What data Alpimate processes, why, for how long, and your rights. Cookies included.
Version 2.1·Published on 27 septembre 2026·
This translation is provided for convenience. The French version prevails.
The controller for the processing described here is the publisher of the website, identified in the legal notice: Maxime Geay, sole trader trading as Alpimate, Chambéry, France. Contact for any question about your data: team@alpimate.com.
No data protection officer has been appointed: Alpimate falls under none of the cases where an appointment is mandatory. No representative in Switzerland has been appointed to date, as the cumulative conditions of article 14 of the Swiss Federal Act on Data Protection are not met. This point will be reviewed if activity in Switzerland changes in scale.
Browsing data processed by the trackers described in section 9, only after your consent. Email address, first name, town and favourite sports when you fill in a sign-up or contact form.
| Processing | Legal basis |
|---|---|
| Accounts, bookings, messaging, payment, attribution log, acceptance history | Performance of the contract (GDPR art. 6.1.b) |
| Professionals' listing file | Legal obligation (art. 6.1.c): article L.212-1 of the French Sports Code, which reserves paid supervision to holders of a recognised diploma or title; and performance of the contract |
| Accounting records | Legal obligation (art. 6.1.c): French Commercial Code |
| Platform security, fraud prevention, technical logging | Legitimate interest (art. 6.1.f) |
| Safety-relevant information | Explicit consent (art. 9.2.a) |
| Audience measurement and advertising trackers, calendar synchronisation | Consent (art. 6.1.a), withdrawable at any time |
| Monthly round-up of new professionals, sent to professionals | Legitimate interest, with unsubscribe at any time |
| Situation | Period | Basis |
|---|---|---|
| Active client account | Lifetime of the account | Contract |
| Closed client account | Immediate anonymisation of identifying data; accounting records kept for 10 years | French Commercial Code |
| Bookings and payments | 10 years from the end of the financial year | French Commercial Code |
| Messaging | Lifetime of the account, then 5 years | Ordinary limitation period |
| Safety-relevant information | 7 days after the date of the activity | Data minimisation |
| Acceptance history and attribution log | Lifetime of the account, then 5 years | Proof of the contract, limitation period |
| Reviews | As long as the professional's page exists | Information of clients |
| Active professional | Duration of the relationship | Contract |
| Deregistered professional | Immediate anonymisation; compliance documents kept for 5 years, then deleted automatically | Handling of disputes |
| Professional liability insurance certificate | Renewed yearly, previous certificate archived for 5 years | Sports Code L.212-1 |
| Unfinished listing | 2 years at most | CNIL recommendation |
| Email address collected by a website form | 3 years after the last contact | CNIL recommendation |
| Google Calendar synchronisation (busy slots and tokens) | Until the calendar is disconnected | Consent |
| Tracker consent choice | 6 months | CNIL recommendation |
After these periods, data is deleted or irreversibly anonymised. If a dispute is pending, the data concerned may be set aside with restricted access until it is resolved.
Your data is intended for the Alpimate team, to the extent its work requires, for the professional concerned by a booking (section 6), and for the following processors, bound to Alpimate by a data processing agreement within the meaning of article 28 of the GDPR:
| Processor | Role | Location of the data |
|---|---|---|
| Supabase (Supabase Pte. Ltd) | Database, files, authentication | European Union (Stockholm); company established in Singapore |
| Stripe Payments Europe Limited | Payments; independent controller for payment data, under its own policy | Ireland, with transfers to the United States |
| Vercel Inc. | Website hosting | United States |
| Resend | Transactional emails | United States |
| Google (Google Ireland Limited, Google LLC) | Google Calendar API for calendar synchronisation; Google Analytics if you consent | Ireland and United States |
| Meta Platforms Ireland Limited | Meta pixel, if you consent | Ireland and United States |
No data is transferred or sold to third parties.
When you book, the professional concerned receives the data needed to carry out the activity: your identity, your contact details, the participants' data and, if you provided it, the safety-relevant information. The professional becomes the controller for their own purposes, within the limits set by their service terms and by the Professional terms: use limited to the booking, no copying, no retention beyond the activity for safety-relevant information. Your contact details are passed on only once the booking is formed. The professional's contact details are not passed on to you; exchanges go through messaging.
