Privacy policy

Version of 25 Oct 2026

We Made Room collects only what a stay needs. No advertising, no tracking, no data sold.

1. Who is responsible

The publisher of the site, named in the legal notice, is responsible for your data. Write to hello@wemaderoom.com for any question.

To write to We Made Room, use English or French: the team reads both.

2. What we collect

Host families: the names of the adults and the email of the adult whose identity is checked, the address, the phone, the household, the profile, the photos, whether the family hosts as a private individual or as a professional and a professional's registration number, the tax details required for the declaration to the tax administration, the result of the checks, and the family whose link brought it, if any.

The identity of one adult of the household is checked by Stripe Identity: the document and the selfie stay with Stripe, and we receive only the result and the name.

Students: the name, email, phone, date of birth, nationality, languages, purpose of the stay, diet, whether they smoke, and the arrival details.

Institutions: the name, the billing details, the emergency contact and the email of each user.

Visitors who ask to be told when a family opens in their city: the email, the city, the month of arrival and the language of the page.

For everyone: the messages written on the site about a request or a stay, the reports, the reviews, and, with each signature of a contract and each request or answer to make a stay longer, its date and the IP address it came from, as proof.

With each account, the campaign or the site that led to it when there is one (a link named "utm_source", or the site whose page linked here), to know which ones bring families and institutions.

Bank details are entered on Stripe's pages and never reach us.

3. Why

To arrange and pay for the stays (the contract with you); to check the families and handle reports (our legitimate interest in safe stays); to keep the accounts and declare the families' income (legal obligations). Nothing is used for advertising.

4. Who receives it

Before a stay is confirmed, a family sees only the student's first name, age, nationality, languages, purpose of the stay, diet and whether they smoke, the name of their institution when one books for them, and the messages they write. Once the first period is paid, the family and the student receive each other's contact details, and the institution sees both.

Our providers: OVH, which hosts the site in France; Stripe, for payments, the families' payouts and the identity check of the families; Resend, which sends the emails. Stripe and Resend may process data in the United States, under the safeguards of the GDPR (EU-US Data Privacy Framework or standard contractual clauses).

The map on a family's page comes from OpenStreetMap: the OpenStreetMap Foundation receives the family's address, without any name, to find its area, and the map is shown from its servers, which then see the visitor's IP address. The places around are looked up in OpenStreetMap through Geoapify, and in Wikidata (Wikimedia Foundation), which receive only the centre of the area. The page shows only the area, never the address.

The French tax administration receives every year the amounts paid to each family whose home is in the European Union (DAC7).

5. How long

A student's data is anonymised 12 months after their last stay, or their last request if they never stayed; their reviews remain, signed "Student", and what the family wrote about them in its review and its reports goes with it. A family's or an institution's data is erased once it has not used the service for 36 months; if one of its stays was booked, 10 years after its last stay, the time the accounting records must be kept. Erased data stays in the encrypted backups until they are deleted, after 35 days at most.

The records of payments are kept 10 years, as accounting law requires.

The email left to be told when a family opens in a city is deleted once that email is sent, after 90 days, or when the month of arrival is past, whichever comes first; or at once, with the button of the page that noted it.

6. Cookies

The site sets only the cookies it needs to work: the session of a signed-in account or of a student's personal link, and the language chosen. No advertising, and nothing to accept.

The site counts, day by day, its pages read, by kind of page and by the campaign or site that led there, and the searches that found nothing, by city. Nothing in these counts says who: no cookie, no IP address, no visitor followed from page to page.

The pages read by a visitor without an account are also counted with Umami, an open-source tool hosted on the same server as the site, not by a third party. It sets no cookie. A page read is recorded with the page and its title (without the parameters of its address), the site that led there, the browser, the system, the kind of device, the size of the screen, the language, and the place (country, region, city) found from the IP address. The IP address itself is never stored: it is only combined with the browser and a code renewed each month into a fingerprint that tells one visitor's pages apart within the month, and from which the address cannot be found again. The pages of an account and a student's personal link are never counted. Nothing is shared or sold.

After a request sent without an account, the browser keeps for 24 hours what the student typed about themselves, so their other requests do not ask it again. It stays in that browser, is cleared as soon as the student opens their personal link, and the request form has a button to clear it at once.

7. Your rights

You may access your data, have it corrected or deleted, limit its use, object to it, and receive it in a file. A family or an institution downloads its data from its space; a student from their personal link. For anything else, write to hello@wemaderoom.com.

To write to We Made Room, use English or French: the team reads both.

You may also complain to the CNIL (cnil.fr).

8. Security

The site is served over HTTPS only. Tax numbers are encrypted, verification documents are never public and are read only by the administrators, and every reading is logged.