WaySplat is built for privacy: no account to create, no app to install, no camera, no targeted advertising. This policy explains, in plain words, which data is processed, by whom, why and for how long, on:
- the WaySplat website (https://waysplat.com);
- WaySplat visitor pages (https://go.waysplat.com), opened from a QR code, an NFC tag or a link in an equipped venue (airport, mall, hospital, stadium, store…);
- WaySplat Immo property tours (https://immo.waysplat.com);
- the Bluetooth beacons installed in some venues (see also Bluetooth, location and sensors).
1. Who is responsible for your data?
Two parties are involved, depending on what you use.
| Situation | Controller | WaySplat’s role |
|---|---|---|
| You write to us from the website | WaySplat | Controller |
| You use a venue’s visitor page (airport, mall…) | The venue operator, a WaySplat customer, for the statistics provided to it | Processor on behalf of the operator (GDPR article 28); controller for the security and technical operation of the service |
| You view a property tour | The agency, developer or private seller publishing the property | Processor |
| You are a business customer or prospect | WaySplat | Controller |
WaySplat is published by Marvin De Souza, sole proprietor (French “entrepreneur individuel”, micro-enterprise scheme), 1 rue de l’Exemple, 75001 Paris, France. Contact for any question about your data: [email protected].
For processing carried out on behalf of a venue or an agency, you can contact that operator or write to us directly: we will forward your request and help you exercise your rights.
2. What we don’t do
- We ask for no account, no name, no phone number to use a visitor page or a property tour.
- We use neither the camera nor the microphone of your phone.
- Your GPS position, orientation and the Bluetooth signals picked up by your phone are used on your device to guide you: they are not sent to us.
- We do no targeted advertising, no profiling, no data resale. No advertising cookies, no Google, Meta or other third-party analytics.
- We process no health data: in a hospital, the page doesn’t know who you are or why you came.
3. Website: contact form
Data: name, work email, company (optional), industry (optional), message, website language and page, date.
Purposes: answering your request, presenting WaySplat, preparing a quote, following up the business relationship.
Legal basis: pre-contractual steps taken at your request, and WaySplat’s legitimate interest in developing its business with professionals.
Retention: 3 years after our last exchange, then deletion. If you become a customer, data needed for the contract is kept for the contract’s duration, then as long as legally required (10 years for accounting records).
Abuse protection: an invisible field filters out bots, and the number of messages per email address is limited. Your IP address is not recorded by WaySplat.
The website sets no cookies and uses no analytics tool. Its font is hosted with the site.
4. Visitor pages: anonymous usage statistics
So that the venue operator knows whether the service is useful (how many visits, which destinations are most requested, which searches fail), the visitor page sends anonymous statistics:
- a random visit identifier, kept in the tab’s memory (sessionStorage) and forgotten when the tab is closed: it cannot recognize you from one visit to the next;
- the device type, at the coarsest level (iPhone/iPad, Android, computer, other);
- the steps of the visit: opening, start of guidance, search (typed text and number of results), chosen destination, arrival, stop, with their time.
No IP address, position or advertising identifier is recorded with these statistics. Avoid typing personal information in the search bar: search text is recorded as typed, without any link to you.
Legal basis: the venue operator’s legitimate interest in measuring the use of the service it provides. This setup meets the conditions defined by the French data protection authority (CNIL) for consent-exempt audience measurement (strictly limited purpose, anonymous data, no combination with other processing).
Retention: 25 months at most, then deletion; only aggregated totals (per day, per destination) may be kept longer.
Opting out: measurement is automatically disabled if your browser sends the Global Privacy Control or Do Not Track signal. You can also open the page once with ?nostats added to its address (for example https://go.waysplat.com/s/venue-name?nostats): measurement then stays disabled on that device.
