Privacy policy

Vaylla is run by Aizz, a French micro-entreprise registered under SIREN 800 443 285, at 60 rue François Ier, 75008 Paris. We are the data controller for everything described here.

Write to hello@vaylla.co for anything on this page. A person reads it.

Your account. Your email address, the password you chose (stored hashed, never in a form we can read), and the display name and photograph you add if you add them.

Your properties and what we write for them. The listing link you paste and everything read from it: the title, the description, the amenities, the location, the photographs. Then the posts written from it, the captions, the hashtags, the Reel scripts, the rewrites, and whether you have marked one as posted.

Your subscription. Which plan you are on, how many credits you have and when they last refilled, and the customer and subscription identifiers Stripe gives us. We never see your card. It is typed on Stripe’s page and stored by Stripe. No card number, expiry or security code reaches a Vaylla server.

Whatever you write to us. If you email hello@vaylla.co we hold your address and what you sent, for as long as it takes to settle the thing you wrote about. That includes a request made under the rights below: we have to keep a record that you asked and that we answered.

Server logs. Our host records the usual: IP address, browser, the address requested and when. They are how a broken page gets found and how abuse gets stopped.

Audience measurement, but only if you agreed to it on this site. See the cookies clause below.

• Your account, your properties and everything written for them: to perform our contract with you. Without them there is no product.
• Payments, invoices and credits: to perform our contract, and for the invoices, a legal obligation under French accounting law.
• Server logs, and the rate limits and abuse checks built on them: our legitimate interest in keeping the service standing and not paying for someone else’s scraping.
• Audience measurement: your consent, which you give or refuse on this site and can withdraw at any time.

These are the companies that process data on our behalf, and all of them are under a contract that binds them to it. There is no one else. We do not sell anything to anybody, and we run no advertising, so there is no ad network in this list and no reason for one to appear later.

The words. What the listing says about the property: its title, type, size, sleeping arrangements, amenities, the description you wrote, the city and area, and the rating if it has one.

Not your name, not your email, not your account, not your address, and not your photographs. The model is told how many pictures exist so it can plan the right number of slides; the images themselves never leave for it, and the slides are drawn on our own servers.

DeepSeek is a Chinese company, and this is a transfer outside the European Union. We would rather name that than leave it in a table for you to notice. It is covered by the European Commission’s standard contractual clauses, and what travels is the listing text described above, which is already public on the platform you listed with. Our generation runs behind one interface with a provider setting, so if that trade stops being one we are willing to make, it is a configuration change and not a rewrite.

Stripe, Vercel, Resend, Google and DeepSeek process data outside the EU. Each is covered by the European Commission’s standard contractual clauses, and the American ones additionally by the EU-US Data Privacy Framework where they are certified under it.

• Your account, properties and posts: for as long as your account exists. A subscription that lapses closes the door to the app; it does not empty the room. Ask us to delete the account and everything in it goes within 30 days.
• Invoices and the accounting records behind them: ten years. That one is not ours to shorten; French commercial law sets it.
• Server logs: as long as our host keeps them, which is a matter of weeks.
• Audience measurement: 14 months, and the consent cookie itself six.

This site sets no cookie you did not ask for. There is no session here to keep: the product lives on its own address and the marketing pages cannot read a login even if one exists.

If you accepted audience measurement, Google Analytics sets its own cookies to tell a returning visitor from a new one. We turn off every advertising signal it offers, permanently and in code: no ad storage, no ad personalisation, no ad user data. Nothing is loaded before you say yes, and refusing loads nothing at all.

Whichever you choose, we remember it for six months in one first-party cookie so you are not asked again on the next page. Use Cookies at the foot of any page to change your mind.

Inside the product at app.vaylla.co there are session cookies, and those are the ones that keep you signed in. They are strictly necessary, there is nothing to consent to, and there is no way to offer the service without them.

• We do not sell your data, to anyone, for anything.
• We do not use your listings or the posts written for them to train any model.
• We do not show you advertising and we run no advertising trackers.
• We do not read your content except when you ask us to look at something, or when we have to in order to fix a fault you have reported.

Under the GDPR you may ask for a copy of what we hold, correct it, have it deleted, take it elsewhere in a machine-readable form, have its use restricted, or object to processing we base on legitimate interest. Where we rely on your consent you may withdraw it at any time, and withdrawing it does not undo what was lawful before.

Write to hello@vaylla.co. We answer within a month. If you are not satisfied you may complain to the CNIL, 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, or at cnil.fr.

Vaylla is sold to people running a rental business and is not for anyone under 18. We do not knowingly hold data about a child. Tell us if we have and it goes.

When this page changes in substance we change the date at the top and email anyone with an account before it takes effect. Small corrections happen without an email.

See also the terms of service and the questions hosts ask.