Privacy policy

Last updated: 22 October 2026

This privacy policy explains how MIGLIACCIO LAUMOND Mélanie, trading under the name Solivida and operating the Gustosia service, collects, uses, stores and protects personal data in connection with the gustosia.com website and the Gustosia service.

Gustosia is intended exclusively for professionals.

This policy is drawn up in accordance with Regulation (EU) 2016/679 of 27 April 2016 on the protection of personal data (GDPR) and the applicable French regulations.

1. Data controller

The controller of the personal data processing carried out for Gustosia’s own purposes is:

MIGLIACCIO LAUMOND Mélanie
Status: micro-entreprise (French micro-business status)
Trade name: Solivida
SIREN: 992 732 065
SIRET: 992 732 065 00014
Address: 19 rue d’Emmerez de Charmoy, 97490 Sainte-Clotilde, La Réunion
Email: contact@gustosia.com

The controller determines the purposes and means of the personal data processing carried out for Gustosia’s own purposes.

2. Personal data that may be collected

The categories of personal data processed depend on how you use the website and the Gustosia service.

2.1. When you contact us

When you contact Gustosia using the website form, by email or by any other means offered, the following data may in particular be collected:

your name;
the name of your company or establishment;
the type of establishment or business;
your email address;
the content of your message;
any other information you choose to provide voluntarily in your request.

This data is used to respond to your request and, where you wish to subscribe to the service, to prepare the business relationship.

Messages sent via the website form are transmitted by means of the third-party service Web3Forms, which forwards the information entered by email to Gustosia’s contact address.

2.2. When you book an appointment

When you book an appointment using the tool offered on the website, certain data needed to organise and manage the appointment may be processed by the provider concerned.

The provider used is Calendly. On the Contact page, the booking calendar is designed to load only after you click.

Use of this third-party service may involve the processing of data in accordance with the Calendly privacy policy. The data concerned may in particular include the information you enter when booking and the information needed to manage the appointment.

2.3. When using Gustosia

When an establishment becomes a customer, Gustosia processes the data needed to create, configure and operate its account and its service. This data may in particular include:

the name of the company or establishment;
the email address;
the address of the establishment;
information relating to the business;
information relating to menus and menu items;
prices;
photographs of the establishment and of the products;
the logo and visual identity elements;
the content needed to create the digital menu or digital guest guide;
the login details and information needed to access the Gustosia account;
the information needed to manage the subscription, payments and invoicing.

Certain information may be entered directly by the customer from their administration area.

3. Purposes of processing

Personal data is processed in particular for the following purposes:

respond to contact requests;
organise and manage appointments;
prepare subscription to the service;
create and administer customer accounts;
provide and configure the Gustosia service;
create and publish digital menus and digital guest guides;
allow customers to manage their content from their administration area;
provide assistance and support;
manage subscriptions, payments and invoices;
prevent and manage unpaid amounts;
ensure the security and proper operation of the service;
produce statistics on the operation of the service;
comply with the applicable legal and regulatory obligations;
where necessary, allow the establishment, exercise or defence of legal claims.

4. Legal bases for processing

Depending on the purposes concerned, the processing of personal data may be based on one of the following legal bases:

The performance of a contract or of pre-contractual measures, in particular to prepare a subscription, create a customer account and provide the Gustosia service;
Compliance with a legal obligation, in particular for accounting and invoicing obligations;
Gustosia’s legitimate interest, in particular to ensure the security of the service, prevent abuse, handle complaints and defend its rights, subject to the rights and interests of the data subjects;
The consent of the data subject, where required by the applicable regulations.

Gustosia does not base processing on consent where consent is not necessary. Where consent is the legal basis for processing, it may be withdrawn under the conditions laid down by the applicable regulations.

5. Data hosting and storage

The data needed to operate the Gustosia application is stored, in particular, on Supabase infrastructure.

Supabase provides database and infrastructure services enabling, in particular, the storage, management and deletion of the data used by applications. Supabase makes available a data processing agreement intended to govern the processing carried out as part of its services.

