Privacy policy
What data is collected, why, who receives it, how long it is kept and how to exercise your rights.
Version of October 9, 2026, in force from that date.
1. Who handles your data
The controller is Croissant in Bed, identified in the legal notice. For any question about your data: support (at) croissantinbed.com.
No data protection officer has been appointed: the activity falls into none of the cases where article 37 GDPR makes one mandatory. The address above is the single point of contact.
The property manager or owner running the home you are staying in is the controller for its own property and stay data; we are the controller for the order, its payment and its delivery.
2. What we hold
| Category | Detail | Source |
|---|---|---|
| Identity and contact | The name you give for the delivery — one field, the name the courier will ask for — and your mobile number, both required; email address and preferred language (optional). | You |
| Delivery | The home’s address, floor, door, intercom name, access instructions, building code, drop-off policy, and any free-text instructions you add for the courier. | The property manager or owner, then your own corrections |
| Order | Products, quantities, chosen window, substitution choice, amounts, and your order history. | You |
| Payment | Amount, currency, transaction reference, authorization result, and the card’s last four digits and type. The card number is never passed to us. | The payment provider |
| Fulfillment | Delivery events, the courier’s position and public identity, timestamps, and photographic proof of delivery. | The delivery provider |
| Preparation | Photographs of the bag taken at the bakery’s counter when the order is ready; they show the bag label, with the name you gave and the order number. | The bakery |
| Customer relationship | Complaints, photographs you attach, exchanges with us, ratings and comments, tips. | You |
| Technical | IP address, device and browser type, language, access and security logs, notification delivery status. | Automatic |
We collect no health data: the service records no allergy and no medical diet. Allergen information belongs to the products, never to you. Avoid putting anything in the free-text courier instructions that you would not want passed to the carrier.
The service is not aimed at children under fifteen and opens no accounts: no order can be placed without the code found in the home.
Delivery data reaching us from the property manager or owner is supplied by them; this policy is the information required by article 14 GDPR.
3. Why, and on what basis
| Purpose | Legal basis |
|---|---|
| Record and prepare the order, have it delivered, keep you informed, handle substitutions, cancellations, refunds and complaints. | Performance of the contract — article 6(1)(b) GDPR |
| Issue the receipt and the invoice, keep the accounts and meet tax and commercial obligations. | Legal obligation — article 6(1)(c) |
| Prevent and detect payment fraud, secure the service, filter automated traffic, keep proof of a disputed order or delivery. | Legitimate interest — article 6(1)(f) |
| Measure and improve service quality from ratings, incidents, and the gap between the promised and the actual arrival time. | Legitimate interest — article 6(1)(f) |
| Answer a message sent through the contact form or a bakery application. | Pre-contractual steps or legitimate interest — articles 6(1)(b) and 6(1)(f) |
| Send you news about our own service by email, if you have asked us to. | Consent — article 6(1)(a), which you can withdraw at any time |
| Establish, exercise or defend a legal claim. | Legitimate interest — article 6(1)(f) |
We never sell your data, and we never pass it to anyone for their own marketing. The messages sent for an order concern that order and nothing else: confirmation, progress, incident, refund. We may also send you news about our own service by email, but only if you asked for it: it is never on by default, every such message carries a one-click unsubscribe, and withdrawing costs you nothing else. Your mobile number is used to run the order and to reach you at delivery, never for marketing.
4. Who receives your data
Your data is never sold, never rented, and never passed to anyone so that they can market to you. It is available to our authorized staff, and disclosed only to the third parties whose involvement the order requires:
| Recipient | What it receives, and why | Where it is processed |
|---|---|---|
| The bakery selling and preparing the order | The contents of the order, the window, and the name you gave, printed on the bag label, which it photographs when the order is ready. Neither your address, nor your number, nor your access codes are passed to it. | France |
| Uber Portier B.V. (Uber Direct) | The name you gave, your mobile number, the address, floor, door, instructions and access code, to carry out the delivery. Access codes are removed from the provider’s reach once the delivery is complete. | Netherlands, United States |
| Stripe Payments Europe, Limited and Stripe, Inc. | The payment, its security, refunds and partner payouts. Stripe is a controller in its own right for fraud prevention and its regulatory obligations. | Ireland, United States |
| Twilio Ireland Limited | Sending the SMS messages about your order. | Ireland |
| Resend, Inc. | Sending the emails about your order. | United States |
| Cloudflare, Inc. | Hosting the site and the applications, serving images, and protecting against bots. | European Union, United States |
| Supabase, Inc. | Hosting the database, which is located in the European Union (Frankfurt, Germany). | European Union |
| Clerk, Inc. | Authentication for professional accounts. No account is created for a guest: your data is not passed to it. | United States |
| The property manager or owner | That an order was delivered to their home, its date and its amount, so their commission can be calculated. Neither your name, nor your number, nor the detail of your products is passed to them. | France |
We may also disclose data to our lawyers, our accountant, an insurer, or an administrative or judicial authority making a request in the proper legal form.
