Privacy Policy — VF Ads (VoyageForum.com advertising system)

Last updated: 8 October 2026

This English version is a translation provided for convenience; in case of discrepancy, the French version prevails.

This Privacy Policy describes how MYATLAS GROUP, which operates the advertising system on VoyageForum.com ("VF Ads", also referred to below as the "advertising system"), processes personal data in connection with that system. It is addressed to two audiences: advertisers who use an advertiser account, and readers of the Site on whose pages advertisements or affiliate suggestions are displayed.

It supplements the Terms of Sale and Use of the advertising system, which refer to it for all matters relating to personal data, as well as the privacy policy of the VoyageForum.com website, available at the bottom of the Site's pages.

For any question about your data, write to support@myatlas.com.

Contact details of MYATLAS GROUP:
55 rue Hutellier
60290 LAIGNEVILLE

Controller
Scope
Advertiser data
Data of Site readers
Data obtained through Google APIs (Google Ads API)
Recipients of data
Data sent to Google Ad Manager
Transfers outside the European Union
Cookies and browser storage
Your rights
Security
Changes to this Policy

1. Controller

The controller of the data described in this Policy is MYATLAS GROUP.

The terms "Site", "advertiser", "advertiser account", "campaign" and "creative" have the meaning given to them in the Terms of Sale and Use. The term "reader" refers to any person who visits the Site.

2. Scope

This Policy covers:

the advertiser dashboard and the server behind it (accounts, campaigns, creatives, wallet, billing, support);
the transmission of campaigns to Google Ad Manager, which delivers the advertisements on the Site;
the affiliate module that the Site may load to offer partner travel deals;
the contact forms that the Site may display on behalf of MYATLAS GROUP;
the keyword analysis that VF Ads performs using the Google Ads API (see §5).

It does not cover the Site's own other processing (forum member accounts, posts, general audience measurement, consent banner), which falls under the Site's privacy policy.

3. Advertiser data

3.1 Account and users

Data processed. Email address, optional display name, password (stored only as a hash, never in clear text), date of email address verification, role of each user within an advertiser account, invitations sent (invitee's address, role, author of the invitation), acceptance of the Terms (version, date, user).

Purposes. Creating and managing the account, authentication, managing users and roles, proof of acceptance of the Terms.

Legal basis. Performance of the contract between you and MYATLAS GROUP (Article 6(1)(b) GDPR).

Retention. A login session expires after 30 days. An email verification link is valid for 24 hours, a password reset link for 1 hour, an invitation for 7 days. Account data is kept for as long as the account exists, and thereafter for the period needed to handle any claims, unless erasure is requested (see §10).

3.2 Billing profile, payments and invoices

Data processed. Account name, legal name, billing contact email address and name, postal address, country of establishment, registration number, intra-EU VAT number, website, currency and time zone.

For payment methods: customer ID assigned by Stripe, card brand, last four digits and expiry date, as well as the cardholder's name and email address, the issuing country, the card type, a technical fingerprint of the card and the result of the verification checks performed by Stripe. MYATLAS GROUP never receives or stores the full card number or its security code.

For VAT: the VAT number is checked against the European Commission's VIES system, whose response (including the name and address registered for that number) is kept as tax evidence; exemption certificates you upload are kept with your request.

Each invoice and each credit note freezes a copy of the billing information in force at the time it is issued.

Purposes. Collecting top-ups, issuing invoices and credit notes, determining the applicable VAT treatment, preventing payment and VAT fraud, refunds, handling payment disputes.

Legal bases. Performance of the contract (Article 6(1)(b)); legal accounting and tax obligations (Article 6(1)(c)); legitimate interest of MYATLAS GROUP in preventing fraud (Article 6(1)(f)).

Retention. Accounting and billing documents (invoices, credit notes, payments, refunds and associated evidence) are kept for the statutory retention period under French law, including when you exercise your right to erasure (Article 17(3)(b) and (e) GDPR).

