Aller au contenu
Nidora
EN
Français (FR) English (EN)
Save a search

Privacy policy

We process your personal data in accordance with the GDPR.

Last updated: 29 July 2026.

Controller and contact

The controller is the publisher of Nidora (a non-professional publisher, see the legal notice). For any request, contact contact@logement-etudiant-france.fr.

Data collected and purposes

  • Saved search / alert: when you save a search we store your e-mail address, the desired city, housing type and maximum budget, your chosen language, your consent and the creation date. Purpose: keep your criteria and send you an e-mail notification when a matching CROUS residence appears. These e-mail alerts are active (sent by an offline batch job after the daily CROUS data refresh).
  • Outbound click measurement: clicks to official sites are counted server-side, in aggregate, without individual profiling.
  • Audience measurement: with your consent, Google Analytics 4 (via Google Tag Manager) measures site usage using cookies (see the cookie policy).

Legal bases

  • Saved searches and e-mail alerts: your consent (GDPR art. 6(1)(a)), which you can withdraw at any time.
  • Audience-measurement cookies: your consent (GDPR art. 6(1)(a) and art. 82 of the French Data Protection Act).
  • Server-side, non-identifying click counting: our legitimate interest (GDPR art. 6(1)(f)) in understanding aggregate use of the service.

Recipients and processors

  • Supabase (managed PostgreSQL database) — stores saved-search data.
  • Resend — sends the e-mail alerts.
  • Google (Analytics / Tag Manager) — audience measurement, only after consent.
  • OVH — hosting of the application (see the legal notice).

We do not sell your data and share it only with these providers, to the extent needed to run the service.

Transfers outside the EEA

Two providers process data on infrastructure located outside the European Economic Area, in the United States. The safeguards relied upon are the following:

  • Google (Analytics / Tag Manager) — Google LLC is certified under the EU–U.S. Data Privacy Framework and, since 1 September 2023, relies on that framework to transfer EEA personal information to the United States for its advertising and measurement services; the Google Ads Data Processing Terms additionally incorporate the European Commission's Standard Contractual Clauses (Google — international data transfers). These transfers only occur if you accept measurement cookies: without your consent, no Google tag is loaded.
  • Resend (alert e-mails) — Resend Inc. states that its primary processing operations take place in the United States. Transfers are governed by the EU Standard Contractual Clauses (Commission Decision 2021/914, Module Two, controller to processor), and Resend has certified its adherence to the EU–U.S. Data Privacy Framework Principles with the U.S. Department of Commerce (Resend Data Processing Addendum, sections 6.1, 6.2 and 11.1). Its list of sub-processors is published at resend.com/legal/subprocessors.

The database (Supabase) and the application host (OVH) are configured in Europe, so subscription data is stored in the EEA. Only the sending of e-mails and, subject to your consent, the measurement of visits involve a transfer to the United States.

Retention

Alert subscriptions are kept for 6 months from the date the saved search is recorded, then permanently deleted. This deletion is not a mere promise: an automated purge runs every day and removes any subscription that has passed this deadline. You can re-subscribe at any time.

Unsubscribing removes you from the mailings immediately. An unsubscribe record is kept beyond the 6 months, in the form of a sha256 hash of your e-mail address only (never in clear text), for the sole purpose of guaranteeing you are not contacted again.

Aggregated audience statistics (Google Analytics 4) are retained according to the setting of the measurement property, independently of any subscription.

Your rights

  • Right of access, rectification and erasure.
  • Right to withdraw your consent at any time — every alert e-mail contains an unsubscribe link that stops all further notifications.
  • Right to data portability and right to object.

To exercise your rights, write to contact@logement-etudiant-france.fr. We reply within one month of receiving your request, as required by Article 12.3 of the GDPR. To unsubscribe from alerts, the quickest route remains the one-click link at the bottom of every e-mail. You also have the right to lodge a complaint with the CNIL (the French data protection authority, www.cnil.fr).

Security

We apply reasonable technical and organisational measures: encrypted (HTTPS) connections, access limited to what is necessary, and unsubscribe links signed so they cannot be forged. E-mail addresses are never written to our logs (only a truncated hash is used for troubleshooting).