Privacy policy

This privacy policy explains how Skiway collects, uses, retains, protects and shares users' personal data in connection with its various services.

It applies in particular:

to the showcase website accessible at skiway.app;
to the B2B dashboard accessible at dashboard.skiway.app;
to the Skiway mobile app;
to email communications, newsletters, payments, support services and associated features.

Last updated: June 15, 2026

1. Data controller

The controller of the personal data is:

Bloodbee
Sole trader (individual entrepreneur)
Email address: mathieu@skiway.app
Phone: +33 6 65 50 77 83
Website: https://bloodbee.space

The data controller determines the purposes and means of the personal data processing carried out as part of Skiway.

If Skiway later appoints a data protection officer, their contact details will be added to this policy.

2. Summary of the Skiway environments

Data processing varies depending on the environment used.

skiway.app showcase website: viewing of public pages, in particular the legal pages. The showcase website does not place analytics cookies or trackers as long as this configuration remains unchanged.
dashboard.skiway.app B2B dashboard: a professional area that may process account, organisation, product-usage and administration data.
Skiway mobile app: an app that may process account, location, usage, technical diagnostic, map and OAuth sign-in data.
Associated services: emails, newsletters, payment, billing, support, security and technical providers.

3. Personal data collected

Skiway only collects the data necessary for the purposes described in this policy. The categories of data may vary depending on the features used by the user.

Category	Examples	Purpose	Legal basis	Indicative retention
Identification and account data	Surname, first name, email address, user ID, profile picture, Google or Facebook ID when the user chooses OAuth sign-in.	Create and manage the account, authenticate the user, allow access to the service and secure its use.	Performance of the contract or pre-contractual measures; legitimate interest in the security of the service.	For the lifetime of the account, then deletion or limited archiving depending on legal obligations and evidential needs.
B2B dashboard data	Organisation, role, access rights, users attached to an organisation, professional billing information, dashboard usage history.	Provide the B2B service, manage access, administer client organisations, provide support and improve the product.	Performance of the contract; legitimate interest in improving, securing and administering the service.	For the duration of the contractual relationship, then limited archiving according to legal, accounting or evidential obligations.
Location data	GPS position, approximate position, routes, waypoints, map data, data related to the use of the map or group tracking.	Display the position on the map, enable certain navigation, route, group or ski-experience features.	Consent or mobile permission where required; performance of the service when the feature is requested by the user.	Limited to the time needed to provide the feature. Location histories should only be kept where necessary, explicitly provided for and documented.
Usage data and product analytics	Usage events, pages or screens viewed, clicks, features used, journeys within the dashboard or app, technical identifiers.	Understand actual product use, fix friction, prioritise development and improve the user experience.	Legitimate interest or consent depending on the configuration, the level of tracking, the environment concerned and the options offered.	Proportionate to product analysis. Old events should be deleted, aggregated or anonymised when no longer needed.
Technical and diagnostic data	Error logs, crashes, technical traces, app version, operating system, device type, execution context, IP address where necessary.	Detect, understand and fix errors, improve stability, ensure security and maintain the service.	Skiway's legitimate interest in maintaining a reliable, secure and functional service.	Short and appropriate to technical diagnosis, unless required for security or evidence.
Contact and support data	Email address, message content, support requests, complaints, reports, exchanges with the Skiway team.	Respond to requests, provide support, handle complaints, ensure customer follow-up.	Performance of the contract, pre-contractual measures or legitimate interest depending on the nature of the request.	For the time needed to handle the request, then limited archiving for evidence or support improvement.
Newsletter and communications data	Email address, subscription status, consent, unsubscription, delivery status, opens or clicks if tracking is enabled.	Send newsletters, product information, service communications or transactional emails.	Consent for marketing newsletters; performance of the contract or legitimate interest for service messages.	Until unsubscription or withdrawal of consent, then limited retention of proof of consent where necessary.
Payment and billing data	Billing identity, email address, billing address, Stripe customer ID, payment history, invoices, subscription status.	Process payments, manage subscriptions, produce invoices, prevent fraud, comply with accounting and tax obligations.	Performance of the contract; legal obligation; legitimate interest in fraud prevention.	According to applicable accounting, tax, legal and evidential obligations.

