1. Who is responsible
- For the site, professionals’ accounts and the contact forms, the data controller is BORA BORA FUN ACTIVITES SARL (Smart Lagoon Agency), publisher of FenuaResa (see the legal notice, in French).
- For a booking, your data is intended for the professional you book with: they are responsible for their customer file. FenuaResa acts on their behalf, as a processor, to pass on the request, send the e-mails and host that file. Its commitments to the professional are set out in the terms of use (in French).
2. The data processed
If you browse the directory
No account and no advertising cookie. As with any website, your IP address and technical information about your browser pass through our hosting providers to display the pages and protect the site.
If you allow geolocation, your position is used to choose the nearest island or to sort listings by distance. It is rounded to about a hundred metres; for sorting by distance, it is included in the page address sent to the server. It is not stored in our database.
If you book
First name, last name and e-mail address; your phone number and your message to the professional if you provide them; the date, the time slot, the number of participants, the options chosen and the language of the booking.
The professional sees your request as soon as you send it, even if you do not then validate it from the e-mail you receive: this lets them contact you to finalise it.
The e-mails sent to you automatically:
- the e-mail that lets you validate your request;
- if you have not validated it after one hour, a single reminder, sent only if the link remains valid for at least 30 more minutes;
- the confirmation e-mail, once the booking is validated;
- a reminder the day before the service, sent from 8 a.m. (Tahiti time), only if the booking was made at least 12 hours earlier;
- an e-mail if the professional changes or cancels your booking.
If you are a professional
E-mail address and password (stored in an irreversibly encrypted form by our authentication provider), name and phone number; the version of the terms of use you accepted and its date; information about your business (name, island, trade, description, photos, prices, public contact details); your availability, your bookings, your customer file and your notes; your payment settings (bank details or payment link, sensitive credentials being encrypted); a technical log of sensitive actions.
If you write to us
Name and e-mail address and, depending on the form, your business, your phone number, your island, your trade and your message.
3. Why, and on what basis
| Purpose | Basis |
|---|---|
| Providing the pro area and publishing your listing | The contract (terms of use) |
| Keeping proof of your acceptance of the terms of use (version and date) | Our legitimate interest in being able to prove the contract |
| Passing on a booking, sending the validation, reminder, confirmation and day-before e-mails | The booking you request, processed on behalf of the professional |
| Answering a message or a demo request | Your request (pre-contractual steps) |
| Securing the site, preventing fraud and spam, backing up the database to restore it after an incident | Our legitimate interest |
| Complying with our legal obligations | The law |
No advertising, no sale of data, no profiling.
4. Who receives the data
The professional you book with receives the data of your booking. The FenuaResa team only accesses it when needed (support, security). Our technical providers:
| Provider | Role | Where |
|---|---|---|
| Cloudflare, Inc. | Hosts the site, delivers the pages and protects them from attacks. Every request goes through Cloudflare, which therefore sees your IP address. Also forwards e-mails sent to contact@fenuaresa.com to the team’s mailbox.Concerns: all visitors | United States, worldwide network of data centres |
| Supabase Pte. Ltd. | Database, accounts and photos: listings, activities, bookings, customer files.Concerns: professionals and visitors who book | Amazon Web Services servers in Tokyo (Japan) |
| Cloudflare, Inc. (R2) | Storage of the database backups, encrypted before they are sent and deleted after 30 days.Concerns: professionals and visitors who book | Cloudflare data centres in the Oceania region |
| GitHub, Inc. | Database backups: every night, an automated job hosted by GitHub copies the database, encrypts the copy and sends it to the backup storage. Older encrypted copies are also kept in a private GitHub repository until their deletion, planned for the end of October 2026.Concerns: professionals and visitors who book | United States |
| Resend | Sending e-mails: booking validation, reminders and confirmations, notices to the professional, sign-in e-mails for the pro area, messages from the contact forms.Concerns: professionals, visitors who book or write to us | United States |
| Google (Google Workspace) | The team’s mailbox: e-mails sent to contact@fenuaresa.com, messages from the contact forms, notices of a professional’s sign-up and account deletion requests arrive in a Google Workspace mailbox.Concerns: professionals, visitors who write to us | United States, worldwide network of data centres |
| Esri | Satellite base map. When a map is displayed, your browser loads its images from Esri’s servers, which receive your IP address.Concerns: visitors who display a map | United States |
| Fondation OpenStreetMap | Address search and base map when a professional places their meeting points in their pro area.Concerns: professionals | United Kingdom |
| Google (Google Fonts) | Fonts of the booking module installed on a professional’s website, only if they chose a custom font.Concerns: visitors to those websites | United States |
| Anthropic, PBC | Assisted writing of descriptions, only when a professional uses the assistant in their pro area: only the text they type is sent. The assistant is not available today.Concerns: professionals | United States |
5. Data outside French Polynesia
Our providers host or process data outside French Polynesia: in Japan (database), in the United States (including the older encrypted backup copies kept by GitHub), in the United Kingdom, in Cloudflare data centres in the Oceania region (encrypted backups) and in Cloudflare and Google data centres around the world. These transfers are governed by the data protection commitments each provider applies to its customers. Japan also benefits from an adequacy decision of the European Commission.
6. How long
- Professional account: as long as it is open, together with the proof of your acceptance of the terms of use. After a deletion request, the listing and the booking pages are removed immediately and the data is erased within 30 days, except what the law requires us to keep (accounting records).
- Bookings and customer files: in the professional’s account, who decides how long they are kept; erased with their account. The professional can delete a customer at any time: their contact details, notes and messages are erased; the dates and amounts of their bookings remain in the professional’s accounts, without name or contact details.
- Booking requests never validated by e-mail: visible to the professional concerned, who may contact you to finalise the booking, then erased 7 days after the link expires.
- E-mail sending logs: 90 days.
- Log of sensitive actions (security): 12 months.
- Messages from the contact forms: 3 years after the last exchange.
- Backups: the database is copied every night; the copies are encrypted and kept for 30 days, then deleted. Older encrypted copies, made since June 2026, remain in a private GitHub repository until their deletion, planned for the end of October 2026. These copies are only used to restore the service after an incident. Erased data disappears from the backups when the last copy containing it is deleted.
7. Your rights
You can access your data, have it corrected or erased, object to its processing or have it restricted, receive it in a readable format, and decide what happens to it after your death.
- For a booking, contact the professional first: they are responsible for their customer file and can, from their pro area, correct your contact details or delete your customer record. You can also write to us: we pass your request on to the professional and help them answer it.
- Professionals: your information can be edited in your pro area, and your account can be deleted from Paramètres › Compte (Settings › Account).
- In all cases, write to contact@fenuaresa.com. We reply within one month.
This processing is governed by French Act No. 78-17 of 6 January 1978 on information technology, data files and civil liberties (“Informatique et Libertés”), which applies in French Polynesia and makes the rules of the European General Data Protection Regulation (GDPR) applicable there. You can lodge a complaint with the CNIL, the French data protection authority (cnil.fr).
9. Security
Exchanges are encrypted (HTTPS). Each professional account only sees its own data, a control enforced by the database itself. Sensitive payment credentials are encrypted (AES-256-GCM), passwords are never stored in plain text, backups are encrypted before they are stored, and sensitive actions are logged.
10. Changes
This policy changes with the service (new provider, new feature). The date at the top of the page shows the version in force; professionals are notified by e-mail of any significant change.
11. Contact
For any question about your data: contact@fenuaresa.com, or the contact form (in French).