The public gustosia.com website is hosted by Hostinger International Limited.

Data may also be processed by the technical providers mentioned in this policy, within the limits of their respective tasks.

6. Payments

Payments for Gustosia subscriptions are made via Stripe.

Gustosia does not directly store the full bank card details provided during payment.

Payment transactions are processed by Stripe in accordance with its own terms and privacy policy. Depending on the services used, Stripe may in particular process data relating to payments, invoicing, Stripe accounts and fraud prevention.

7. Sending emails

Gustosia may use a specialised technical provider to send certain emails needed for the operation of the service, in particular messages enabling the recovery or resetting of passwords for customer establishments’ accounts.

The provider selected for this purpose is Brevo, whose API is used by the Gustosia application to send email address verification and password reset emails.

The data needed to deliver these messages may be passed to the provider concerned to the extent necessary to send the emails.

8. Data relating to visitors to menus and guides

Visitors to Gustosia digital menus and digital guest guides can view the content made available by customer establishments.

As at the date this policy was last updated, the menus and guides do not include any form allowing visitors to send personal data directly to Gustosia or to the establishment through them.

Certain features may allow a direct action to be taken, for example clicking a button to call a hotel’s reception.

Gustosia’s purpose is not to identify visitors to menus and guides individually.

9. Usage statistics

The Gustosia service may produce statistics on the use of menus and guides to help customer establishments better understand how their content is viewed.

These statistics may relate in particular to:

the most viewed categories;
the number of views of certain categories or certain content;
searches that returned no results;
viewing times;
the breakdown of languages used;
other functional statistics needed for the operation of the service.

As at the date this policy was last updated, Gustosia does not use these statistics to build individual visitor profiles and does not collect their IP address for this purpose.

These statistics are separate from the security processing described in Article 13, which concerns attempts to log in and to reset the password of customer accounts.

The gustosia.com website also measures views of its pages for statistical purposes in order to monitor its traffic. The data from this visit counter is recorded in Supabase.

10. Cookies and trackers

The Gustosia website may use cookies or similar technologies that are strictly necessary for its operation.

The use of third-party services may also involve the processing of data under the conditions described in this policy and in the privacy policies of those providers.

If cookies or trackers that are not necessary for the operation of the website are introduced, the information provided to visitors and, where required, the arrangements for obtaining their consent will be adapted in accordance with the applicable regulations.

11. Recipients of the data

Personal data may be accessible, to the extent necessary for their tasks, to the following recipients:

MIGLIACCIO LAUMOND Mélanie and any persons authorised to act on behalf of Gustosia;
the technical providers needed for the operation of the service;
Hostinger, for hosting the website;
Supabase, for database and storage services;
Stripe, for payments and related management;
Calendly, for booking appointments when this service is used;
Web3Forms, for forwarding messages sent using the contact form;
Brevo, for sending email address verification and password reset emails;
administrative or judicial authorities, where required by law.

Gustosia does not sell its users’ personal data.

12. Data retention periods

Gustosia retains personal data for a period appropriate to the purpose for which it is processed. When its retention is no longer necessary, it is deleted or, where appropriate, anonymised, subject to the applicable legal obligations and to what is needed to defend Gustosia’s rights.

12.1. Prospect data

The personal data of persons who have contacted Gustosia without subscribing to the service is retained for a maximum period of three years from its collection or from the last contact initiated by the prospect, depending on the starting point applicable to the processing concerned.

This data may be deleted or anonymised before the end of this period when it is no longer needed to handle the request or to manage the relationship with the prospect.

At the end of the applicable retention period, the data is deleted or anonymised, unless its retention remains necessary to comply with a legal obligation or to allow the establishment, exercise or defence of legal claims.

12.2. Customers’ operational data

The data needed for the operation of the account and the service, in particular set menus, menus, photographs, logos, visual identity elements and the content of digital guest guides, is retained for the duration of the subscription.

