Legal notice and privacy policy
This page sets out the legal information about the Local good spots website and explains, transparently, which personal data is processed, why, for how long, and how to exercise your rights.
Last updated:
1. Publisher
Local good spots is an independent project: a guide to coffee shops, bakeries, matcha and bubble tea spots in Paris. It is not affiliated with any of the listed establishments or with any chain. Sponsored listings are paid for by the establishments concerned and are labelled as such.
- Website
- Local good spots — localgoodspots.com
- Name
- Benoît HAVET
- Address
- 94 rue marius Aufan, Levallois-Perret, 92300, France
- Legal status / registration
- Entrepreneur individuel — SIREN 533 370 557
- Publication director
- Benoît HAVET
- Contact
- benoithavet@hblabstudio.fr
2. Hosting
The website (pages, application servers and technical logs) is hosted by:
- Name
- Vercel Inc.
- Address
- San Francisco, CA, États-Unis / United States
- Website
- vercel.com
3. Database, authentication and storage
Spot data (listings, addresses, photos), manager accounts and authentication are handled through:
- Name
- Supabase Inc.
- Address
- San Francisco, CA, États-Unis / United States
- Website
- supabase.com
Supabase provides the PostgreSQL database, the authentication service (sign-in with a Google account) and storage for photos uploaded by managers. Access to data is restricted: sensitive operations are performed server-side only, and administrative keys are never exposed to the browser.
4. Other service providers
- Stripe (Stripe Payments Europe Ltd. / Stripe, Inc.): payment for sponsorships and "Buy me a coffee" contributions. Card details are entered directly with Stripe and never pass through our servers.
- Google (Google Ireland Ltd. / Google LLC): sign-in with a Google account, Google Analytics 4 audience measurement (with your consent), Google AdSense advertising, and the Google Maps Places API, used server-side to verify spot addresses (no data about you is sent to it).
- OpenStreetMap: map background. When the map is displayed, your browser downloads map tiles from OpenStreetMap servers, which receive your IP address in the process. No cookie is set.
5. Personal data protection (GDPR)
The data controller is the website publisher (see section 1). Processing complies with Regulation (EU) 2016/679 (GDPR) and the French Data Protection Act of 6 January 1978. We only collect the data strictly necessary for the purposes below.
| Processing | Data | Purpose | Legal basis |
|---|---|---|---|
| Suggesting a spot (/add-spot) | Name and address of the establishment, contact email, optional photo | Moderate the suggestion and contact you about it | Pre-contractual steps taken at your request (Art. 6(1)(b)) |
| Photo submission (spot page) | Photo (location and device metadata removed on upload), optional first name or nickname shown as credit, optional email | Review and publish the photo, credit its author, contact you about it | Consent (art. 6.1.a) |
| Manager account | Email address and Google account identifier, profile information provided by Google | Authenticate you and give you access to your spot's management area | Performance of a contract (Art. 6(1)(b)) |
| Sponsorship and payments | Email, payment status and reference (card details stay with Stripe) | Activate the sponsorship, keep accounting records | Performance of a contract and legal obligations (Art. 6(1)(b) and (c)) |
| Internal statistics | Filters and searches used, pages and listings viewed, with no identifier, no IP address and no cookie | Improve the guide (most requested districts and spots) | Legitimate interest (Art. 6(1)(f)); data cannot be linked to a person |
| Google Analytics 4 audience measurement | Cookie identifiers, pages viewed, technical device information | Measure website traffic | Consent (Art. 6(1)(a)) |
| Google AdSense advertising | Advertising identifiers, technical device information | Fund the website by displaying ads | Consent (Art. 6(1)(a)) |
| Security and technical logs | IP address, date and time, requested page; hashed fingerprint of the IP address (anti-abuse) | Keep the website running and secure, limit abusive automated submissions | Legitimate interest (Art. 6(1)(f)) |
Photos sent by visitors: by sending a photo, you confirm that you took it yourself and grant the publisher, free of charge and for as long as it is displayed, the non-exclusive right to reproduce and display it on the site. Every photo is reviewed before publication. To have a photo removed (your own, or one that infringes your rights), write to benoithavet@hblabstudio.fr.