3.3 Email communications

Data processed. Email address, sending language, notification preferences.

Purposes. Sending emails related to the operation of the service: address verification, password reset, invitation, approval decisions on creatives and campaigns, suspension or resumption of delivery, low balance, spending cap reached, failed automatic top-up, decisions on VAT exemption requests. No marketing emails are sent by the system.

Legal basis. Performance of the contract (Article 6(1)(b)).

Emails are sent from the server of MYATLAS GROUP. Optional notifications can be turned off in your account's notification preferences; emails essential to account security cannot be turned off.

3.4 Support, bug reports and audit log

Data processed.

Support tickets — content of your request and the user who created it.
Bug reports — message, address of the page concerned and technical browser information (user agent, screen size, language, clock).
Audit log — record of sensitive actions performed on accounts (sign-up, address verification, password change, billing profile changes, user management, acceptance of the Terms, wallet operations, disputes, personal data requests), with the author, the date and, for some actions, the state of the data before and after the change.

Purposes. Handling your requests, fixing defects, security of the service, proof of operations performed and defence of the rights of MYATLAS GROUP.

Legal bases. Performance of the contract for support; legitimate interest of MYATLAS GROUP in securing the service and being able to account for operations performed (Article 6(1)(f)) for bug reports and the audit log; legal obligation for records relating to financial operations.

Retention. Audit log entries relating to financial operations follow the retention period of accounting documents. The other data in this section is kept for as long as needed for its purpose.

3.5 Security and internal notifications

To limit abusive login attempts, the IP address of the request is used in memory only to limit the number of attempts; it is not recorded in your account or in the audit log.

For each request, the web server records the IP address, user agent and referring page in its technical logs, for security and diagnostic purposes, on the basis of the legitimate interest of MYATLAS GROUP. These logs are rotated automatically and kept only for a limited period.

The team of MYATLAS GROUP receives an internal notification, via the Slack business messaging service, for each sign-up (email address and display name) and each advertiser account creation (account name, legal name, billing country and email address, creator's email address and name), in order to ensure commercial follow-up and the approval of new advertisers.

4. Data of Site readers

4.1 Ad delivery

The advertising system does not itself collect data about readers when advertisements are displayed. Display, counting of impressions and clicks, frequency capping, detection of the user's country and invalid traffic filtering are performed by Google Ad Manager, a service provided by Google.

The script that queries Google Ad Manager is loaded by the Site. In addition to the technical information of the request, it sends Google context parameters describing the page and the slot: page type, slot position, country and topic covered by the page, language, device type, approximate reader country estimated by the Site, environment. No direct identifier of the reader (name, email address, member ID) is included in these parameters.

The setting and reading of trackers by Google, as well as any personalisation of advertisements, are subject to the choice the reader expresses in the Site's consent banner. That banner is managed by the Site using a consent management platform compliant with the IAB Transparency and Consent Framework (TCF); the choices made there apply to the advertising system.

Processing carried out by Google is governed by Google's privacy rules.

4.2 Affiliate module

Where the Site loads it, the affiliate module may, when the reader clicks on the page, open an offer from a travel partner (accommodation, activities, transport) in a new tab. MYATLAS GROUP is paid a commission when that visit results in a booking.

Prior consent. The module waits for the signal from the Site's consent management platform. It activates only if the reader has consented to the storage of information on their device and access to that information, or if that platform indicates that the GDPR does not apply. Until then, it stores nothing in the browser and sends nothing to the server. If the reader withdraws consent, the module immediately stops all activity.

Data stored in the browser.

vf-affiliate-visitor (local storage) — random browser identifier, with its creation date and expiry date. Its lifetime is 60 days from creation; it is not extended by subsequent visits.
vf-affiliate-session, vf-affiliate-session-visitor, vf-affiliate-created, vf-affiliate-stay22 (session storage) — visit identifier and flags specific to that visit, erased when the tab is closed.