4. Data the user provides directly

The user may provide certain data directly when creating an account, signing in, using the B2B dashboard, contacting Skiway, subscribing to a newsletter, taking out an offer, making a payment or using certain features of the mobile app.

This data may include, in particular, the email address, surname, first name, account information, organisation information, preferences, billing information, support requests and the communications exchanged with Skiway.

5. Data collected automatically

When using the service, certain data may be collected automatically to ensure operation, security, technical diagnosis, usage measurement or product improvement.

This data may include, in particular, technical logs, IP addresses, technical identifiers, device information, app version, operating system, errors, crashes, usage events, screens viewed and interactions with certain features.

On the skiway.app showcase website, Skiway does not use analytics cookies or trackers as long as this configuration remains unchanged. Minimal technical logs may nonetheless be generated by the hosting or security infrastructure to ensure the operation of the service.

6. Location data

The Skiway mobile app may process location data when the user enables or uses features that require it, in particular displaying the position on the map, navigation, routes, group tracking or features related to the ski experience.

Access to location requires permission from the mobile operating system. The user can accept, refuse or withdraw this permission from their device settings.

Withdrawing the location permission may prevent certain features from working correctly, in particular custom maps, navigation, position display or group tracking.

Skiway must not collect or retain location histories longer than necessary. Where location data is retained, this retention must be justified by a clear and limited purpose.

Location data may reveal movement habits or frequently visited places. Skiway therefore processes it with particular care, even where it does not necessarily fall within a special category of data within the meaning of the GDPR.

7. OAuth sign-in with Google and Facebook

The Skiway mobile app may offer sign-in via Google OAuth or Facebook OAuth.

When the user chooses this sign-in method, they are redirected to the relevant provider in order to authenticate and authorise the sharing of certain information with Skiway.

Depending on the provider and the permissions approved, Skiway may receive an account identifier, an email address, a surname, a first name and a profile picture.

Skiway undertakes to limit the OAuth permissions requested to what is strictly necessary. The user can manage certain authorisations from their Google or Facebook account settings.

8. Product analytics with PostHog

Skiway uses PostHog in the B2B dashboard and in the mobile app to understand product use, identify friction, measure the features used and prioritise improvements.

The data collected via PostHog may include usage events, screens or pages viewed, clicks, journeys, technical properties, session information and identifiers linked to the account or organisation.

Skiway does not use PostHog to sell users' personal data or to display targeted advertising.

Skiway must configure PostHog according to a data-minimisation approach. More intrusive features, such as session recording, broad autocapture or the collection of detailed properties, must only be used where necessary, documented and consistent with users' rights and choices.

Where analytics processing is not strictly necessary to the operation of the service, Skiway puts in place a consent, opt-out or objection mechanism where the regulations require it.

9. Error tracking with Sentry

Skiway uses Sentry in the mobile app to detect, analyse and fix errors, crashes, slowdowns or technical malfunctions.

The data sent to Sentry may include technical information about the device, the app version, the operating system, error traces, the execution context and certain technical identifiers needed for diagnosis.

Skiway takes care to filter sensitive data, reduce the information sent to Sentry and avoid sending private content, payment data or information that is not useful for diagnosis.

10. Mapping with Mapbox

Skiway uses Mapbox to provide mapping features in the mobile app, in particular the display of maps, geographic data, navigation and location-related features.

Depending on the configuration of the Mapbox SDKs and services, certain technical data, map requests, map information or location data may be processed.

Skiway must configure Mapbox so as to limit the data collected to what is necessary, inform users about the applicable telemetry and offer the required settings or options where these are necessary.

11. Emails, newsletters and Resend

Skiway uses Resend to send transactional emails, account-related messages, service communications, confirmations, notifications and newsletters.

Marketing newsletters are sent on the basis of the user's consent or in cases where the regulations allow communication with an existing contact, subject to the possibility of objecting at any time.

Each newsletter includes a means of unsubscribing. The user may also request to unsubscribe by contacting Skiway.

If open or click tracking is enabled in the emails, Skiway states this in this policy and limits such tracking to what is genuinely necessary to measure the communications.

12. Payments, subscriptions and Stripe

Skiway uses Stripe to process payments, subscriptions, invoices, refunds, payment methods and fraud prevention measures.

