Privacy policy

Table of contents

1. 1. Data controller
2. 2. Nature of the project
3. 3. Local storage and external services
4. 4. Data collected and purposes
5. 5. EmailJS and confirmation emails
6. 6. Maps and external resources
7. 7. Cookies and trackers
8. 8. Retention periods
9. 9. Security
10. 10. Your rights
11. 11. Transfers outside the European Union
12. 12. Updates to this policy
13. 13. Contact

Last updated: 22 July 2026

Fictional student project This site was built as part of a training programme. No real booking, payment, or transaction can ever be made on the AtypikHouse site. Some technical features are nonetheless active, in particular sending a mock booking confirmation email.

1. Data controller

The data controller for the personal data used in this demonstration is:

Quentin Seynaeve
AtypikHouse student project
Email address: contact@atypikhouse.fr

AtypikHouse is the fictional name of the platform presented as part of this student project. AtypikHouse is not a genuinely registered company.

No data protection officer has been appointed. Requests concerning personal data can be sent to the address above.

2. Nature of the project

AtypikHouse is a demonstration platform built as part of a fictional student project. The stays, reviews, bookings, payments, and gift cards shown are simulated. Some technical features are, however, genuinely active: account creation, storing the data entered in forms, and sending a confirmation email via EmailJS after a mock booking. This policy describes precisely what actually happens, feature by feature.

3. Local storage and external services

This version of AtypikHouse has no application server or production database. Some of the information entered is stored in the local storage (localStorage) of the browser used to view the site.

Some data is nonetheless sent to external services when necessary for a feature to work, in particular to EmailJS and the connected email provider, for sending mock booking confirmation emails.

Technical data may also be sent to map or external script providers when these services are loaded after the user's consent, in accordance with the preferences expressed in the tracker management banner (see sections 6 and 7).

No real payment is ever processed and no genuine bank data should ever be stored or transmitted.

4. Data collected and purposes

The table below covers only the processing actually present in this version's code.

Where a field is marked as required, its absence prevents the relevant feature from being used or confirmed. Optional fields can be left blank without preventing the flow from continuing.

Account creation and management

• Data collected: first name, last name, email address, password, role (traveller or host), date and version of the Terms of Use accepted.
• Purpose: creating and using a demo account (favourites, bookings, reviews, host or administrator area depending on role).
• Legal basis: the data controller's legitimate interest in enabling accounts and demo features requested by the user to work.
• Field status: all required.
• Recipients: none — kept only in your browser's local storage.
• Storage: localStorage (key atypikhouse:utilisateurs). The password is hashed (SHA-256) before being stored, never kept in plain text or in a reversible form — see section 9.
• Duration: see section 8.

Sign-in (session)

• Data collected: account ID, email, first name, last name, role.
• Purpose: staying signed in from one page to the next.
• Legal basis: the data controller's legitimate interest in ensuring the user session works and continues correctly.
• Recipients: none.
• Storage: localStorage if "Stay signed in" is checked, otherwise sessionStorage (cleared when the tab is closed).
• Duration: until sign-out, the tab is closed (sessionStorage), or browser data is cleared.

Contact form

• Data collected: first name, last name, email, phone (optional), message.
• Purpose: demonstration of the contact flow.
• Legal basis: the user's consent to have the information entered stored locally as part of the contact form demo.
• Field status: first name, last name, email, and message required; phone optional.
• Recipients: none. The message is stored only in your browser: it is not emailed, not sent to any external service, and not viewable by an AtypikHouse administrator.
• Storage: localStorage (key atypikhouse:messages_contact).
• Duration: see section 8.

Stay proposal ("become a host" application)

• Data collected: first name, last name, email, phone, type of partnership, planned location and type of stay, number of stays, website, social media, project description, and environmental approach. This form does not support uploading a photo.
• Purpose: demonstration of the host application flow.
• Legal basis: the user's consent to have their stay proposal stored locally as part of the demo.
• Field status: first name, last name, and email required; all other fields (phone, type of partnership, location, type of stay, number of stays, website, social media, description, environmental approach) are optional.
• Recipients: none — stored only in your browser, not transmitted, not viewable by an administrator.
• Storage: localStorage (key atypikhouse:candidatures_partenaires).
• Duration: see section 8.

Partnership request

• Data collected: first name, last name, company, email, phone (optional), partner type, message.
• Purpose: demonstration of the partnership request flow.
• Legal basis: the user's consent to have their partnership request stored locally as part of the demo.
• Field status: first name, last name, company, email, partner type, and message required; phone optional.
• Recipients: none — stored only in your browser.
• Storage: localStorage (key atypikhouse:demandes_partenariat).
• Duration: see section 8.

Appointment request

• Data collected: reason, requested date and time slot, first name, last name, company, email, message (optional).
• Purpose: demonstration of a time-slot request — this is simply a local entry, never a confirmed appointment, a calendar event, or an email that is sent.
• Legal basis: the user's consent to have their appointment request stored locally as part of the demo.
• Field status: reason, date, time slot, first name, last name, company, and email required; message optional.
• Recipients: none.
• Storage: localStorage (key atypikhouse:rendezvous_partenaires).
• Duration: see section 8.