The module sets no cookies.

Data sent to the server. Random browser and visit identifiers, page address without its query parameters or fragment, page title and description, page type, device category (desktop, mobile or tablet, inferred in the browser; the user agent itself is not sent), origin only of the referring page (for example https://www.example.com, without path or parameters), as well as the module's display and click events. The server stores neither the reader's IP address nor their user agent for this module.

Where the Site also displays offers from the partner Stay22, the module only observes, within the page, the fact that a reader has clicked on one of them, so as not to overlap with that partner during the same visit. No data is sent to Stay22 by the advertising system.

Partners. The click is redirected to the Travelpayouts affiliate network, which directs the reader to the chosen merchant site (for example Booking.com, GetYourGuide, Viator). The only data the system sends to Travelpayouts is a random click identifier, which allows a booking to be matched to that click; the redirection is made without passing on the address of the originating page. Travelpayouts then returns to MYATLAS GROUP the booking status and commission, without any identity data of the traveller. Processing carried out by Travelpayouts and by merchant sites is governed by their own privacy policies.

The title and description of the Site's pages, excluding any data relating to the reader, may be analysed by an artificial intelligence service accessed through Vercel's gateway in order to determine relevant offers.

Performance measurement. To improve the choice of offers, MYATLAS GROUP uses aggregated statistics from the Site's Google Analytics audience measurement tool (number of visits and clicks by date, page, device category and referring site), over a rolling 60-day period. No individual reader data is kept by the system for this purpose.

Legal basis. The reader's consent for storing and reading information on their device (Article 82 of the French Data Protection Act and Article 6(1)(a) GDPR); legitimate interest of MYATLAS GROUP in measuring and improving the affiliate service, for aggregated statistics.

Retention.

The browser identifier expires after 60 days; it is then deleted from the server.
Visits and clicks are deleted no later than 60 days after their creation.
Display decisions and events are anonymised no later than 60 days after their creation, or as soon as the identifier or visit they relate to expires.
Confirmed bookings are anonymised no later than 60 days after their date; only the partner's booking reference and the commission amount are kept, for accounting purposes.

These deletions and anonymisations are performed automatically every day.

4.3 Contact forms

Where the Site displays a contact form on behalf of MYATLAS GROUP (for example for an information request about a travel offer), the data entered is sent to the advertising system: name, email address, telephone number (optional) and message. Also recorded are the version of the information notice displayed, the address of the page and of the referring page, campaign parameters (utm_*), the user agent and a hash of the IP address computed with a secret key that is renewed every day; the IP address itself is not kept.

Purposes. Responding to your request; combating automated and abusive submissions.

Legal basis. Pre-contractual measures taken at your request (Article 6(1)(b)) and legitimate interest of MYATLAS GROUP in protecting the form against abuse (Article 6(1)(f)).

Recipients. These requests are accessible only to the team of MYATLAS GROUP; they are not passed on to advertisers. An internal notification indicating the name of the form and your first name, excluding your email address, telephone number and message, is sent to the team via Slack.

Retention. Your data is kept for as long as needed to handle your request, and you may request its erasure at any time (see §10).

4.4 Allocation of roles with the Site

The Site is responsible for the consent banner, for loading the ad delivery script and the affiliate module, for the Google Analytics audience measurement tool, and for informing readers about these tools. The advertising system is responsible for the data it receives and stores, as described in §§4.2 and 4.3, and for the information sent to Google Ad Manager to create campaigns (see §7).

5. Data obtained through Google APIs (Google Ads API)

VF Ads connects, using the Google OAuth authorisation protocol and the single scope https://www.googleapis.com/auth/adwords, only to the Google Ads account(s) operated by MYATLAS GROUP itself. This access is used exclusively to use the Google Ads Keyword Planner for keyword analysis.

Data obtained. Keyword ideas, average monthly search volumes, competition level and top-of-page bid ranges, broken down by location and language. These are aggregated statistics about searches made on Google: they contain no personal data about internet users, readers of the Site or advertisers.