Payment data is processed by Stripe. Skiway does not directly store full bank card numbers when payment is handled via Stripe.

Data related to payments and billing may be retained for the periods necessary to comply with accounting, tax, legal and evidential obligations.

13. Purposes of the processing

Skiway processes personal data for the following purposes:

provide the website, the B2B dashboard and the mobile app;
create, manage and secure user accounts;
enable sign-in via Google or Facebook;
provide the map, location, route and group features;
administer client organisations as part of the B2B dashboard;
provide support and respond to requests;
send transactional emails or service communications;
send newsletters where the user has consented or where the regulations allow it;
process payments, subscriptions, invoices and refunds;
detect, diagnose and fix technical errors;
measure product use and improve the user experience;
prevent fraud, abuse, intrusions and security breaches;
comply with legal, accounting and tax obligations;
establish, exercise or defend legal claims where necessary.

14. Legal bases for the processing

Depending on the purposes, Skiway may process personal data on the following legal bases:

Performance of the contract: provision of the account, the B2B dashboard, the mobile app, the requested features, payments and support.
Consent: newsletters, certain mobile permissions, certain location processing, certain trackers or analytics processing where required.
Legitimate interest: security, fraud prevention, product improvement, technical diagnosis, reasonable measurement of the use of the service and the defence of Skiway's rights.
Legal obligation: billing, accounting, taxation, responses to requests from the competent authorities and retention of certain supporting documents.

15. Data recipients

Personal data is accessible only to the people and providers who need it for the purposes described in this policy.

The recipients may include, in particular:

the Skiway team responsible for the product, support, security, administration or billing;
the hosting and infrastructure providers;
the providers of analytics, technical diagnosis, mapping, email, payment and authentication;
Skiway's professional advisers, where necessary;
administrative or judicial authorities, only where the law requires or allows it.

16. Processors and third-party services

Skiway uses several technical providers to deliver, secure, improve or monetise the service.

Provider	Role	Environment	Data concerned	Location / note
PostHog	Product analytics	B2B dashboard and mobile app	Usage events, technical properties, user or organisation identifiers depending on the configuration.	To be confirmed depending on the configuration used by Skiway, in particular PostHog Cloud EU or another region.
Sentry	Error tracking and technical diagnosis	Skiway mobile app	Error logs, crashes, technical traces, execution context, device information and app version.	To be confirmed depending on the region and retention settings configured in Sentry.
Mapbox	Mapping, maps and location-related features	Skiway mobile app	Map requests, technical data, map data, location data depending on the features enabled.	May involve processing outside the European Union depending on the Mapbox services used.
Resend	Sending emails and newsletters	Skiway email services	Email address, message content, delivery status, technical sending data, opens or clicks if enabled.	May involve processing outside the European Union depending on the provider's infrastructure.
Stripe	Payment, subscriptions, billing and fraud prevention	Skiway paid services	Billing data, customer identifiers, payment history, transaction data, anti-fraud data.	May involve processing outside the European Union depending on the Stripe services used.
Google OAuth	Authentication	Skiway mobile app	Google ID, email address, surname, first name, profile picture depending on the permissions approved by the user.	Processing according to the terms and settings of the user's Google account.
Facebook OAuth	Authentication	Skiway mobile app	Facebook ID, email address, surname, first name, profile picture depending on the permissions approved by the user.	Processing according to the terms and settings of the user's Facebook account.
Railway	Hosting provider	Skiway mobile app and API, redis, database	Personal information such as surname, first name, ski level, phone number, email address, hashed password.	Data storage, server hosting, CDN, DNS.

Skiway takes care to select providers that offer appropriate guarantees in terms of security, confidentiality and protection of personal data.

17. Transfers outside the European Union

Some providers used by Skiway may be located outside the European Union or the European Economic Area, or may process data from third countries.

Where transfers of personal data outside the European Union take place, Skiway ensures that they are governed by appropriate safeguards, such as an adequacy decision, standard contractual clauses, a data processing agreement or any other mechanism recognised by the applicable regulations.

Skiway must check the hosting region and processing settings of each provider, in particular PostHog, Sentry, Mapbox, Resend, Stripe, Google and Facebook.

18. Retention periods

Skiway retains personal data only for the time necessary for the purposes for which it was collected, subject to the applicable legal, accounting, tax, contractual or evidential obligations.

