Privacy Policy

1. Who We Are

La Vida Tunisie operates an accommodation marketplace and related administration tools for browsing properties, requesting bookings, managing reservations, processing deposits, and synchronizing property availability. In this Privacy Policy, La Vida Tunisie is referred to as we, us, or our.

For privacy questions, deletion requests, or questions about our Google Calendar integration, contact us at vida.tunisia.escapes@gmail.com.

2. Scope of This Policy

This policy applies to the La Vida Tunisie website, booking flows, customer accounts, administrative dashboard, calendar connection pages, APIs, email communications, and integrations that link a property calendar to La Vida availability.

3. Information We Collect

Depending on how you use La Vida Tunisie, we may collect:

• Account information: name, email address, phone number, preferred language, password authentication data, email verification status, and account role.
• Booking information: property selected, check-in and check-out dates, guest count, meal options, booking status, payment status, deposit amount, remaining amount, currency, guest contact details, and admin notes needed to manage the reservation.
• Payment information: payment references, transaction status, webhook status, and payment provider responses. We do not intentionally store full payment card numbers; payment details are handled by the configured payment provider.
• Property and owner information: property details, images, amenities, location data, availability rules, owner email address, and calendar connection status.
• Technical information: device and browser details, IP address, approximate location derived from network data, logs, security events, session data, and analytics events.
• Communications: messages, support requests, email delivery records, and calendar connection invitations.

4. Google Calendar Data

Property owners or administrators may optionally connect a Google Calendar so La Vida Tunisie can block unavailable booking dates and reduce double bookings. Connecting Google Calendar is not required for guests to browse or request accommodation.

Google OAuth scopes requested

• https://www.googleapis.com/auth/calendar.events.readonly to read calendar events for availability synchronization.
• https://www.googleapis.com/auth/calendar.calendarlist.readonly to read the list of calendars available to the connected Google account when needed to select, confirm, or maintain the linked property calendar.

Google data we process

We process the connected account email, OAuth access and refresh tokens, granted scopes, token expiration time, calendar ID, calendar time zone, sync token, event ID, event ETag, event status, transparency value, and event start and end date/time.

Our availability sync is designed to use only the fields needed to create unavailable date ranges. We do not store Google Calendar event titles, descriptions, locations, attachments, guest or attendee lists, conference information, reminders, or private notes as part of the normal synchronization record.

How Google Calendar data is used

• To connect a property owner calendar after explicit OAuth consent.
• To refresh access tokens so the calendar can remain connected while the owner is offline.
• To convert busy calendar events into property unavailable ranges.
• To show guests and administrators that dates are unavailable without showing private event details.
• To troubleshoot synchronization errors, prevent abuse, and maintain security.

We do not request permission to create, edit, delete, share, or permanently delete Google Calendar events.

5. Google API Limited Use

The use and transfer by La Vida Tunisie of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements.

• We use Google Calendar data only to provide or improve the calendar availability feature that the property owner or administrator authorized.
• We do not sell Google user data or transfer it to advertising platforms, data brokers, information resellers, credit agencies, or lending services.
• We do not use Google user data for targeted advertising, personalized advertising, retargeting, interest-based advertising, or training generalized AI or machine learning models.
• We do not allow humans to read raw Google Calendar data except when the connected user gives affirmative permission for support, when necessary for security or abuse investigation, when required by law, or when data is aggregated for internal operations in accordance with applicable privacy requirements.

6. How We Use Information

We use information to:

• provide, operate, and secure La Vida Tunisie;
• create and manage accounts, bookings, deposits, and stays;
• verify identity, email ownership, and account access;
• send transactional emails and calendar connection invites;
• calculate availability and prevent conflicting bookings;
• detect errors, abuse, fraud, and security incidents;
• comply with legal, tax, accounting, and regulatory duties;
• improve performance, reliability, and user experience.

7. How We Share Information

We do not sell personal information. We share information only when necessary to operate La Vida Tunisie, comply with law, or protect users and the service.

• Service providers: hosting, database, storage, email delivery, analytics, monitoring, maps, and payment providers may process information on our behalf under confidentiality and security obligations.
• Booking participants: limited booking and contact information may be shared between guests, administrators, and property operators when needed to manage a reservation.
• Availability display: derived unavailable date ranges from Google Calendar may be shown to guests and administrators, but private Google event details are not shown.
• Legal and safety: we may disclose information if required by law, legal process, fraud prevention, security, or to protect rights, property, or safety.
• Business transfers: if La Vida Tunisie is involved in a merger, acquisition, financing, reorganization, or sale of assets, information may transfer as part of that transaction, subject to this policy and applicable law.

8. Security

We use administrative, technical, and organizational safeguards designed to protect personal information. These include HTTPS in transit, database access controls, password hashing, role-based administrative access, logging and monitoring, and encryption of Google OAuth tokens at rest using AES-256-GCM before storage in our database.

No internet service can guarantee perfect security. If we learn of a security incident that affects your information, we will take appropriate steps consistent with applicable law.

9. Retention and Deletion

• Account and profile information is retained while the account is active and as needed for security, support, legal, and business purposes.
• Booking, transaction, and payment records are retained as needed to provide the service and meet tax, accounting, dispute, fraud prevention, and legal obligations.
• Google OAuth tokens are retained only while the calendar connection remains active or as needed to complete a requested disconnection, deletion, security, or legal process.
• Google-derived unavailable date ranges are retained while needed to provide availability, resolve booking conflicts, maintain audit integrity, or comply with law. When a connected calendar is removed, we stop syncing it and delete or deactivate derived blocks unless retention is required for legitimate business or legal reasons.
• Backups and logs are retained on a limited operational cycle and deleted or overwritten according to our backup and security practices.

10. Your Choices and Rights

• You can request access, correction, export, or deletion of your personal information by contacting us.
• You can ask us to disconnect a Google Calendar at any time by contacting us from the connected owner or administrator email address.
• You can revoke Google Calendar access granted to La Vida Tunisie from your Google Account permissions page at https://myaccount.google.com/permissions.
• You can opt out of non-essential communications where an unsubscribe or preference option is available. Transactional messages may still be sent for bookings, security, payments, or calendar connection events.

We may need to verify your identity before completing a request. Some information may be retained where required or permitted by law.

11. Cookies, Analytics, and Similar Technologies

We may use cookies, local storage, server logs, and analytics tools to keep users signed in, remember preferences, measure site performance, detect abuse, and understand how the service is used. Google Calendar data is not used for advertising analytics.

12. International Transfers

Our service providers and infrastructure may process information in Tunisia, the European Economic Area, the United States, or other countries where our providers operate. Where required, we rely on appropriate safeguards for international transfers.

13. Children

La Vida Tunisie is not directed to children under 13, and we do not knowingly collect personal information from children under 13. If you believe a child provided personal information to us, contact us so we can take appropriate action.

14. Changes to This Policy

We may update this Privacy Policy to reflect operational, legal, or security changes. If we materially change how we use Google user data or other personal information, we will update this page and, where required, notify affected users or request renewed consent before using data in a new way.