5. Transfers outside the European Union
Data is processed in the European Union wherever the provider allows it; the database is hosted in Frankfurt.
Some of the providers listed above are established in the United States or may access data from there for technical support. Those transfers are covered by the standard contractual clauses adopted by the European Commission on June 4, 2021 and, where the recipient is certified under it, by the adequacy decision of July 10, 2023 on the EU–US Data Privacy Framework, together with the applicable supplementary technical measures (encryption in transit and at rest, minimizing the fields sent). A copy of the safeguards can be requested at the contact address.
6. How long we keep it
| Data | Period |
|---|---|
| Accounting records: order, amounts, receipt, invoice | 10 years from the close of the financial year (article L. 123-22 of the French Commercial Code) |
| Contact details and order history tied to your device | 3 years from your last order, then anonymized |
| Building code, intercom name, access instructions and free-text instructions | Removed from the carrier’s reach as soon as the delivery ends; deleted from our systems 3 months after delivery |
| Photographic proof of delivery and delivery events | 13 months, covering the card chargeback period |
| Photographs of the bag taken at the bakery | 13 months after they are taken, covering the card chargeback period |
| Complaints, attachments, exchanges with customer service | 3 years from the last exchange, or until any proceedings end |
| Ratings and comments | 3 years |
| Your agreement to receive our news, or your withdrawal of it | 3 years from your last contact with us; a withdrawal is kept for the same period as proof that it was honored |
| Technical and security logs | 12 months at most |
| Messages sent through the public forms | 3 years from the last exchange |
| Partner and bakery accounts | The life of the relationship, then 5 years |
Past those periods, data is deleted or irreversibly anonymized. Data kept to meet an accounting obligation is used for nothing else.
7. Your rights
On the conditions set out in articles 15 to 22 GDPR you have the right to access your data, have it corrected, ask for it to be erased, ask for its processing to be restricted, object to processing based on our legitimate interest, withdraw at any time a consent you gave us, and receive the data you gave us in a structured format. You may also leave directions on what becomes of your data after your death (article 85 of French Act No. 78-17 of January 6, 1978).
The service creates no account, so those rights are exercised by email to support (at) croissantinbed.com, quoting the mobile number used for the order. That number is what ties your orders to you, and there is no form to fill in: an email is enough, and you owe us no reason for asking. Because a deletion cannot be undone, and a number alone does not prove who is writing, we may ask you to confirm one of your orders — its date, its exact amount, the apartment it went to — before we act. We ask only where a reasonable doubt about your identity remains, and we ask for nothing else.
With no account to sign in to, we check that the request really comes from you by sending a code by SMS to that number. The code is used for nothing else. We answer within one month, extendable by two months for a complex request, and erasure cannot cover records the law requires us to keep.
You may lodge a complaint at any time with the French data protection authority: CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France — cnil.fr.
8. Security and automated decisions
Data travels encrypted, access is individual and limited to what each role needs, sensitive operations are logged, and building codes are masked on screen by default with every reveal recorded. They are never printed on the bag label.
Choosing the bakery that sells and prepares your order and computing the available windows are automated. They rest on distance, opening hours and production capacity, never on a profile built from your data, and produce no legal effect concerning you within the meaning of article 22 GDPR.
9. Changes
This policy may change to reflect a change in the service or in the law. The date it was last updated is at the top of this page; a substantial change is flagged to you before your next order.