This page is a courtesy translation. In case of discrepancy, the French version prevails.
Nidz (hereinafter “we”) attaches the utmost importance to the protection of your personal data. This Privacy Policy is intended to inform the users (hereinafter “you”) of our mobile and web application Nidz (hereinafter “the Application”) about how your data is collected, processed and protected, in accordance with the General Data Protection Regulation (GDPR) and the French Data Protection Act. It supplements the terms of use.
1. Data controller
The controller of the personal data collected through the Application is:
- Company name: Nidz
- Legal form: SAS (French simplified joint-stock company)
- Head office: Appartement A51, 66 rue Bayard, 59000 Lille, France
- Registration number: 988769840
- Contact email: contact@nidz.fr
2. Data collected and purposes
We only collect and process the data strictly necessary for the following purposes:
| Data collected | Purpose of processing | Legal basis |
|---|---|---|
| Account data: last name, first name, email address, password | Creation and management of the user account, access to the services | Performance of the contract |
| Profile data: photo, bio, interests and, if you provide it, phone number | Presentation to the neighbours of your residence (name, photo, bio); contact by your managers (email, phone) | Performance of the contract |
| Attachment data: home, status of owner, tenant or occupant, role (residents’ council, manager) | Access to your residence’s spaces. This data is provided to us by your property manager (the Customer), who is responsible for its accuracy | Performance of the contract; legitimate interest of the Customer in managing the residence |
| Content and messages: incident reports, announcements, discussions, comments, activities, loans, votes, attachments, messages | Operation of the residence’s exchanges | Performance of the contract |
| Reviews of the management: rating, comment, “anonymous” option | Feedback to your manager. The “anonymous” option hides your identity when displayed; Nidz keeps it for its legal obligations and to fight abuse | Performance of the contract; legitimate interest |
| Conversational assistant (where offered): questions and conversation history | Answering your questions about the use of the Application; transmission to the artificial intelligence provider and, in case of escalation, to the Nidz team | Performance of the contract |
| Technical data: IP address, unique device identifier (UUID), phone model, OS version, app version | Technical maintenance, application security, bug fixing, updates of the mobile app | Legitimate interest |
| Audience measurement data: screens viewed, features used, interactions, random identifier specific to the device or browser, not linked to your account | Anonymous usage statistics to improve the Application (see section 11) | Legitimate interest; tracker exempt from consent (article 82 of the French Data Protection Act) |
| Error reports: nature of the error, screen concerned, Application version, device system and model; on mobile, crash reports | Detecting and fixing bugs (see section 11) | Legitimate interest |
| Notification data: push tokens | Sending push notifications (alerts, reminders) | Consent |
3. Recipients of the data
Your personal data is processed by NIDZ’s authorised staff. It may also be transmitted to trusted third-party processors for technical needs:
- Hosting, database and file storage: OVHcloud (France)
- Authentication: Auth0 (Okta), instance hosted in the European Union
- Push notifications and messaging: Google Firebase (sending notifications, storing messages and, to protect access to conversations, opening a messaging session with a technical identifier: your Nidz user id)
- Email delivery: Amazon Web Services SES (Paris region)
- Conversational assistant, where offered: Google (Gemini models)
- Technical monitoring: SigNoz, a tool self-hosted by Nidz on its own infrastructure
- Anonymous audience measurement and error reports of the Application: PostHog (PostHog, Inc.), European instance hosted in Germany (see section 11)
- Mobile app updates: Expo (650 Industries, Inc., United States), EAS Update service. On each launch, the app contacts Expo’s update servers, which receive the device’s IP address, its platform (iOS or Android), the app version and its update channel
Home attachment data (owner, tenant, occupant) is provided to us by your property manager, who is responsible for its accuracy and lawfulness; Nidz processes it for the needs of the service. Your managers have access to your contact details (email, phone); your neighbours only see your name, photo and bio. Nidz may change providers; you are informed when the change substantially modifies the processing of your data.
Commitment: we do not sell, rent or share any of your personal data for commercial purposes without your explicit consent.
4. Data transfers outside the European Union
Your data is hosted in the European Union (France). Where a provider may process data outside the European Union, the transfer is covered by appropriate safeguards: an adequacy decision of the European Commission or standard contractual clauses.
In particular:
- PostHog: audience measurement data and error reports are hosted in PostHog’s European instance, in Germany. As PostHog, Inc. is a US company, any access from the United States is covered by its participation in the EU-US Data Privacy Framework and by the standard contractual clauses of its data processing agreement.
- Expo: mobile app update requests are processed by 650 Industries, Inc., a company established in the United States, which states that it complies with the EU-US Data Privacy Framework and whose terms of service incorporate the European Commission’s standard contractual clauses (module 2, controller to processor).
5. Data retention
We keep your data only for as long as necessary for the purposes for which it was collected:
- Account data: kept as long as your account is active. When you deactivate your account, you have 30 days to reactivate it; at the end of this period, your account is irreversibly anonymised (profile, photo, contact details, devices, preferences, access, reviews and conversations with the assistant deleted). Content published in the life of the residence (incident reports, announcements, discussions, comments, activities, loans, messages) remains visible to the members concerned, attributed to “Deleted user”. Data required for our legal obligations is kept for the period provided for by law. Nidz may deactivate, after informing you, an account that has remained inactive for a long period.
