My account

Personal data

Privacy Policy

This policy explains what personal data Lynupp collects, why, how long it is kept, and what your rights are, in accordance with the General Data Protection Regulation (GDPR).

Data controller

The data controller is the Site's publisher, an individual (see Legal Notice): Lucas Chevalier, reachable at contact@lynupp.com. No Data Protection Officer (DPO) has been appointed to date; requests are handled directly by the data controller.

1. "My Space" account

  • Data: email address, password (stored hashed, never in plain text), first name, home city.
  • Purpose: creating and managing your account, logging you in, personalizing your trip planning.
  • Legal basis: performance of the contract (providing the account service).

2. Favorites and musical taste

  • Data: festivals and artists you favorite / follow.
  • Purpose: retrieving your favorites, building a map of your musical genres, suggesting festivals that match your artists.
  • Legal basis: performance of the contract. For a visitor who isn't logged in, these favorites stay stored locally in your browser (see "Cookies and local storage").

3. Trip saved from a festival page

  • Data: the festival concerned, dates, home city, number of travelers, indicative budget, needs (accommodation, transport…), and — if you provide it — your email address and your consent to be contacted again.
  • Purpose: letting you pick up your trip planning later; if you leave an email and tick the corresponding box, letting you know when ticket sales open and about dates for future editions.
  • Legal basis: your consent (checkbox) for being contacted; the publisher's legitimate interest in aggregated, anonymous measurement of demand when no email is provided.

4. Login and browsing

  • Data: a session cookie (a signed token, with no personal data in plain text), and the technical data sent to the host (IP address, server logs) needed for the site to function and stay secure.
  • Legal basis: legitimate interest (security, operation); the session cookie is strictly necessary.

Retention periods

  • Account: until you delete it, or after 3 years of inactivity (a reminder email is sent before deletion).
  • Saved trip / lead: 3 years from the last contact.
  • Host's technical logs: per the host's policy (generally a few months).

Recipients and processors

Your data is neither sold nor rented. It is processed by:

  • Vercel Inc. (site hosting, USA) — transfer outside the EU governed by the European Commission's standard contractual clauses.
  • Railway Corp. (San Francisco, USA; processing and storage servers located in the European Union — Amsterdam, Netherlands) — storage of content and accounts.
  • Brevo (Sendinblue SAS) — a French company, data hosted in the European Union — sending login and notification emails.

In addition, some pages embed third-party services displayed in frames (iframes): Stay22 (accommodation map) and ComparaBUS (travel comparison). These services may set their own cookies and collect data when you interact with them, according to their own privacy policies.

Cookies and local storage

  • Session cookie (lynupp_session): strictly necessary for login, exempt from consent.
  • Preference cookie (lynupp_consent): remembers your choice on audience measurement (see below), valid for 6 months. Also strictly necessary for the banner to work, exempt from consent.
  • Consent banner: on your first visit, a banner lets you accept, decline, or customize audience measurement. You can change this choice at any time via "Manage cookies," at the bottom of every page.
  • Audience measurement: no tool is installed as of today. The banner is already in place so your consent will be requested before such a tool is activated, on the day that happens.
  • Browser local storage: used for your favorites and trip planning when you're not logged in, and for small display settings. This data doesn't leave your device unless you create an account.
  • Any cookies from embedded third-party services (Stay22, ComparaBUS, Spotify): see their respective policies.

Your rights

You have the right to access, rectify, erase, restrict, object to, and port your data. You can also withdraw your consent at any time (for example for notification emails).

To exercise these rights, write to contact@lynupp.com or use the Contact page. We will respond within one month.

If you believe your rights are not being respected, you can file a complaint with the CNIL (the French data protection authority) — www.cnil.fr.

Last updated: September 13, 2026.