Google account concerned. The OAuth authorisation is granted by MYATLAS GROUP for its own Google account; the resulting token relates to that account only. Advertisers and readers never sign in to VF Ads with their Google account, and VF Ads does not access any Google account or Google Ads account that is not operated by MYATLAS GROUP.

Purposes. Understanding what travellers search for in order to plan the advertising inventory and content of VoyageForum.com, and advising advertisers on the targeting of their campaigns. This data is not used for any other purpose.

Storage and security. The OAuth refresh token is stored server-side, encrypted or held in a secret manager, and access to it is restricted to authorised administrators of MYATLAS GROUP; it is never sent to the browser or disclosed to advertisers. Keyword statistics are kept for as long as needed for the analysis for which they were obtained.

No sale or sharing. Data obtained through Google APIs is not sold, not used for advertising profiling of individuals, and not disclosed to third parties, except where required by law. It is not used to train generalised artificial intelligence or machine learning models. Targeting advice given to advertisers is based on these analyses without the raw data received from Google being transferred to them.

Revocation. VF Ads' access to the Google account concerned can be revoked at any time from https://myaccount.google.com/permissions.

Limited Use.

"VF Ads' use and transfer of information received from Google APIs to any other app will adhere to Google API Services User Data Policy, including the Limited Use requirements."

6. Recipients of data

Data is accessible only to authorised staff of MYATLAS GROUP, within the limits of their duties. Within an advertiser account, each user accesses the account's data within the limits of their role.

Your data is not sold, exchanged or rented to any third party.

The following providers are involved in operating the system:

Google (Google Ad Manager) — delivery and measurement of advertisements (see §7); Google Analytics and BigQuery for the aggregated statistics of the affiliate module.
Google (Google Ads API) — provides VF Ads with the aggregated keyword statistics described in §5; no personal data of advertisers or readers is sent to it through this channel.
Stripe — card payment processing; receives the account name, billing email address and country, as well as the card data you enter directly in the payment form provided by Stripe.
Cloudflare — routing and protection of traffic to the server.
Slack — the team's internal messaging (notifications described in §§3.5 and 4.3, technical alerts).
Travelpayouts — affiliate network (see §4.2).
Vercel — gateway to the artificial intelligence service used to analyse pages (see §4.2); no personal data is sent to it.
European Commission (VIES) — verification of intra-EU VAT numbers.

The dashboard may also use a technical error tracking service, which receives technical information about errors encountered in your browser.

Finally, data may be disclosed to the competent authorities where required by law, or for the establishment, exercise or defence of legal claims.

7. Data sent to Google Ad Manager

For your campaigns to be delivered, MYATLAS GROUP creates in Google Ad Manager an advertiser bearing the name of your advertiser account, as well as your campaigns and creatives. Google Ad Manager then produces the impression, click and spend metrics displayed in your account.

Google Ad Manager does not allow an advertiser to be deleted once created. If your account is closed or erased, this record remains in Google Ad Manager; it contains only the name of your account and an internal technical reference.

Delivery and measurement data is kept by Google Ad Manager for the periods specific to that service. MYATLAS GROUP does not keep a raw event history of impressions and clicks on its side.

8. Transfers outside the European Union

Some of the providers mentioned in §6 are established, or have data processed, outside the European Union, in particular in the United States. This is notably the case of Google, including for the Google Ads API (§5), where the exchanges concern aggregated keyword statistics and the authorisation token for the Google account of MYATLAS GROUP. Where such a transfer takes place, it is covered by one of the safeguards provided for in Chapter V GDPR (adequacy decision, including the EU–US Data Privacy Framework, or the European Commission's standard contractual clauses). You can obtain information about these safeguards by writing to support@myatlas.com.