- Connection data and logs: kept for a maximum of 6 to 12 months.
- Audience measurement data (cookies/SDK): kept for a maximum of 13 months.
- Audience measurement and error reports of the Application: kept for 1 year by PostHog, then deleted.
6. Your rights
Under the GDPR, you have the following rights over your personal data:
- Right of access: obtain confirmation and a copy of the data processed about you.
- Right to rectification: correct inaccurate or incomplete data.
- Right to erasure (“right to be forgotten”): request the deletion of your personal data.
- Right to restriction of processing: temporarily freeze the use of certain data.
- Right to portability: receive your data in a structured, machine-readable format (the Application offers no self-service export: write to us).
- Right to object: object at any time to the processing of your data on legitimate grounds or for direct marketing purposes.
- Withdrawal of consent: withdraw your consent at any time for the features that require it (e.g. geolocation, notifications).
- Post-mortem instructions: decide what happens to your data after your death (article 85 of the French Data Protection Act).
To exercise these rights, you can contact us directly at: contact@nidz.fr.
If, after contacting us, you believe your rights are not being respected, you have the right to lodge a complaint with the CNIL (www.cnil.fr), the French supervisory authority.
7. Deleting your Nidz account
You can ask at any time for your Nidz account and its associated data to be deleted, in either of two ways:
- In the Nidz app (mobile app or web app at app.nidz.fr): open Settings › Your account › Delete your account, then confirm. Your account is deactivated immediately, then permanently deleted after 30 days along with your personal data. Until then, you can reactivate it by signing back in.
- Without the app: write to contact@nidz.fr from your account’s email address asking for your account to be deleted. We handle your request within one month, as required by the GDPR.
What is deleted and what is kept: at the end of the 30 days, your account is irreversibly anonymised and your personal data is deleted. Content published in the life of the residence remains visible to the members concerned, attributed to “Deleted user”, and data required for our legal obligations is kept for the period provided for by law. Details are in section 5.
8. Security
We implement appropriate technical and organisational security measures (encryption in transit via HTTPS, access control per residence, authentication delegated to a specialised provider: hashed passwords, passkeys) to protect your data against any unauthorised access, alteration, disclosure or destruction.
9. Contact and support forms on nidz.fr
The site’s contact form collects the following data: name, email address, capacity (property manager, residents’ council or resident), message, and, if you provide them, company and phone number. The support form collects email address, capacity, topic of the request, priority and message, plus, if you provide them, your name and a screenshot or attached document; when opened from the Nidz app, it also attaches the name of the residence concerned, the app used and its version, and the device’s operating system. It follows the same rules.
- Purpose: processing and answering your request. This data is used for no other purpose.
- Legal basis: pre-contractual measures at your request and Nidz’s legitimate interest in answering the requests it receives.
- Recipients: the Nidz team only.
- Technical processors: Supabase (secure storage of the messages, hosted in the European Union) and Amazon Web Services SES (email delivery, Paris region).
- Retention: 3 years at most after your last contact, then automatic deletion.
- Your rights: the rights described in section 6 apply; write to us at contact@nidz.fr.
10. Cookies and trackers on nidz.fr
The nidz.fr site uses an audience measurement and browsing analytics tool (UX-KEY) intended to improve the site. These trackers are only set after your consent, given through the banner shown on your first visit. If you take no action, or if you decline, no tracker is set.
- Legal basis: your consent (article 82 of the French Data Protection Act).
- Validity of your choice: 6 months (whether accepted or declined), after which you are asked again. Your choice is stored locally in your browser, never on our servers.
- Withdrawing your consent: at any time through the “Cookies” link in the footer; the refusal takes effect from the next page.
- Retention of measurement data: 13 months at most (see section 5).
The footer also shows the state of our services, read from our public status page status.nidz.fr (hosted by Better Stack). This is a plain technical request, triggered only when the footer comes into view: it sends your IP address to Better Stack, without any cookie or identifier, and is not used for audience measurement.
11. Audience measurement and error reports in the Application
The Nidz web and mobile apps measure their usage and report their errors with PostHog, in its European instance hosted in Germany. This measurement is designed to remain anonymous:
- No identification: neither your account identifier nor your email address is sent, and no profile is created. Events are attached to a random identifier specific to your device or browser, not linked to your account.
- IP address not stored: PostHog discards your IP address before storing events; only an approximate location (country, city) may be derived from it beforehand.
- No session recording: no video or capture of your screen is made, and the text displayed is not collected.
- Cleaned addresses: page addresses are sent without parameters or identifiers.
- Excluded content: messaging and managers’ internal notes are not measured at all.
- Error reports: when an error occurs, a technical report is sent (nature of the error, screen concerned, Application version, device system and model); on mobile, it includes the app’s crash reports.
- Legal basis: audience measurement only produces anonymous statistics, without cross-referencing with other processing, and is therefore covered by the consent exemption for audience measurement tools (article 82 of the French Data Protection Act, CNIL recommendations); error reports rely on our legitimate interest in keeping the Application working and secure.
- Retention: 1 year, then deletion.
12. Changes to this Privacy Policy
We reserve the right to amend this Policy at any time to reflect changes in the Application or in regulations. In the event of a substantial change, we will inform you through a notification in the Application or by email.