Mock booking

• Data collected: the traveller's identity and contact details (first name, last name, email, phone), check-in and check-out dates, number of travellers, stay, options chosen, mock price, payment method chosen, applicable cancellation policy (a full copy stored with the booking), status, date and version of the Terms of Sale accepted, confirmation email sending status (see section 5), and, if cancelled, who cancelled it, the reason, the date, and the mock refunded amount.
• Purpose: demonstration of an end-to-end booking flow, including cancellation.
• Legal basis: the data controller's legitimate interest in enabling the mock booking flow requested by the user and sending their confirmation email.
• Recipients: EmailJS and the connected email provider (see section 5), only for travellers signed in to an account — never for guest bookings.
• Storage: localStorage (key atypikhouse:reservations).
• Duration: see section 8.

Mock payment

No genuine bank data is needed for this demo to work. Users should never enter any real bank details. The "card number", "expiry", and "CVC" fields in the booking flow and gift cards are demo fields only: their content is only checked against a format (expected number of digits), never stored in local storage, never sent to EmailJS or any other API, and never added to cookies, a URL, or a technical log.

Traveller reviews

• Data collected: rating, title, comment, displayed name.
• Purpose: demonstration of publishing and moderating reviews. Reviews correspond to mock bookings and do not result from any real stay.
• Legal basis: the data controller's legitimate interest in enabling the demonstration, display, and moderation of reviews linked to mock bookings.
• Recipients: none.
• Storage: localStorage (key atypikhouse:avis).
• Duration: see section 8.

Newsletter

• Data collected: email address.
• Purpose: demonstration of a newsletter sign-up.
• Legal basis: the user's explicit consent, collected via a checkbox unchecked by default, with no automatic sign-up.
• Recipients: none. No third-party sending tool (such as Mailchimp) is connected in this version: the address is only kept locally, and the message shown after signing up is a simulation — no confirmation email is actually sent.
• Storage: localStorage (key atypikhouse:newsletter_subscribers).
• Duration: see section 8.

Mock gift cards

• Data collected: recipient's name and email, buyer's name, amount, personal message, requested send date.
• Purpose: demonstration of a gift card purchase.
• Legal basis: the user's consent to have the mock gift card information stored locally as part of the demo.
• Recipients: none. No email is sent to the recipient: the card is only shown on screen and can be downloaded as a text file by the buyer.
• Storage: localStorage (key atypikhouse:cartes_cadeaux).
• Duration: see section 8.

Creating a stay (host area)

• Data collected: stay information and photos. Photos added by the host are converted to an encoded image (Base64) and stored as-is in local storage — no file is ever sent to a server or remote service.
• Purpose: demonstration of creating and approving a listing.
• Legal basis: the data controller's legitimate interest in enabling the host area to work and demonstrating listing creation and approval.
• Recipients: none.
• Storage: localStorage (key atypikhouse:logements_hebergeur).
• Duration: kept as long as the host account exists and the listing is not deleted.

Admin log and data-rights requests

An administrator's moderation actions (rejection, removal, deletion) and clicks on "Request access to my data", "Export my data", or "Request a correction" are logged locally (keys atypikhouse:journal_administration and atypikhouse:demandes_rgpd) for demo and audit purposes.

"Export my data" genuinely downloads a JSON file containing the signed-in account's AtypikHouse data. "Request access to my data" and "Request a correction" remain simulations, logged locally: no one actually receives these requests, which the message shown to the user explicitly states.

Legal basis: the data controller's legitimate interest in ensuring the security, moderation, and traceability of actions carried out in the demo.

No profiling or automated decision-making

AtypikHouse carries out no profiling based on the data collected.

No decision producing legal effects or significantly affecting the user is made in a fully automated way.

The approvals, rejections, and administrative actions shown in this demo do not constitute decisions with any real effect on the user.

5. EmailJS and confirmation emails

After a mock booking is confirmed by a traveller signed in to an account (never for a guest booking), a confirmation email is genuinely sent using the EmailJS service.

The following data, and only this data, is sent to EmailJS to build this email:

• the traveller's email address (the one linked to their account, never an editable form field);
• the traveller's name;
• the booking number;
• the stay's name and region;
• check-in and check-out dates;
• number of travellers;
• total mock amount (with no currency indicated in the variable);
• booking status;
• applicable cancellation policy;
• a link to the personal account area (the real address of the site being visited).

No bank details, password, or sign-in token is ever sent to EmailJS: only the variables above, strictly needed for the confirmation template, are sent to it.

EmailJS acts as a technical provider for sending the messages. The information needed for the confirmation email is sent to it, as well as to the email provider connected to the service: Outlook / Microsoft 365.

Actual recipients: EmailJS Pte. Ltd. and Microsoft (the email provider connected to the account EmailJS uses for sending).

EmailJS may also process technical metadata about the sending, in particular the date and time of the request, its status, and information needed for security and abuse prevention.

