HOSTAUPAIRS · TRUST & LEGAL
Privacy notice
How Hostaupairs handles accounts, member profiles, private conversations, au pair documents, locations and privacy requests.
Version 2026-10-11.1 · Effective 2026-10-11. These documents are available in the four website languages for the U.S. audience.
Scope
This notice covers Hostaupairs accounts and website use. Contact contact@hostaupairs.com. This notice distinguishes data visible to other members from information restricted to your account and authorized teams. Operator details are at the end of this notice and on the legal information page.
Information collected at registration
We collect your email, account credentials managed by our authentication provider, real first and last names, city and state, languages, program status, gender, date of birth, planned program end and your selected community goals. We record adult confirmation, safety commitments and privacy acknowledgment. Date of birth is used to check adult eligibility and derive a profile age range; your exact birth date is not shown on profile cards.
Information you add while using the service
A profile can contain a photo, bio, languages, interests, travel plans and hosting preferences. Trips, activities, participation and stay requests contain dates, places and messages. Private conversations, support tickets, reports, blocks and moderation records support communication and safety. Information you send in a message is disclosed to its recipients, who may retain their own copy. Avoid sending unnecessary sensitive information.
Au pair program documents
For program review, the application accepts a DS-2019 form or a designated-sponsor attestation. These files can contain sensitive information. Prefer an attestation with only the facts needed to assess the program; redact unnecessary identifiers and unrelated information while preserving details needed for review. The review consent is separate and can include contacting the sponsor shown. Review status, timestamps, consent and a decision record are retained separately from the file. Do not submit a passport, visa, Social Security number or banking details.
Locations and third-party requests
General city and state support discovery. Offering accommodation can involve a precise point and an exact address held separately from public profile cards. A generalized map marker must not be treated as anonymous. Public activity locations can be sent to the U.S. Census geocoder. Map tiles requested from OpenStreetMap can disclose IP address and the map area requested; custom tile settings may use another provider. Font requests can reach Google Fonts. Hosting and authentication also necessarily process connection data.
Purposes and recipients
Data provides and secures accounts, verifies adulthood, displays profiles to their intended audience, connects members, handles requests, reviews au pair program documents and manages support and abuse. Participants access their exchanges; authorized personnel review documents and support or moderation cases. Conversation supervision is linked to a report or block and limited to the relevant case. Supabase supplies authentication, database and storage; the main database is in the US us-east-1 region. Vercel hosts the site and provides optional measurement; Resend delivers emails. Maps, geocoding and fonts may call the providers described above. Processing can involve transfers outside the European Union. The published processing agreements of Supabase, Vercel and Resend describe their commitments and transfer mechanisms; contact us for information concerning your processing.
Visibility and photographs
Profiles are intended for signed-in members. Email, exact birth date, private declarations, documents and moderation notes do not appear on profile cards. Photos use public URL storage: anyone with the URL can view or copy them without an account. Do not upload photos if this exposure would be unacceptable.
Measurement, marketing and controls
Optional Vercel audience and performance measurement requires separate permission and covers only the public homepage. URL parameters and fragments are removed. Declining, Global Privacy Control or Do Not Track blocks it. Necessary authentication and hosting remain independent. Conversation email preferences do not authorize marketing. No targeted advertising system is integrated into the application.
Retention and deletion
Account and profile data is used during the member relationship and reviewed on an account closure or erasure request. Listings and exchanges remain while necessary to manage them and related requests. Removing a listing or hiding an inbox conversation does not immediately erase its history. Tickets, reports and decisions remain to handle the case and any necessary dispute or legal obligation; their necessity is reviewed when the case closes. Support handles erasure requests manually and explains any retained data and reasons. Program files are removed after a decision; pending files expire after 30 days and scheduled cleanup retries failures. Decision metadata is separate. Local drafts expire after one hour and are cleaned on their next read; the measurement choice lasts 180 days. Provider backups and logs follow their own cycles: deletion from the active database is not immediate erasure of every copy. Support responds to requests about these records.
Your requests and U.S. state rights
Use Privacy requests or contact@hostaupairs.com to request access or a portable copy, correction, deletion/account closure, restriction, opt-out or review of a denied request. You may ask without creating an account. A signed-in member can submit a private support ticket and follow it there. Legal entitlement, exceptions, verification and deadlines depend on residency and which laws apply to the business. California and other state rights are not assumed to apply to every visitor or business. An authorized agent may contact us and provide evidence of authority using a proportionate process; do not email an identity document by default. You will not lose service solely for making a privacy request.
European data protection and legal bases
Providing requested accounts, listings and exchanges relies on performing the service. Access security, abuse prevention and complaints pursue the legitimate interest of protecting members and the service, subject to individual rights. Optional measurement relies on separate consent withdrawable in the footer. Document review and any sponsor contact require the authorization displayed at upload. Request access, correction, erasure, restriction and, where applicable, objection or portability through the request form or contact@hostaupairs.com. GDPR requests normally receive a response within one month; any permitted extension is explained. You may complain to the CNIL. Automatic profile publication follows human program review; it is not an automated background check.
Children, security and notice changes
The service is for adults and does not seek accounts from children. Contact us if you believe a minor has provided information so access can be investigated and the data handled appropriately. Role-based access and row-level database policies are used, but no security measure guarantees absolute protection. Material changes should be dated and communicated; accepting terms does not waive privacy rights.
Responsible operator
Bastien Coulonnier, a private individual established in France, operates Hostaupairs. Contact contact@hostaupairs.com. For full publication information see Legal — publication information. Tiphaine Caillet is credited as co-creator; that credit alone does not designate her as a separate or joint data controller.
Measurement choice at signup
No measurement banner opens on arrival. At signup, an optional, unchecked box separate from the terms allows Vercel Analytics and Speed Insights in this browser. Without permission these tools are not loaded; necessary hosting logs remain independent. You can also grant or withdraw permission through Measurement preferences in the footer. The preference expires after 180 days without automatically opening a prompt. These tools do not use measurement cookies: Vercel describes an audience hash derived from incoming requests, discarded after 24 hours, and aggregate statistics. This does not mean no data is transmitted. Only the public homepage is measured; URL parameters and fragments are removed, with no account identifiers or conversation content. Accepting the terms does not authorize measurement.