Legal notice

1. Data controller

In accordance with Regulation (EU) 2016/679 (GDPR) and the amended French Data Protection Act No. 78-17, the controller of the processing described below is MESRA CONCIERGERIE (SAS), SIREN 101123883, 5 Impasse de la Colombette, 31000 Toulouse, France, contact@mesra-conciergerie.com, +33 7 77 69 34 46.

2. Data we process

On the website (requests for an estimate, contact requests, newsletter):

• last name, first name, email address, telephone number
• features and location of the property, free-text message
• for the newsletter: your email address and the related preferences.

In the owner area, on the website and in the Mesra Conciergerie mobile app:

• Account: last name, first name, email address, telephone number, country, profile photo if you choose one, account identifier.
• Properties: address and features, photos attached to a request for management, access information (codes, instructions), rental preferences.
• Bookings and guests: guests’ names, dates of stay, amounts and income. This data comes from the booking platforms, through our management tool Hospitable.
• Messages exchanged with guests.
• Documents that you send us (supporting documents, accounting records), and your accountant’s email address if you turn on automatic sending.
• Cleaning: cleaning reports, photos of the property, comments and reported issues, with the name and email address of the cleaner or team member who writes them.
• Support: your requests and our exchanges with you.
• Technical data: security logs (IP address, date and type of request), session token, and a random identifier specific to the installation of the app, used only to deliver its updates.

The mobile app only accesses the camera and your photos when you choose to attach a photo. It uses no geolocation, no advertising identifier and no audience measurement or tracking tool. Its notifications are generated on your phone: no notification token is collected.

3. Purposes and legal bases

• Management of your property and of your owner area (bookings, income, messages, cleaning, documents, support): performance of the management contract.
• Requests for an estimate, contact requests and requests to manage a property: steps taken prior to entering into a contract.
• Invoicing and accounting: legal obligations.
• Security of the website and the app, and prevention of abuse: legitimate interests.
• Newsletter: consent, which you can withdraw at any time with the link in every email.
• AI writing assistant: consent, requested before the first use (see section 4).

4. Artificial intelligence and translation

For properties under digital management, an assistant can rephrase your reply to a guest or suggest a reply. It only works when you start it. Your draft and the conversation concerned are then sent to Anthropic (United States), which produces the suggestion. Under its commercial terms, Anthropic does not use the data received through this service to train its models. We ask for your consent before the first use, and you can withdraw it at any time from My account, in the app and on the website.

Guest messages written in another language are automatically translated into French by Microsoft Azure Translator, with processing in France.

5. Recipients and processors

Your data can be accessed by authorised staff of MESRA CONCIERGERIE and, for the property they look after only, by the cleaner and their team. Your data is never sold or shared for commercial purposes. Our processors, who are bound by confidentiality:

• OVHcloud (France): hosting of the website, the database and the files, sending of emails.
• Hospitable (United States): tool for managing bookings and messages from rental platforms.
• Anthropic (United States): writing assistant, only if you use it.
• Microsoft Azure (processing in France): translation of guest messages.
• Expo (United States): delivery of mobile app updates.
• Cloudflare (United States): protection of forms against bots and aggregated audience measurement for the website.
• Google (United States): signing in with a Google account on the website, if you choose it, and management of the website’s tags.
• Meta: measurement of the website’s advertising campaigns (see section 11).

6. Hosting and transfers outside the European Union

Your data is hosted in France by OVHcloud. Some of the processors listed in section 5 are based in the United States. These transfers are covered by the safeguards provided for in Articles 45 and 46 of the GDPR: an adequacy decision of the European Commission, in particular the EU-US Data Privacy Framework for the companies that take part in it, or the standard contractual clauses of the Commission.

7. Retention periods

• Account and owner area: as long as the account is active, then deletion when the account is closed (section 10).
• Bookings, income and cleaning reports for a property: for as long as Mesra manages the property.
• Accounting records and invoices: 10 years, the legal period (Article L123-22 of the French Commercial Code).
• Requests for an estimate and prospects: 3 years after the last contact.
• Newsletter: until you unsubscribe.
• Technical and security logs: 12 months at most.

8. Security

• Encryption of all communications (TLS), on the website and in the app.
• Encryption at rest of sensitive information, such as property access codes.
• App session kept in the encrypted secure storage of the phone.
• Access limited to authorised persons, on a need-to-know basis.
• Security logging, limits on sign-in attempts, backups.

9. Your rights

You have the rights of access, rectification, erasure, restriction of processing, objection and data portability, as well as the right to give instructions on what happens to your data after your death. Where processing is based on your consent, you can withdraw your consent at any time, without affecting the processing already carried out. To exercise your rights: contact@mesra-conciergerie.com. You can also lodge a complaint with the CNIL, the French data protection authority.

10. Account deletion

Any account holder can delete their account directly from My account, in the Mesra Conciergerie app or in their web area. The detailed procedure is on the Delete my account page. The account, access rights, documents, contractual items, tickets and contact details linked to it are deleted. Managed properties stay in the Mesra portfolio but are detached from the account: the operating history that remains no longer contains any reference to the deleted account. We only keep the data that the law requires us to keep, such as accounting records, for the legal period given in section 7. Data held by the booking platforms is subject to their own policies and is not affected by this deletion.

11. Website trackers

The mobile app uses no trackers. The website measures its audience on an aggregated basis with Cloudflare Web Analytics, without cookies or individual profiling. It also uses Google Tag Manager and the Meta pixel, which place trackers to measure how well our advertising campaigns perform. You can block them in your browser settings.

12. Changes

This policy may change. Last updated: Tue 22 Sep 2026.