After the subscription has effectively ended, this operational data is deleted within a maximum period of thirty days, except for data that must be retained to comply with a legal obligation or to allow the establishment, exercise or defence of legal claims.

12.3. Contractual, accounting and invoicing data

Accounting documents and their supporting documents, in particular invoices, are retained for the applicable legal period, in particular ten years in accordance with Article L. 123-22 of the French Code de commerce (Commercial Code).

Data that must be retained after the end of the contractual relationship is archived appropriately, and access to it is limited to the needs justifying its retention.

Other contractual data, in particular data needed to prove subscription or termination, is retained for the period necessary to comply with the applicable legal obligations and to defend Gustosia’s rights.

12.4. Payment data

Payment information may be retained to the extent necessary for managing subscriptions, invoicing, accounting and compliance with the applicable legal obligations.

Gustosia does not directly retain the full bank card details provided during payment.

13. Data security

Gustosia implements reasonable and appropriate technical and organisational measures to protect personal data against loss, unauthorised access, alteration and unauthorised disclosure.

Access to the service is protected, in particular, by authentication mechanisms.

To protect accounts against abusive access attempts, the Gustosia application limits the number of failed login attempts and password reset requests. To do so, it records a hash (SHA-256) calculated from the identifier entered and the IP address from which the request originates, together with the number of attempts and their timestamps. Under this mechanism, neither the IP address nor the identifier is recorded in plain text.

This hash constitutes pseudonymised data: it does not guarantee anonymity and remains personal data within the meaning of the GDPR. This processing is based on Gustosia’s legitimate interest in ensuring the security of the service and limiting abuse.

This data is only useful for a short period. Once it has become obsolete, it is deleted automatically during subsequent recording operations.

Customers are responsible for keeping their login details confidential. They must choose a sufficiently strong password and must not disclose it to unauthorised third parties.

14. Rights of data subjects

In accordance with the applicable regulations and under the conditions laid down therein, data subjects have in particular the following rights:

a right of access to their personal data;
a right to rectification of inaccurate or incomplete data;
a right to erasure of their data, where the legal conditions are met;
a right to restriction of processing;
a right to object to certain processing, where this right applies;
a right to data portability where the conditions laid down by the GDPR are met;
the right to withdraw their consent where processing is based on consent, without affecting the lawfulness of processing carried out before its withdrawal.

To exercise their rights or ask a question about the processing of their personal data, data subjects may contact Gustosia at the following address:

contact@gustosia.com

The request may be accompanied by the information needed to reasonably verify the identity of the requester where such verification is necessary to prevent an unauthorised person from accessing the data.

Requests are handled within the time limits laid down by the applicable regulations.

15. Complaints to the CNIL

If a person considers that the processing of their personal data does not comply with the applicable regulations, they may contact Gustosia to try to resolve the matter.

They may also lodge a complaint with the Commission nationale de l’informatique et des libertés (CNIL), the French data protection authority.

Official CNIL website: https://www.cnil.fr/

16. Processing carried out on behalf of customer establishments

As part of certain features, Gustosia may process personal data on behalf of its customer establishments.

Where Gustosia acts as a processor within the meaning of the GDPR, it processes the data in accordance with the customer’s instructions and the applicable contractual provisions.

Customer establishments remain responsible for the processing they themselves determine, in particular for the content and personal data they choose to publish or process by means of their service, within the limits laid down by the applicable regulations.

As at the date this policy was last updated, the Gustosia service is not designed to allow visitors to menus or guides to send personal data directly to establishments through Gustosia.

This situation may change if new features are added. The data protection documentation will then be adapted accordingly.

17. Changes to the privacy policy

This privacy policy may be amended to take account of changes to the Gustosia service, the technologies used or the applicable regulations.

The version published on the website is the version in force.

Users are invited to consult this page to find out about any changes.

For any question about this policy, you can contact Gustosia at the following address: contact@gustosia.com.

Last updated: 22 October 2026

Gustosia
Your menu, your guide, your world