'audience (sessions, pages vues) | 13 mois |
| _gid | Google Analytics — distinction des utilisateurs | 24 heures |
| _clck, _clsk | Microsoft Clarity — analyse comportementale (heatmaps, enregistrements de sessions) | 1 an |
Targeted advertising (with consent)
Allow us to measure the effectiveness of our Google Ads and Meta campaigns and serve you relevant content.
| Name | Purpose | Duration |
|---|---|---|
| _gcl_au, _gcl_aw | Google Ads — attribution des conversions publicitaires | 90 jours |
| casagiga_attribution | Attribution interne (campagnes payées vs parrainage) | 30 jours |
8. Your Rights (GDPR)
Under the GDPR, you have the following rights over your personal data: • Right of access • Right of rectification • Right to erasure ("right to be forgotten") • Right to data portability • Right to object • Right to restriction • Right to withdraw consent at any time (cookies, newsletter) To exercise these rights, contact us at: [email protected] We have one month to respond. In case of dispute, you can refer the matter to the CNIL: www.cnil.fr.
9. Transfers outside the EU
Some of our subprocessors are based in the United States (Stripe, Cloudflare, Google, Microsoft, Meta, Anthropic, OpenAI, Mapbox). These transfers are governed by Standard Contractual Clauses adopted by the European Commission and, where applicable, the EU–US Data Privacy Framework.
10. Security
We implement appropriate technical and organizational measures to protect your data: HTTPS encryption, password hashing (bcrypt), encrypted daily backups, restricted admin access, access logging.
11. Updates
This policy may be updated to reflect legal, technical or service changes. The last update date is shown at the top of the page. Material changes will be notified by email or via the platform.