Privacy Policy

Last updated: 11 September 2026

1. Roles: controller and processor

For spectator data (the venues' customers), Stashme SAS is a processor within the meaning of Article 28 GDPR: the venue that welcomes you is the controller. It decides which data is requested (phone, name, email, plate), how it is used, and answers your requests to exercise your rights.

Stashme is the controller for visitors of its marketing website, venue staff accounts and subscription billing.

2. Data collected

2.1 Venue user data (staff)

  • Email address
  • First and last name
  • Password (stored as a bcrypt hash)
  • Role (Administrator or Staff)
  • Last login date

2.2 Venue customer data (end users)

  • Phone number (only if the venue enables it, otherwise nothing is asked)
  • First and last name (if enabled by the venue)
  • Consent to promotional SMS and Wallet notifications (unchecked by default)
  • Session data: hanger or spot number, deposited items, drop-off and return timestamps
  • Payment data: processed by Stripe or SumUp, never stored by Stashme (no card number, no amount)
  • Email address (if enabled by the venue)
  • Valet: licence plate, make, model and colour of the vehicle (if enabled)
  • Valet: photo of the vehicle at check-in and automatic plate reading on that photo (if enabled)
  • Rating and comment left after the return
  • Technical identifiers of Apple Wallet and Google Wallet passes (no personal data in the pass, masked number)
  • Pseudonymous identifier derived from the phone number by a process that cannot be reversed without a server key, to link your visits in a venue's statistics

In anonymous mode, none of this data is collected: the ticket is identified by a short reference.

2.3 Technical data

  • IP address and browser of logged-in staff (audit log and dashboard sessions), erased after 12 months
  • Technical cookie for the current ticket on your phone (see the cookie policy)
  • Cookie-less Umami audience measurement across the website and the application, with no ticket or payment identifier in the addresses sent. Google Analytics and Meta Pixel on the marketing website only, never on the drop-off form, the ticket, the payment page or the dashboard.

3. Purposes of processing

Data is collected for:

  • Providing the cloakroom management service
  • Generating digital tickets and QR codes
  • Processing payments via third-party providers
  • Sending service-related notifications (returns, reminders)
  • Sending marketing communications (only with explicit consent)
  • Improving the service through anonymized statistics
  • Ensuring security and preventing fraud
  • Read the plate on the vehicle photo to avoid manual entry (valet)
  • Find the owner of an item left at the cloakroom
  • Collect your feedback after the return

4. Legal basis for processing

  • Performance of contract : processing necessary for providing the service
  • Consent : promotional SMS, promotional Wallet notifications, audience measurement cookies on the marketing website
  • Legitimate interest : security, fraud prevention, cookie-less Umami audience measurement and pseudonymised attendance statistics
  • Legal obligation : retention of billing data

5. Data sharing

Data may be shared with the following providers (sub-processors), each for the stated purpose only:

  • SumUp : online payment (Ireland, card data never sent to Stashme)
  • Brevo : transactional emails and staff invitations (France)
  • The Venue : its own customers' data as part of the service
  • Competent authorities : when legally required
  • Stripe : online payment, Apple Pay and Google Pay (Ireland / United States, DPF and standard contractual clauses)
  • Twilio : transactional and promotional SMS, STOP handling (United States, standard contractual clauses)
  • Cloudflare R2 : vehicle photo storage (European Union)
  • Apple : Apple Wallet passes and pass update notifications (United States, DPF)
  • Google : Google Wallet passes, automatic plate reading (Gemini) and Google Analytics on the marketing website (United States, DPF)
  • Anthropic : plate reading and lost-item notices, depending on configuration (United States, DPF, no training on API data)
  • Meta : advertising audience measurement on the marketing website only (United States, DPF)
  • Umami : cookie-less audience measurement on the marketing website and the application pages (form, ticket, payment, dashboard)
  • Telegram : internal alerts to the Stashme team: a rating and the venue name, never the comment nor any spectator data
  • OVHcloud : hosting of the application and the database (France)

Stashme never sells personal data. Some providers are established in the United States: transfers rely on the adequacy decision for the Data Privacy Framework (DPF) where the provider is certified, otherwise on the European Commission's standard contractual clauses. A copy of the applicable safeguards is available on request at privacy@stashme.io.

6. Data security

  • Password encryption (bcrypt, 10 rounds)
  • Encrypted communications (HTTPS/TLS)
  • JWT authentication tokens
  • Role-based access control (RBAC)
  • PostgreSQL database with encrypted connections
  • Append-only audit log (every action on a session is traced)
  • Phone number masked (last 3 digits) in logs, Wallet passes and the platform view
  • Automatic anonymisation of personal data at the end of the retention period, every night

7. Data retention

  • User accounts : retained as long as the account is active
  • Cloakroom sessions : identity erased 30 days after the return (anonymous statistics kept: dates, number of items, event)
  • Payment data : retained in accordance with legal obligations (10 years for accounting records)
  • Password reset tokens : 1 hour
  • Invitations : 7 days
  • Contacts who consented to SMS : kept 3 years after the last visit, then anonymised
  • Lost items : 1 year after the drop-off, to find the owner
  • Vehicle photos : deleted 30 days after the return
  • Staff IP address and browser : 12 months (audit log and dashboard sessions)
  • Wallet registrations : deleted with the session
  • End of the venue's subscription : export offered to administrators, then full anonymisation 90 days after cancellation

8. Your rights (GDPR)

Under the GDPR, you have the following rights:

  • Right of access : obtain a copy of your personal data
  • Right to rectification : correct inaccurate data
  • Right to erasure : request deletion of your data
  • Right to restriction : restrict the processing of your data
  • Right to object : object to the processing of your data
  • Right to data portability : receive your data in a structured format
  • Right to withdraw consent : withdraw your consent at any time

As a spectator, contact the venue that welcomed you first: it is the controller. Stashme gives it, in its dashboard, the erasure of your data and the export of your history.

Right to object to direct marketing: you may object at any time and without reason to promotional SMS and Wallet notifications, by replying STOP to the SMS, by deleting the Wallet pass, or by asking the venue. No further promotional message will be sent.

To exercise these rights, contact us at privacy@stashme.io. We will respond within 30 days.

You can also file a complaint with the CNIL (Commission Nationale de l'Informatique et des Libertes): www.cnil.fr.

9. Sub-processing (DPA)

Stashme acts as a data processor within the meaning of Article 28 of the GDPR. A Data Processing Agreement (DPA) is available upon request for Venues that require one.

A data processing agreement (DPA) and a "spectator GDPR" information sheet are provided to each customer venue; they describe the data, purposes, sub-processors and retention periods above.

10. Contact

For any questions regarding the protection of your data: privacy@stashme.io