As an indication:

account data is retained for the lifetime of the account;
data related to the B2B dashboard is retained for the duration of the contractual relationship with the client organisation;
location data is only retained for the time necessary for the feature concerned, unless explicitly chosen otherwise or documented as needed;
analytics data is retained for a period proportionate to product improvement;
error logs and diagnostic data are retained for a short period appropriate to fixing problems;
newsletter data is retained until unsubscription or withdrawal of consent, then archived if necessary to keep proof of consent;
payment, billing and accounting data is retained for the periods imposed by the applicable legal obligations;
support data is retained for the time necessary to handle the request, then archived on a limited basis if needed.

19. Data security

Skiway implements reasonable technical and organisational measures to protect personal data against unauthorised access, loss, alteration, disclosure, destruction or misuse.

These measures may include, depending on the systems concerned, authentication, access-rights management, encryption in transit, technical monitoring, logging, backups, data minimisation and limiting access to authorised persons only.

However, no computer system can be guaranteed to be completely secure. In the event of an incident likely to affect personal data, Skiway takes the necessary measures in accordance with the applicable regulations.

20. Minors

Skiway is not specifically intended for children and does not seek to knowingly collect data concerning minors without the necessary safeguards.

Where the user is a minor, use of the service must take place under the conditions provided by the applicable law and, where necessary, with the authorisation of the holder of parental authority.

If Skiway learns that data concerning a minor has been collected in a non-compliant manner, Skiway may delete the data concerned or take any appropriate measure.

21. User rights

Under the conditions provided by the applicable regulations, the user has the following rights:

Right of access to personal data
Right to rectification of inaccurate or incomplete data
Right to erasure of data under the conditions provided by law
Right to restriction of processing
Right to object to processing where it is based on legitimate interest
Right to data portability where this right applies
Right to withdraw consent at any time for processing based on consent
Right to set guidelines on the fate of data after death
Right to lodge a complaint with the CNIL

To exercise their rights, the user may contact Skiway at the following address: mathieu@skiway.app.

Skiway may request additional information where this is necessary to confirm the identity of the requester or to handle the request.

The user may also lodge a complaint with the French data protection authority, the CNIL, if they consider that their rights are not being respected.

22. Withdrawal of consent and objection

Where processing is based on consent, the user may withdraw that consent at any time. Withdrawing consent does not affect the lawfulness of processing carried out before that withdrawal.

Where processing is based on Skiway's legitimate interest, the user may object to the processing for reasons relating to their particular situation, unless Skiway demonstrates compelling legitimate grounds or the processing is necessary for the establishment, exercise or defence of legal claims.

For newsletters, the user may unsubscribe at any time via the link provided in the emails or by contacting Skiway.

For mobile permissions, in particular location, the user may change their choices directly from their device settings.

23. Cookies, trackers and similar technologies

Information about cookies, trackers, SDKs, similar technologies and third-party services is detailed in the Cookie, tracker and similar technologies policy .

The skiway.app showcase website does not place analytics cookies or trackers as long as this configuration remains unchanged. The B2B dashboard and the mobile app, on the other hand, may use third-party SDKs or services, in particular PostHog, Sentry, Mapbox, Resend, Stripe, Google OAuth and Facebook OAuth.

24. Automated decisions

Skiway does not take decisions producing legal effects or significantly affecting the user on the sole basis of fully automated processing.

If Skiway later implements profiling, scoring, advanced recommendation or automated-decision features with a significant impact, this policy will be updated and users will be informed in accordance with the applicable regulations.

25. Security data and abuse prevention

Skiway may process certain technical data in order to detect abuse, attacks, intrusion attempts, fraud, abusive automated use, critical errors or behaviour harming the security of the service.

This processing is based on Skiway's legitimate interest in protecting its service, its users, its infrastructure and its data.

26. Changes to the policy

Skiway may amend this policy to reflect changes in the service, the mobile app, the B2B dashboard, the providers used, the processing carried out or legal obligations.

In the event of a substantial change, Skiway may inform users by any appropriate means, in particular by email, notification, display in the app or a visible update on the website.

27. Contact

For any question relating to this policy, the protection of personal data or the exercise of rights, the user may contact Skiway at the following address:

mathieu@skiway.app