GROUND STARS

Privacy policy

Last updated October 23, 2026

This policy explains which personal data GroundStars processes, why, for how long, who receives it and how to exercise your rights. It applies to the groundstars.ai website, to the GroundStars application used by tour and activity teams, and to the messages exchanged with travelers (chat, email and WhatsApp).

Data controller

Qualium

For any question about this policy or your personal data: hello@groundstars.ai

Data we process

Travelers

When you book a tour or activity operated with GroundStars, directly or through a reseller (for example GetYourGuide, Viator, Headout or Klook), the booking is passed to us through the operator's booking system. We receive:

  • your first and last name, email address, phone number and country;
  • your booking: product, date, time, number of participants, booking reference and reseller;
  • the messages you exchange with the team (chat, email, WhatsApp), their attachments and their delivery status;
  • your tickets, when the tour requires them.

Team members and guides

  • name, email address, role and profile photo;
  • password (stored hashed, never in clear text);
  • activity in the application (sign-ins, actions performed), kept in an audit log.

Website visitors

The site sets no advertising or analytics cookies. Our host keeps technical logs (IP address, date, page requested, browser) to run and secure the service.

Purposes and legal bases

  • Running your tour (performance of the booking contract): planning, guide assignment, check-in, meeting-point information, ticket delivery.
  • Answering and informing you (performance of the contract and legitimate interest): chat, email and WhatsApp messages about your booking.
  • Translating and summarizing messages (legitimate interest): so the team can answer you in your language.
  • Securing and improving the service (legitimate interest): technical logs, error monitoring, audit log.
  • Meeting legal obligations: accounting and responses to authorities.

We do not sell your data and do not use it for advertising.

WhatsApp

If you contact us on WhatsApp, or if the team sends you a WhatsApp message about your booking, your phone number and the messages are processed by Meta Platforms (WhatsApp Business Platform). We only send messages related to your booking. Reply STOP at any time to stop receiving them.

Artificial intelligence

To translate messages, summarize a conversation or correct a reply, the text concerned is sent to OpenAI. It is not used to train OpenAI's models, under OpenAI's API terms.

Recipients and processors

Your data is accessible to the operator's team, each member according to their role. We rely on the following processors:

  • Clever Cloud (France): hosting of the application, database and files;
  • Rezdy: booking system of the operator, source of bookings;
  • Meta Platforms: WhatsApp messages;
  • Resend: sending of emails;
  • OpenAI: translation, summaries and text correction;
  • Sentry: error monitoring.

Transfers outside the European Union

Some processors (Meta, Resend, OpenAI, Sentry, Rezdy) may process data outside the European Union, in particular in the United States or Australia. These transfers are covered by an adequacy decision (such as the EU-US Data Privacy Framework) or by the European Commission's standard contractual clauses.

Retention

  • Bookings, messages and tickets: for as long as needed to operate the tour and handle follow-up questions, then deleted or anonymized, subject to legal retention obligations.
  • Team accounts: for as long as the account is active.
  • Technical logs: a few weeks.

Security

Data is encrypted in transit (HTTPS). Access to the application requires an account and is limited by role. Connection secrets to third-party services are stored encrypted.

Your rights

Under the GDPR, you have the right to access, rectify and erase your data, to restrict or object to its processing, and to data portability. Write to hello@groundstars.ai; we answer within one month.

You may also lodge a complaint with the French data protection authority, the CNIL (www.cnil.fr), or with the authority of your country of residence.

Changes

We may update this policy. The date at the top of the page shows the latest version.