How long this information is kept depends on the EmailJS account settings and the provider's policy.

6. Maps and external resources

Two real maps are built into the site, each loaded only after your consent to the "External features" category in the cookie banner (or directly if that choice has already been saved):

• Google Maps (stay listing page, contact page): an embedded map (iframe) pointing to google.com/maps. Provider: Google Ireland Ltd.
• Stays basemap ("Our stays" page): the Leaflet library loaded from unpkg.com, with a basemap provided by CARTO (tiles served from basemaps.cartocdn.com). Leaflet is a display library; the actual basemap provider is CARTO, identifiable in the tile URL.

Loading these two resources is genuinely blocked before your consent: without it, neither the Leaflet library, the CARTO tiles, nor the Google map are requested over the network.

When a map is actually loaded, technical data may be sent to the relevant provider: IP address, browser information, date and time of the request, page viewed. No geolocation function is used by the site itself.

The typefaces used by the site are hosted locally and loading them triggers no data transmission to an external provider.

7. Cookies and trackers

AtypikHouse itself sets no HTTP cookie via document.cookie.

The site does, however, use the browser's local storage, in particular localStorage and sessionStorage. These technologies can access or store information on the user's device and therefore count as trackers under the applicable rules.

Trackers strictly necessary for the site to work can be used without prior consent. Non-essential external resources are blocked until the user consents.

Google may set or read trackers when the Google Maps iframe loads; their exact name and duration are not determined by AtypikHouse and are therefore not invented here. No cookie specific to CARTO or unpkg.com was observed during our checks: both are documented above as requests to third-party services, not as cookies.

No analytics, advertising, or marketing tool is currently installed on this version of the site. No corresponding consent category is therefore offered in the banner.

If such a tool is added later, this policy and the cookie policy will be updated and new consent will be requested before it is activated where necessary.

Manage your preferences at any time from Cookie settings (French page), which reopens the preferences panel.

8. Retention periods

The periods below apply to this demo's local data and are genuinely enforced by an automatic purge mechanism that runs when the site loads: any entry older than its threshold is removed from local storage.

User accounts have been covered by this automatic purge since this update: an account with no sign-in for 12 months is deleted (linked reviews and bookings anonymised as with a voluntary deletion, notifications removed, host listings removed), unless it is the account currently signed in in the tab where the purge runs. The fixed demo accounts (quick access offered on the sign-in page) are demo data reused on every visit and are never affected.

9. Security

No genuine bank data is collected or stored on this site.

Demo passwords are hashed using the SHA-256 algorithm before being stored locally. This mechanism avoids storing them in plain text, but is not an authentication solution suited to a production environment.

This version's account system is a local simulation. Users should not use a password already used on another service.

A genuine production deployment would require server-side authentication and a password-hashing function designed for that purpose, using in particular a per-account salt and a slowing mechanism such as Argon2 or bcrypt.

10. Your rights

Under the GDPR, you have the right to access, rectify, erase, object to, and restrict the processing of your data, and, where applicable, to data portability.

To exercise your rights, you can contact the data controller using the details given in section 1 of this policy, at contact@atypikhouse.fr.

The rights that apply may vary depending on the legal basis for the processing.

Where processing is based on legitimate interest, you may exercise your right to object for reasons relating to your particular situation, subject to applicable limits.

Where processing is based on your consent (newsletter, non-necessary cookies), you can withdraw it at any time. Withdrawing it does not affect processing carried out before the withdrawal.

Data stored only in your browser can also be deleted using the site's features: deleting your account from your personal account area, or the "Delete my local data" action (traveller and host areas), which clears all AtypikHouse data from this browser after confirmation — or by clearing the site's local data in your browser settings.

If, after contacting the data controller, you believe your rights are not being respected, you can lodge a complaint with the CNIL (French data protection authority).

11. Transfers outside the European Union

Using EmailJS may result in some data being transferred to the United States. EmailJS states that it governs transfers of European data through a mechanism recognised by the European Commission or standard contractual clauses. This mechanism is not presented here as an absolute guarantee.

The email provider connected to EmailJS (Outlook / Microsoft 365) may also process the data sent on infrastructure located outside the European Union, under the same safeguards declared by Microsoft.

For Google Maps, Google Ireland Ltd. may transfer data to the United States under Google's own mechanisms, outside AtypikHouse's control. For CARTO and unpkg.com, no precise documentation of a transfer outside the EU has been verified to date: no claim is therefore made on this point.

12. Updates to this policy

The data controller may amend this policy to reflect changes to the site or applicable rules. The last-updated date is shown at the top of this page.

13. Contact

For any question about this privacy policy or your personal data, contact the data controller identified in section 1:

Quentin Seynaeve — AtypikHouse student project
contact@atypikhouse.fr

Related documents

• Legal notice (French page)
• Terms of use (French page)
• Terms of sale (French page)
• Cancellation policy (French page)
• Cookie policy (French page)
• Cookie settings (French page)
• Accessibility (French page)

↑ Back to top