If you choose to connect your Google Calendar from your professional space, Alpimate accesses your calendar through the Google Calendar API (calendar.events permission), in read and write mode. This access serves only to read your busy slots so as to block your availability on Alpimate automatically and avoid double bookings, and to add your Alpimate bookings to your calendar. Alpimate keeps only the busy slots needed to display your availability and your access tokens, stored securely. It neither reads nor stores the detailed content of your other events. This data is never sold, shared with third parties, used for advertising or used to train models. You may disconnect your calendar at any time from your space, which revokes access and deletes the tokens. Alpimate's use and transfer of information received from Google APIs complies with the Google API Services User Data Policy, including the Limited Use requirements.
Data entrusted to Vercel, Resend, Google and Meta may be processed in the United States. These transfers rely on the European Commission's adequacy decision of 10 July 2023 on the EU-US Data Privacy Framework, for the entities certified under it (Google LLC, Meta Platforms Inc., Resend, Vercel Inc.), and, as an additional safeguard or for entities that are not certified (Supabase), on the European Commission's standard contractual clauses included in their data processing agreements. Data hosted by Supabase remains in the European Union.
For people in Switzerland, the Swiss Federal Act on Data Protection applies in addition to the GDPR. You have the same rights, and you may contact the Federal Data Protection and Information Commissioner.
No tracker subject to consent is set before you have made a choice. On your first visit, a window offers you to accept or refuse, with the same simplicity in both cases. Your choice is kept for six months, after which you are asked again. You may change it at any time through the "Manage cookies" link at the bottom of the page. Refusing prevents no feature of the website.
| Name | Issuer | Purpose | Duration | Regime |
|---|---|---|---|---|
| Session cookies (sb-…-auth-token) | Supabase, for Alpimate | Keep you signed in | Session, renewed at each sign-in | Strictly necessary, no consent |
| alp_ref | Alpimate | Remember the professional whose personal link you followed, for the attribution of your sign-up and first booking | 30 days | Necessary for the requested service, no consent |
| alp_parrain, alp_parrain_nom | Alpimate | Remember a professional's referral of another professional (code and first name of the referrer) | 30 days | Necessary for the requested service, no consent |
| alpimate_cookie_consent (local storage) | Alpimate | Remember your consent choice and its date | 6 months | No consent |
| Local preferences of the signed-in space (view, listing draft, display) | Alpimate | Convenience, data staying in your browser | Variable | No consent |
| _ga, _ga_* | Google Analytics (Google Ireland Limited) | Audience measurement: pages viewed, paths leading to a sign-up, without reading what you type | 13 months | Consent |
| _fbp, _fbc | Meta pixel (Meta Platforms Ireland Limited) | Measure whether our Instagram and Facebook adverts bring visits and sign-ups | 90 days, according to Meta | Consent |
If you refuse after having accepted, the audience measurement and advertising cookies already set are deleted.
Alpimate protects all personal data, and in particular professionals' documents, safety-relevant information and Google Calendar data, with the following measures: encryption of communications (TLS); encryption at rest at Supabase; row-level access control in the database (each user only accesses their own data; professionals' documents are accessible only to their owner and, for verification only, to the authorised team; safety-relevant information only to the professional of the booking and to the client); Google access tokens stored encrypted and accessible only to the server functions that perform synchronisation; files in private storage served through time-limited signed links; automated permanent deletion at the end of the retention periods; internal rule of not reading conversations between clients and professionals.
You have the rights of access, rectification, erasure, restriction, objection and portability of your data, the right to withdraw at any time a consent you have given (trackers, safety-relevant information, calendar synchronisation), and the right to give instructions on what happens to your data after your death. These rights are exercised:
Closing your account anonymises your identifying data immediately. Accounting records and, for professionals, compliance documents are kept for the periods in section 4, then deleted automatically. Closure is deferred while an upcoming booking or a refund due exists.
In case of a persistent disagreement, you may lodge a complaint with the French data protection authority (CNIL, cnil.fr) or, if you live in Switzerland, with the Federal Data Protection and Information Commissioner.