Privacy policy

1. Data controller

BeeHive (mobile app and beehiveevents.app website) is a service operated by Casabee, sole trader, 2 boulevard Loucheur, 40130 Capbreton, France — SIRET 911 440 014 00015. Contact: contact@casabee.fr.

2. Data we collect

BeeHive app users

• E-mail address (if you create an account, verified with a one-time code), preferences (categories, favourites), and your birthday if you choose to provide it;
• Location (with your permission) or a city you select manually, in order to display events near you and for usage statistics (areas where the app is used);
• Technical device identifier (to operate the service).
• A pseudonymised fingerprint of your IP address, specific to each day, when you view an event (app and website): it is used to count your views only once in the popular events ranking; the address itself is not stored.
• If you use the loyalty card: your progress in each programme (number of stamps, rewards earned) and the dated history of your visits to the venues where you present your card.
• If you turn on notifications: your phone’s notification token, its language and operating system (iOS or Android), linked to your account when you are signed in, and the technical history of sends (date, notification type, delivery result), without the text of the messages.
• If you turn on “Scratch games near me”: your phone’s area, rounded to about 1 km (your chosen city, otherwise your position), sent when the app is open, to let you know when a scratch game opens near you (within 5 to 30 km, depending on the game).

Professional and artist accounts

• Name (or stage name), e-mail, password (hashed), area of activity, published photos and images, biography, streaming links, artistic categories, website;
• If you connect your Instagram account (with your explicit consent, collected and logged): the account’s ID and username, and its public posts and stories, for the sole purpose of automatically detecting your events. Access is read-only, through Meta’s official API, and can be revoked at any time from your settings.

3. Purposes and legal bases

• Providing the service (accounts, event publication, artist pages) — performance of the contract;
• Automatic event detection from connected Instagram posts — consent;
• Local personalisation (nearby events, preferences) — consent / legitimate interest;
• Usage statistics and event ranking (areas of use, views counted once per visitor and per day) — legitimate interest;
• Notifications on your phone, if you turn them on in the app, and the area used for “Scratch games near me” if you choose that type — consent, which you can withdraw at any time in the app or in your phone settings;
• Security, abuse prevention, legal obligations — legitimate interest / legal obligation.

4. Processors and recipients

Your data is processed by service providers acting on our behalf, under contracts that comply with the GDPR:

• Meta Platforms (Instagram API): connection of professional/artist accounts;
• Artificial intelligence providers (OpenAI, Mistral AI): analysis of the collected posts in order to extract event information (dates, places, descriptions);
• DeepL: automatic translation of content (descriptions, biographies);
• UploadThing: image hosting;
• Stripe: payment of professional subscriptions (we never store your bank details);
• Technical providers for access to public Instagram content and for sending transactional e-mails;
• Expo (650 Industries): routing of notifications to Apple and Google, which deliver them to your phone;
• Hostinger: hosting of the website and servers.

Loyalty programme venues

When you have your loyalty card scanned at a venue, that venue — and the staff it has authorised to scan — can see your first name, your e-mail address and your progress in its own programme: number of stamps, rewards earned, and the dates of your visits there. This lets it run its programme and recognise you at the counter.

These venues are not processors: they decide themselves how to use this information for their own programme. A venue never has access to your activity at another business, nor to your other BeeHive data.

Some providers are located outside the European Union; such transfers are covered by the European Commission’s standard contractual clauses or an equivalent adequacy mechanism.

5. Retention periods

• Account: for as long as you use the service;
• Images and translations of past events: purged one week after the event date;
• Instagram access tokens: deleted and revoked as soon as the account is disconnected or deleted;
• Geographic positions sent by the app (usage statistics): 6 months;
• Notification token: deleted as soon as you turn notifications off (in the app, or in your phone settings the next time you open the app), and at the latest 180 days after you last opened the app; send history: 90 days at most;
• Phone area (“Scratch games near me”): replaced each time you open the app, deleted as soon as you turn that type off, and at the latest 30 days after its last update;
• Pseudonymised IP address fingerprint attached to event views: 31 days;
• Billing data: statutory accounting periods (10 years).

6. Your rights

Under the GDPR, you have the rights of access, rectification, erasure, restriction, objection and portability regarding your data.

• Deleting an artist/professional account: directly from your settings (“Delete my account”) — the profile is anonymised, the photos deleted and the Instagram connection revoked;
• Withdrawing Instagram consent: the “Disconnect” button in your settings, or from your Instagram settings (we then delete the related data);
• For any other right (access, portability, etc.): contact@casabee.fr — reply within one month.

You may also lodge a complaint with the French data protection authority, the CNIL (cnil.fr).

7. Cookies

The website only uses cookies that are strictly necessary for it to work (secure sessions for professional and artist accounts). No advertising or third-party tracking cookie is set.