Privacy Policy

Last updated: 28 October 2026.

1. Data controller

The data controller and publisher of Barbads.com is FWI Editions, a French single-member limited liability company (EURL) with share capital of €[CAPITAL], registered with the Trade and Companies Register (RCS) of [VILLE] under number [SIREN]. Registered office: [ADRESSE]. Publication director: [NOM]. VAT: [TVA]. Contact: privacy@barbads.com.

2. Data collected

• Account data: surname, first name, email address, telephone number, password (hashed) and optional profile photo.
• Listings and messages: content you post, photos and messages exchanged with other users.
• Payment data: payments are processed by Stripe (Stripe Payments Europe Ltd., Ireland). Barbads receives transaction references, payment status and billing details needed for invoices and refunds; card details are handled by Stripe only.
• Technical data: IP address, browser type, operating system, pages viewed, timestamps and security logs.
• Cookies: see Cookie Policy.

3. Purposes and legal bases

• Providing and operating the service (account creation, listing publication and messaging) — performance of a contract (art. 6.1.b GDPR).
• Security, fraud and abuse prevention, moderation — legitimate interest (art. 6.1.f GDPR).
• Audience measurement and service improvement — consent obtained via the cookie banner (art. 6.1.a GDPR).
• Service communications (message notifications, security alerts) — performance of a contract.
• Newsletter and marketing communications — consent, which may be withdrawn at any time.
• Compliance with legal obligations (accounting, court orders) — legal obligation (art. 6.1.c GDPR).

4. Service providers and recipients

Your data is accessible to authorized Barbads staff and, strictly to the extent necessary, to these providers:

• Lovable — website hosting and AI features (Lovable AI). Sweden-based provider; processing may use international infrastructure.
• Supabase — database, sign-in and file storage. Region: [RÉGION À CONFIRMER].
• Stripe — payments, invoicing and fraud prevention. Stripe Payments Europe Ltd., Ireland, with international group operations.
• Mailjet — service and notification e-mails. France / EU.
• Amazon Web Services (Amazon SES) — processor for sending service, saved-search and listing notification e-mails; receives only the recipient address and message content required for delivery. International transfers are subject to the safeguards described below.
• Twilio — SMS (phone verification and notifications). United States and international networks.
• Sentry — error reporting, with personal data masked. United States provider.
• Cloudflare — infrastructure delivery, security and Turnstile anti-bot checks. United States provider, global network.
• OpenStreetMap — maps. OpenStreetMap Foundation, United Kingdom.
• AI providers via Lovable AI — Google Gemini and OpenAI, for listing analysis and moderation. United States / international infrastructure.
• Optional advertising recipients: Google Ads, Meta (Facebook & Instagram) and Microsoft Ads — purpose: advertising measurement and optimisation; legal basis: consent (art. 6.1.a GDPR). Only when configured, activated and explicitly accepted through marketing cookies. Data: click identifiers and successful conversion types, without contact data, customer matching, listing content or booking details. Internal first-party attribution lasts 30 days. We retain dated, versioned consent evidence, region and withdrawal choices; you can withdraw at any time in Cookie settings, stopping new reporting and clearing active attribution. Provider processing may occur internationally; sensitive or otherwise prohibited conversions are not shared. See Marketing in our Cookie Policy for cookies, tags and durations.

We never sell your personal data. We may be required to disclose it to competent authorities pursuant to a lawful request.

5. Location and transfers

Some providers listed above process data outside the European Economic Area, including in the United States. Where GDPR transfer rules apply, these transfers rely on an adequacy decision (including the EU–US Data Privacy Framework for certified recipients) or on the European Commission's Standard Contractual Clauses. Contact privacy@barbads.com for details of the safeguards applying to your data.

6. Retention periods

• User account: for as long as the service is used, followed by intermediate archiving for 3 years from the last activity.
• Published listings: for the selected display period, then deleted or anonymized.
• Internal messaging: 3 years from the last exchange.
• Accounting data: 10 years (Article L.123-22 of the French Commercial Code).
• Technical and security logs: 12 months maximum.
• Marketing / newsletter: 3 years from the last contact initiated by you.
• Cookie consent evidence: 6 months.

7. Your rights

Under Articles 15 to 22 of the GDPR and the French Data Protection Act, you have the following rights:

• the right to access, rectify and erase your data;
• the right to restrict processing and the right to object to processing;
• the right to data portability;
• the right to withdraw your consent at any time (without retroactive effect);
• the right to set instructions concerning the fate of your data after your death.

To exercise these rights: privacy@barbads.com. Proof of identity may be requested where there is reasonable doubt. We will respond within one month.

You may also lodge a complaint with the CNIL — French Data Protection Authority, 3 place de Fontenoy, 75007 Paris, cnil.fr.

Where the Barbados Data Protection Act, 2019 applies, you also have the rights it provides — including access, rectification, erasure, objection, portability and rights relating to decisions based solely on automated processing — and you may complain to the Data Protection Commissioner of Barbados, 5th Floor, SSA Building, Vaucluse, St. Thomas, Barbados, tel. +1 (246) 536-1200, gov.bb.

8. Security

We implement appropriate technical and organizational measures to protect your data: TLS encryption of communications, hashed passwords, access controls, logging, regular backups, the principle of least privilege and reputable infrastructure providers. In the event of a breach likely to pose a risk to your rights, we will notify the CNIL within 72 hours and, where appropriate, the affected individuals.

Automated moderation

Listings are analysed by AI to help detect prohibited content and fraud. If a listing is refused, you see the reason and can ask for a human review from your account or by writing to support@barbads.com.

9. Minors

The service is not intended for minors under 18. No account may be created by anyone below this age. If we discover that an account has been opened by a minor, it will be deleted.

10. Cookies

See our Cookie Policy. You can change your choices at any time using the dedicated link in the footer.

11. Changes

This policy may change; the “Last updated” date will be revised. Material changes will be notified to registered users by email.