GDPR and personal data

Your data stays on your WordPress; the platform only receives aggregated figures. Retention, export, deletion and hosting in France.

Kraft Booking was designed so that you remain in control of your guests' and clients' data. It is stored on your WordPress site, with your hosting provider, and the Kraft GDA platform receives only a tiny part of it, strictly what is needed for payments and for the service to operate.

Where your data is

On your WordPress site

Everything about your guests and clients is stored in your site's database:

the guest's identity, contact details and language;
bookings, appointments, extras, the message left in the form;
invoices, credit notes, payment history (amounts and references, never card numbers);
messages exchanged through the portal.

You are the data controller under the GDPR, as for any form on your site. The Kraft GDA platform has no access to it.

What the Kraft GDA platform receives

The platform receives only:

Data	Purpose
Site address, WordPress, PHP and plugin versions	Connection, updates, support
Owner's email and name	Your owner account
Aggregated figures: number of bookings and revenue over 30 days	Calculation and ledger of service fees
Booking reference, amount and fee of each online payment	Fee ledger, refunds
Partner banner display statistics	Operation of the free model

No name, no address, no stay details about your guests are sent to the platform.

What Stripe receives

During an online payment, the payer's email address is sent to Stripe to create the payment session, send the receipt and allow the balance to be charged. This address passes through the platform without ever being stored there. Stripe also processes card data, which goes through neither your site nor the platform.

Stripe acts as a payment institution, with its own privacy policy, which you can read on stripe.com.

Hosting and design

The Kraft GDA platform is hosted in France and designed in France by Global Digital Agency.
Exchanges between your site and the platform are encrypted (HTTPS) and signed.
No third-party trackers: neither the plugin nor the platform embeds any audience analytics tool, advertising pixel or external script on your site. The partner banner sets no cookies and does not observe your visitors (see The partner banner).

Retention periods

Kraft Booking has no retention-period setting and no automatic purge or anonymization: it is up to you to set your periods in your privacy policy, then apply them with the tools described below. Commonly used indicative benchmarks:

Bookings and appointments: the duration of the relationship and of any claims, then for example 3 years for a past booking without dispute.
Invoices and credit notes: 10 years, as they are accounting records; the erasure tool does not delete them.
Waiting list and abandoned requests: a short period, to apply yourself.

When uninstalling, Settings › “Plugin uninstallation” keeps all data by default; a permanent purge is only possible after typing PURGER.

On the platform, the fee ledger is kept for the legal retention period for accounting records; expired technical data (codes, tokens, logs) is purged automatically.

Individuals' rights

Your guests can exercise their rights of access, rectification, portability and erasure with you. Kraft Booking integrates with the native WordPress tools:

Export: Tools › Export Personal Data, enter the guest's email; for each of their bookings and appointments, the export includes the reference, status, contact details, total, the messages visible to them and the list of documents.
Erasure: Tools › Erase Personal Data; the records are anonymized (name, email and phone replaced, the guest's messages erased); issued invoices and credit notes are kept as issued, since they are accounting records, and the erasure report says so.

There is no anonymization button in a booking's record: erasure is done by email address, with the WordPress tool.

For your own owner account, the Kraft GDA area does not currently offer self-service export or account deletion: send the request to support (“Help” bubble › “Talk to a human”).

Notices to include on your site

In your privacy policy, mention the purpose (managing bookings and appointments), the chosen retention period, Stripe as payment provider and Global Digital Agency as technical provider receiving aggregated data. Kraft Booking does not provide a template paragraph: write it, then have it reviewed.

Key points

Guest data stays on your WordPress; the platform only receives aggregated figures and payment references.
The payer's email is sent to Stripe, never stored by the platform.
Hosted and designed in France, with no third-party trackers.
Retention periods set by you, export and erasure through the WordPress tools.