6. How email addresses are handled
- Your email address is only collected in two cases: creating a manager account, and contacting us (suggesting a spot, exchanges with us).
- It is never displayed publicly on the website.
- It is never sold, rented or transferred to third parties, and is never used for marketing without your prior consent.
- It is only used to reply to you, manage your account or your sponsorship, or inform you of a change concerning your spot.
7. Recipients and transfers outside the European Union
Your data is only accessible to the publisher and to the technical providers listed above, acting as processors, to the extent necessary for their tasks. Some of these providers (Vercel, Supabase, Stripe, Google) are based in the United States or may process data there. These transfers are governed by the European Commission's Standard Contractual Clauses and, where the provider has joined it, by the EU–US Data Privacy Framework.
8. Retention periods
| Data | Retention |
|---|---|
| Spot suggestion that was not accepted | Automatically deleted 12 months after submission |
| Submitted photo not published | Deleted when rejected, or automatically 12 months after submission |
| Published visitor photo | As long as it is shown on the spot page; removed on request |
| Contact email for a published spot | As long as the spot is listed, then 3 years after the last exchange |
| Manager account | As long as the account is active; deleted on request or after 3 years of inactivity |
| Accounting records for payments | 10 years (legal obligation, French Commercial Code, Art. L123-22) |
| Google Analytics cookies | 13 months maximum; audience data kept for up to 14 months in Google Analytics |
| Cookie consent choice | 6 months in your browser, after which you are asked again |
| Hashed IP address fingerprint (anti-abuse) | 24 hours |
| Internal statistics (no personal data) | 24 months |
9. Your rights
Under the GDPR, you have the following rights over your data:
- Right of access: obtain confirmation that data about you is being processed, and receive a copy of it.
- Right to rectification: have inaccurate or incomplete data corrected (managers can also edit their listing directly from their management area).
- Right to erasure: have your data deleted, subject to our legal retention obligations.
- Right to restriction of processing and right to object, in particular to processing based on legitimate interest.
- Right to data portability for the data you have provided to us.
- Right to withdraw your consent at any time (audience measurement and advertising cookies), without affecting the lawfulness of prior processing.
- Right to set out instructions regarding what happens to your data after your death.
To exercise these rights, email us at benoithavet@hblabstudio.fr. We reply within one month (extendable by two months for complex requests). Proof of identity may only be requested in case of reasonable doubt. If you believe your rights have not been respected, you can lodge a complaint with the French data protection authority, the CNIL (cnil.fr), or with your local supervisory authority.
11. Google Analytics 4
With your consent, we use Google Analytics 4, a service provided by Google Ireland Ltd., to learn the number of visits, the pages viewed and the type of device used. These statistics are used solely to improve the guide; they are not used to identify you or to show you advertising.
- Conditional loading: the Google Analytics script is only loaded after you click "Accept" in the consent banner.
- IP address: Google Analytics 4 does not log or store visitors' full IP addresses.
- No Google Analytics advertising features (Google Signals, remarketing) are enabled.
- Withdrawing consent: the "Manage cookies" link at the bottom of every page reopens the banner. Google Analytics cookies already set are then deleted automatically.
12. Advertising (Google AdSense)
To fund the website, ads are served by Google AdSense and clearly labelled "Advertisement". They are only loaded after your explicit consent (the banner's "Accept" button): with no choice or if you refuse, no advertising script is loaded and ad slots stay hidden. If you withdraw your consent, ads disappear immediately. Once you have consented, Google and its partners may use cookies or identifiers to serve ads, limit how often they are shown and measure their performance.
13. Intellectual property
The structure of the website, its editorial texts and its selection are the property of the publisher. The names, trademarks and logos of establishments belong to their respective owners. Photographs are the property of their authors and are published by the establishments themselves or with the permission of their rights holders. For any removal request, email benoithavet@hblabstudio.fr.
14. Liability
Information about establishments (addresses, prices, opening hours, products) is provided for guidance only and may change; please check it with the establishment. Links to third-party websites are provided for convenience: the publisher is not responsible for their content. To report incorrect information or unlawful content: benoithavet@hblabstudio.fr.
15. Governing law
This legal notice is governed by French law. In the event of a dispute, and after an attempt at amicable resolution, the French courts shall have jurisdiction. The French version of this page prevails.