Privacy Policy

The data controller is the operator of the Weslet platform, reachable via the Contact page (subject "Personal data") for any question or request about this policy.

Account: name, email, password (hashed only) or Google sign-in identifier, preferred language. Profile: WhatsApp number, country of residence, city. Activity: wishes, parcels, trips, connection requests, reviews given and received, reports, support messages.

Purchases: amount and status of your paid promotions (Boost/Bump). Payment itself is processed by Stripe — your card number never passes through our servers.

Technical and security logs: important account events (refused logins, admin actions, email sends) and infrastructure logs from our hosting providers (IP addresses, timestamps), used only for security and diagnostics.

Signup IP address: the IP address used when your account was created is stored with it, under our legitimate interest in preventing fake accounts and abuse. It is never public, is used for no other purpose, and is deleted with your account.

Measurement and advertising — only if you consent: pages viewed, where your visit came from, and your interactions with the site, sent to our measurement (Google Analytics) and advertising (Meta Pixel) tools. Without your consent, or when these tools are not active, none of this is collected or transmitted.

Contract performance: running the platform (accounts, listings, connections, transactional email notifications).

Legitimate interest: security, fraud and spam prevention, moderation, service improvement, audit log, and our host's aggregate audience measurement — with no cookie and no individual identifier (anonymous traffic statistics).

Consent: detailed audience measurement (Google Analytics) and advertising measurement (Meta Pixel), enabled only if you accept them via the cookie banner. Each purpose is chosen separately: accepting measurement does not enable advertising. You may withdraw your consent at any time via "Manage cookies" at the bottom of any page; withdrawal does not affect the lawfulness of processing carried out beforehand.

Legal obligation: keeping accounting records related to purchases.

Automated processing: some protections apply automatically — a filter refuses to publish a listing containing contact details, rate limits may temporarily block repeated actions, and unanswered connection requests expire on their own. These have no significant legal effect and can be contested via the Contact page. Any enforcement decision with meaningful consequences (suspension, account removal, withdrawal of a benefit) is made by a human, with automated signals serving only as input (GDPR art. 22). We do not sell your data and show no advertising on the site. If you accept advertising cookies, your interactions with Weslet may be used to measure and target our own campaigns on third-party platforms.

Your WhatsApp number and name are shared only with the user with whom a connection is mutually accepted — never publicly, never before acceptance.

Public profile: your display name, country and city, your statistics (deliveries completed, average rating, upcoming trips) and the reviews you received are visible to any visitor of your profile page — this is the platform's trust mechanism. Your email and WhatsApp number never appear there.

Indexing: your listings and public profile are visible without an account, so search engines may index them and shared links may show a preview on other services (WhatsApp, Facebook). After deletion, such external copies may briefly persist in those services' caches, outside our control.

Strictly necessary technical processors: application hosting, database and photo storage, transactional email delivery, payment processing (Stripe). Each accesses only the data needed for its function and is bound by data-protection commitments. No selling or renting of data.

Measurement and advertising, only with your consent: Google (Google Analytics) receives browsing statistics; Meta (Meta Pixel) receives the fact that you visited certain pages, so we can measure our campaigns and show you our ads on its own services. For these purposes those recipients act as independent controllers under their own policies. If you refuse, or while these tools are not active, no data is sent to them.

Business transfer: if the operation of Weslet is transferred to another entity — in particular when it is incorporated as a company, or in the event of a merger, sale or contribution of assets — data may be passed to that entity, which becomes the controller and remains bound by this policy. You will be informed beforehand and may delete your account before the transfer if you prefer.

We may disclose data where the law requires it (court order) or to protect our rights in case of fraud.

Data is hosted in Canada, a country recognized by the European Commission as providing an adequate level of protection for commercial data. Some providers (email, payment, application hosting) may process data in the EU or the US, under recognized transfer mechanisms (standard contractual clauses, adequacy frameworks).

If you accept measurement or advertising cookies, the corresponding data is sent to Google and Meta and may be processed in the United States, under the same recognized transfer mechanisms. Refusing those cookies — or simply not answering the banner — avoids that transfer entirely.

Account and activity data: as long as the account is active. On account deletion (from the My account page, or on request), your personal data is erased or anonymized immediately; your listings are removed from the site. Reviews tied to confirmed transactions may be kept in anonymized form (author "deleted"), to preserve the reliability of other users' track records.

Legal exceptions: records related to purchases are kept as long as accounting and tax obligations require; security logs are kept in anonymized form (no usable link to your identity once the account is deleted).

You have the rights of access, rectification, erasure, restriction, objection and portability (GDPR — applied to all our users, EU residents or not).

Deletion: directly from the My account page ("Delete account"), immediate effect. Other requests: Contact page, subject "Personal data" — answered within 30 days. You may also lodge a complaint with the supervisory authority of your country of residence (e.g. the CNIL in France).

Hashed passwords (bcrypt), encrypted connections (HTTPS), single-use time-limited reset links, least-privilege server-side keys, admin actions recorded in an audit log, two-factor authentication by email code for administrator sign-in.

No system is perfectly secure and we cannot guarantee absolute security. In the event of a data breach presenting a risk to your rights, we will notify the supervisory authority within 72 hours and, where the risk is high, inform you directly (GDPR arts. 33 and 34).

The platform is not intended for anyone under 18 and we do not knowingly collect their data.

Strictly necessary cookies: login, security and remembering your language. These are always active — the site cannot work without them, and they are never used to follow you elsewhere.

Measurement and advertising cookies (Google Analytics, Meta Pixel): switched off by default. They are placed only if you activate them via the banner shown on your first visit, and each purpose is chosen separately. Without your consent — or when these tools are not active — no such cookie is placed and no data is sent to these providers. You can change or withdraw your choice at any time via "Manage cookies" at the bottom of any page.

This policy may evolve; significant changes are notified and the dated version prevails.