Personal data
Updated 19 May 2026.
Data controller
Platypus Forge, reachable at contact@nexttoyourplace.fr.
Data collected and purposes
| Data | Source | Purpose | Legal basis | Retention |
|---|---|---|---|---|
| E-mail address | Signup (OAuth or e-mail) | User account identification | Contract performance | Until account deletion + 30 days |
| First name, surname | OAuth (if provided by the provider) | Personalization of transactional e-mails | Contract performance | Same as user account |
| Analyzed addresses (lat/lon, INSEE code) | Voluntary input | Browsing history | Contract performance | Same as user account |
| Anonymized usage events (page viewed, action, session_id) | Navigation | User journey measurement, product improvement | Legitimate interest | 12 months |
| Anonymized analytics (page, country via truncated IP, browser) | GoatCounter | Audience measurement | Legitimate interest, no third-party tracking | 6 months |
Subprocessors
- Supabase Inc. — authentication + user database. Data stored in Germany (Frankfurt).
- Cloudflare, Inc. — public pages distribution (CDN), DNS proxy. No access to end-to-end encrypted content.
- Oracle Cloud Infrastructure — application services hosting. Data processed in France (Marseille region).
- GoatCounter — self-hosted audience measurement (on infrastructure above). No data sent to third parties.
Your rights
In accordance with articles 15 to 22 of GDPR, you have a right of access, rectification, erasure, restriction, objection and portability regarding your personal data. Exercise them by writing to contact@nexttoyourplace.fr with proof of identity.
You also have the right to lodge a complaint with the French data protection authority (CNIL), 3 place de Fontenoy, TSA 80715, 75334 Paris Cedex 07 — cnil.fr.
Cookies
NextToYourPlace uses a minimal number of cookies, exclusively for technical or anonymized audience measurement purposes:
- sb-* (Supabase) — authenticated user session. Essential, no consent required.
- GoatCounter — anonymized audience measurement, no third-party cookie. IP truncated to 24 bits IPv4. No cross-site tracking.
No advertising cookies, no data resale.