9. Cookies and browser storage

Advertiser dashboard.

session (cookie) — keeps you logged in. It is inaccessible to page scripts and expires after 30 days at most; it is deleted on logout. This cookie is strictly necessary for the service and is not subject to consent.
Browser local storage — remembers your display preferences: active advertiser account, language, theme, table columns. This data stays in your browser and is not sent to the server.
Payment pages load Stripe's script, which is subject to Stripe's privacy policy.

The dashboard uses no audience measurement tool and no advertising tracker.

VoyageForum.com website. The affiliate module uses the local storage and session storage described in §4.2, without cookies. Cookies and trackers set by Google when advertisements are displayed, as well as those of the Site's audience measurement tool, are managed through the Site's consent banner, where you can change your choices at any time. You can also delete the data stored by the affiliate module by clearing the Site's browsing data in your browser.

10. Your rights

Under the General Data Protection Regulation and the French Data Protection Act, you have the following rights over your personal data:

right of access — to obtain confirmation that data concerning you is being processed and to receive a copy of it;
right to rectification — to have inaccurate or incomplete data corrected; most of your advertiser account information can be edited directly in the account;
right to erasure — to obtain the erasure of your data, subject to the retention obligations described below;
right to restriction of processing — to obtain a temporary freeze on the use of your data in the cases provided for by the GDPR;
right to data portability — to receive the data you have provided in a structured, machine-readable format;
right to object — to object to processing based on the legitimate interest of MYATLAS GROUP, on grounds relating to your particular situation;
right to withdraw your consent at any time, for processing based on consent, without affecting the lawfulness of processing carried out before the withdrawal;
right to give instructions regarding the handling of your data after your death.

How to exercise your rights. Advertisers can submit their request from the "Support" page of their account. Anyone, advertiser or reader, can also write to support@myatlas.com. Requests are handled by the team of MYATLAS GROUP; you may be asked to verify your identity. A response will be provided within one month, which may be extended by two months owing to the complexity or number of requests; you will be informed if so.

For the affiliate module, server data is linked only to a random identifier stored in your browser: to request access to or erasure of it, provide the value of the vf-affiliate-visitor identifier, which you can view using your browser's developer tools.

Erasure of an advertiser account. Erasure makes your user account anonymous: your email address, display name and password are replaced, your sessions are closed and your pending invitations are cancelled. It does not delete accounting and billing documents or the associated audit records, which MYATLAS GROUP is legally required to keep (Article 17(3)(b) and (e) GDPR). If you are the sole owner of an advertiser account whose wallet has a balance, that balance must be settled (refund or use) before erasure. The name of your account remains in Google Ad Manager (see §7).

Complaint. If, after contacting us, you consider that your rights have not been respected, you may lodge a complaint with the Commission nationale de l'informatique et des libertés (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07, www.cnil.fr.

11. Security

MYATLAS GROUP implements appropriate technical and organisational measures to protect your data against loss, unauthorised access, disclosure or alteration, including:

passwords are stored as hashes using a strong hashing algorithm (Argon2id);
session, password reset and invitation tokens are stored only as hashes;
communications with the dashboard and the server are encrypted (HTTPS);
card numbers do not pass through the servers of MYATLAS GROUP;
the OAuth authorisation token giving access to the Google Ads API is stored server-side, encrypted or held in a secret manager, and is accessible only to authorised administrators (see §5);
access to administration functions is restricted to authorised persons, and carrying out a data erasure requires approval by a second authorised person;
sensitive actions are recorded in an audit log;
the number of login attempts and requests is rate-limited.

Since no security measure can be absolute, MYATLAS GROUP undertakes, in the event of a personal data breach likely to result in a risk to your rights and freedoms, to make the notifications required by the GDPR to the CNIL and, where applicable, to the data subjects.

12. Changes to this Policy

MYATLAS GROUP may amend this Policy, in particular to reflect changes to the system or to regulations. The date of the last update appears at the top of the document. Changes are brought to the attention of advertisers in their advertiser account.