Privacy policy

• No advertising, no audience-measurement tool, no third-party tracker, no consent banner.
• Browsing the site — including the map — requires no account. The only exception is the visit counter on published business profiles, which stores a daily fingerprint instead of your IP address so the same visitor is not counted twice.
• An account is needed only to contribute. It stores what you typed, nothing more.
• Your data is never sold, rented or shared for advertising purposes.
• The database is hosted in the United States (AWS us-east-1, Virginia), so your account and your contributions are stored outside the European Union.

Freddy JEANTY, publisher of Flanbo Ayiti, is the data controller within the meaning of Regulation (EU) 2016/679 (GDPR). Full identification is on the legal notice page.

Any question about this policy: flanbopeyim@gmail.com.

Account

Name, e-mail address and/or phone number, password, optional avatar. Purpose: creating and using your account, and attributing your contributions. Legal basis: performance of the service you asked for. Retention: until you delete your account.

Contributions

Activities, projects, places, photographs and applications you submit, together with the account that submitted them. Purpose: publishing them on the site and its map, and moderating them. Legal basis: performance of the service. Retention: as long as the contribution is published.

Contact form

Name, e-mail address, message. Purpose: answering you. Legal basis: your request. Retention: 12 months after the exchange ends.

Page statistics

One counter per page and per day, aggregated in-house. No identifier, no IP address, no cookie, no third-party service — a page view cannot be traced back to anyone. Purpose: knowing which pages are useful. Legal basis: legitimate interest in running the site.

Business profile statistics

So that an entrepreneur can see how much visibility their published profile gets, each visit stores the profile, the day, and a fingerprint computed from your IP address and browser. Your IP address itself is never stored, and the fingerprint changes every day and differs from one business to the next, so it cannot follow you across days or across profiles. It exists only to avoid counting the same visitor twice in a day. No cookie, no third-party service. Business owners see counts only — never who visited. Legal basis: legitimate interest in giving entrepreneurs a measure of their visibility. Retention: 180 days.

Technical logs

The host keeps standard server logs (including IP addresses) for security and troubleshooting, under its own retention policy. Legal basis: legitimate interest in site security.

Passwords are never stored in clear text: only a hash is kept, and it is excluded from queries by default. The site asks for no bank details, no identity document and no sensitive data — never provide any.

A published contribution is visible to everyone, along with the display name of the account behind it. Your e-mail address and phone number are never shown on the site.

Do not publish a photograph in which someone is identifiable without their agreement, and do not put personal information about a third party in a description.

The publisher and the site's administrators, for moderation and support. Beyond them, only the technical providers required to run the site, each acting on instructions and under its own contract:

• Hostinger International Ltd — site hosting. Privacy policy.
• MongoDB, Inc. (MongoDB Atlas) — database hosting — servers in the United States (AWS us-east-1, Virginia). Privacy policy.
• MapTiler AG — map tiles, called directly by your browser when you open the map. Privacy policy.
• Google Ireland Ltd (YouTube, Google Fonts) — embedded videos and the site typeface, loaded by your browser. Privacy policy.
• Google Ireland Ltd (Gmail) — delivery of contact-form messages to the publisher's mailbox. Privacy policy.

The site's database is hosted in the United States (AWS us-east-1, Virginia). Your account and your contributions are therefore stored outside the European Union, by MongoDB Atlas (MongoDB, Inc.), under the safeguards of its data processing agreement.

Your browser also contacts third parties directly when it loads an embedded video or a map tile. And a message sent through the contact form is delivered to the publisher's mailbox, hosted by Google Ireland Ltd (Gmail), so that it can be answered.

Only strictly necessary items are stored, which is why no consent banner is displayed:

• flanbo_session — keeps you signed in. Set only when you log in, httpOnly, expires after 7 days, removed when you log out.
• NEXT_LOCALE — remembers whether you chose English or French.

Videos are embedded through youtube-nocookie.com, so YouTube stores nothing until you actually start playback. Starting playback places YouTube's own cookies, governed by Google's policy.

Under the GDPR you have the right to access your data, rectify it, erase it, restrict its processing, port it, and object to processing based on legitimate interest.

• From your account — view and edit your details, delete your contributions, and delete the account itself, at any time and without asking anyone.
• By e-mail — write to flanbopeyim@gmail.com for anything else: a copy of your data, an objection, or the removal of contributions that were kept. You will get an answer within one month.

Deleting your account erases your personal data and everything private attached to it: name, e-mail, phone number, password, favourites, comments, saved scenarios, applications and sign-in log. Your business profile and its statistics are deleted too — it is your own listing, with your contact details, and it does not outlive your account. Other contributions already published — activities, places, photographs — are kept without your name, so the map does not lose information useful to everyone. Ask us if you want those removed as well.

If you believe your rights are not respected, you may lodge a complaint with the CNIL (cnil.fr), the French data protection authority.

The site is open to everyone, but creating an account is intended for people aged 15 or over. Below that age, a parent or guardian must give their consent. If you are a parent and an account concerning your child should not exist, write to us and it will be removed.

This policy may change as the site does. The date at the top of this page is the one in force. A change that materially affects how your data is used will be announced on the What's new page.