5. What stays on your device
To work offline and save you from starting over, the visitor page keeps a few items in your browser only. They are not sent to us and are not used for tracking: they are trackers strictly necessary for the service you request, which do not require consent.
| Item | Content | Duration |
|---|---|---|
Language (localStorage) | FR or EN, if you chose one | Until you clear the site’s data |
| Chosen flight (airport) | Flight identifier and steps already completed | Same; cleared when you change flight |
| Seat (stadium) | Block, row and seat you entered | Same |
Visit identifier (sessionStorage) | Random value (see § 4) | Until the tab is closed |
Statistics preference (localStorage) | “No statistics”, if you asked for it | Until you clear the site’s data |
| 3D models (Cache Storage, service worker) | Copy of the venue’s 3D model, to reload it quickly and offline | 6 venues at most; can be cleared at any time |
You can clear everything from your browser settings (site data / storage).
6. Location, orientation and Bluetooth
- GPS: if you allow it, your browser provides your position to the page to place you on the route. The calculation happens on your phone; the position is neither sent to nor stored by WaySplat. If you decline, the page still guides you, playing the route from the venue’s starting point.
- Compass and motion sensors: used on your phone to orient the view. Nothing is sent.
- Bluetooth beacons: some venues have small beacons that broadcast an identifier; they receive nothing and cannot locate you. Your phone listens to them and computes its position on the device. Details on Bluetooth, location and sensors.
7. Property tours (WaySplat Immo)
The tour shows the property’s 3D model and the contact details chosen by the agency or seller (name, agent, phone, email, address). These details are published under their responsibility. The Call, Write and Directions buttons open your phone, email or maps app: WaySplat does not see these exchanges.
Property tours send no visit statistics. The chosen language is kept on your device.
8. People visible in a 3D model
Venues are preferably scanned while empty. If a person, a face or a licence plate remained recognizable in a published model, write to [email protected] with the venue and the location: we will remove or blur it, together with the venue operator.
9. Customers and business accounts
For customers (venue operators, agencies), we process the contact details of our contacts, exchanges, quotes and invoices, and the emails of the people allowed to sign in to the administration tool (sign-in by emailed link). Legal basis: performance of the contract and legal obligations. Retention: duration of the contract, then 3 years for business follow-up and 10 years for accounting records.
10. Where is your data, and who can access it?
Only the publisher of WaySplat accesses the data, together with the venue operator or agency for the statistics and content of its own site. We use two technical providers, bound by confidentiality and security commitments:
| Provider | Role | Data location |
|---|---|---|
| Supabase, Inc. | Database (contact requests, statistics, site content) | European Union (Ireland) |
| Cloudflare, Inc. | Hosting and delivery of pages, storage of 3D models | 3D models stored in Western Europe; pages delivered by a global network |
As both companies are American, access from the United States cannot be excluded (for example for support or security). These transfers are covered by the European Commission’s standard contractual clauses and, for certified companies, by the EU–US Data Privacy Framework. When a page is displayed, your IP address is necessarily processed by Cloudflare to deliver it and protect the service against attacks.
We neither sell nor rent any data.
11. Security
Restricted, authenticated access to administration tools, encrypted connections (HTTPS), row-level access rules in the database, public writes limited to the strict minimum and bounded (size, number, frequency), separation between private working models and published copies.
Important: a published 3D model is downloaded by each visitor’s browser to be displayed. It is therefore public by nature. Working models and administration data remain private.
12. Your rights
You have the right of access, rectification, erasure, restriction, objection and portability, and the right to set instructions regarding your data after your death. Write to [email protected]. We answer within one month.
For anonymous statistics and items kept on your device, we cannot identify you: you can clear them yourself (§ 5) or disable measurement (§ 4).
If you believe your rights are not respected, you can lodge a complaint with the CNIL (3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, France; www.cnil.fr) or with the supervisory authority of your country.
13. Children
Visitor pages can be used by anyone, without an account or personal data. The contact form is intended for professionals.
14. Changes
We update this policy as the service evolves (for example when beacon positioning on iPhone or location-based offers become available). The date of the last update appears at the top of this page. The French version of this policy prevails in case of discrepancy.
