Version: 1.0 Published: 28 August 2026 Effective: 28 August 2026
1. Controller
GoMyRoof is operated by the sole trader whose legal identity, professional address and publisher details appear in the site's Legal notice. That publisher is the controller of the processing described here. Privacy contact: contact@gomyroof.com.
No data protection officer has been appointed at this stage; this will be reviewed if the activity or processing requires it.
2. Data processed
Depending on the features used, GoMyRoof may process identity and contact details, language, optional date of birth, account and security data, host or professional profile and documents, listings and photographs, addresses and location, searches and calendars, bookings and guests, payments and guarantees, cancellations and attendance events, messages and reports, invoices and commission, Stripe or bank references, acceptance evidence, IP and browser logs, anti-bot and fraud data, and newsletter, partner-offer or tracker choices.
GoMyRoof does not receive or store a full card number or security code.
3. Purposes and legal bases
| Purpose | Main basis |
|---|---|
| Create and secure an account | Contract and legitimate security interest |
| Publish and manage a listing | Contract |
| Search, book and manage a stay | Pre-contractual steps and contract |
| Payment, guarantee, refund and payout | Contract and legal duties |
| Invoices and contractual evidence | Legal duties and proof |
| Fraud and abuse prevention | Legitimate interest and applicable duties |
| Support, complaints and disputes | Contract and defense of rights |
| Tax, DAC7 and authority requests | Legal duty |
| Transactional messages | Contract |
| Newsletter, partner offers or non-exempt analytics | Consent where required |
Consent can be withdrawn at any time without affecting prior lawful processing.
4. Required data
Required fields are identified. Without them, account creation, verification, publication, booking, payment or legal compliance may be impossible. Date of birth remains optional unless a specific check or duty makes it necessary.
5. Recipients and providers
Authorized GoMyRoof personnel and, where needed, the relevant traveler or host may access data. Providers include Hostinger for hosting and email; Stripe for payment, Connect, refunds and card guarantees; Cloudflare Turnstile for anti-bot security; OpenStreetMap tiles and Nominatim for maps and geocoding; Leaflet currently delivered through UNPKG and technical CDNs; confidential support, security, accounting and legal advisers; and competent authorities.
No active Google Analytics script or Meta pixel was detected on the audited public pages at publication. Any future activation will require this policy to be updated and consent to be collected where required. GoMyRoof does not sell personal data.
6. International transfers
Some providers may process data outside the EEA. A valid safeguard must then apply, such as an adequacy decision, standard contractual clauses and additional measures where necessary.
7. Retention
Active-account data is kept while the account is used. A closed or inactive account is targeted for deletion or anonymization after one year, except information that must be retained. Ordinary messages are generally kept for one year after closure. Contractual evidence is kept for performance and applicable limitation periods; accounting documents are generally kept for ten years; tax, security and dispute data follow their legal or documented necessity.
8. Rights and security
Subject to GDPR conditions, a person may request access, copy, correction, erasure, restriction, objection, portability or withdrawal of consent at contact@gomyroof.com. Proportionate identity evidence may be requested in case of reasonable doubt. A complaint may be lodged with the CNIL.
GoMyRoof uses access controls, protected passwords, encrypted communications, logs, backups, separated environments, anti-bot protection and Stripe for card data. Contractual accounts are reserved for people aged at least eighteen.
9. Changes
Each new version is dated. Notice or renewed consent is provided where required. Previous versions remain available on request when needed as evidence.