01Who We Are
Nordath is the trade name of an individual entrepreneur registered in France under the micro-entreprise regime. That entrepreneur is Romain Compagnon (173 rue de Courcelles, 75017 Paris, France). Nordath operates nordath.com, the ALP platform at partners.nordath.com and the staff portal at portal.nordath.com, and is the data controller for the processing described here, except where this policy says a customer is. For any question about this policy, contact [email protected] or our Data Protection Officer at [email protected].
02Who This Policy Covers
This policy applies to visitors of our websites, to customers and team members using ALP, and to landowners whose parcels appear in our tools or who are contacted through them, in every country ALP covers: France, Austria, Belgium, Croatia, the Czech Republic, Denmark, Estonia, Finland, Germany, Iceland, Ireland, Italy, Latvia, Liechtenstein, Lithuania, Luxembourg, the Netherlands, Norway, Poland, Slovakia, Slovenia, Switzerland and the United Kingdom (Scotland). The current status of each country is published at nordath.com/coverage.
03Data We Collect From Visitors
- Your language preference, in your browser's local storage and in a first-party cookie shared with our subdomains. - Your cookie consent choice. - Only if you consent: masked browsing telemetry (pages visited, clicks, session duration) collected by PostHog, hosted in the EU and routed through our own domain, without cookies. Everything typed into forms is masked and never recorded. - What you send us through the contact form or the chat assistant. - Technical connection data (IP address, browser signals) processed by Cloudflare to protect the site against abuse, including its Turnstile bot check.
04Data We Collect From Customers
- Account data: name, work email, company, role, language, and the organisation and team you belong to. You can sign in with email or with your Google or Microsoft account; we then receive your name and email address from that provider. - Billing data: plan, invoices and tax details. Payments are handled by Stripe; we never see or store your full card number. - Workspace content you create: saved parcels, deal pipeline, notes, photos you upload, watchlists, sector alerts, exports, shared dossier links (which expire after 30 days), API keys and webhooks. - Outreach data: the letters you send through ALP, their recipients' postal addresses and their delivery status. - Security and usage logs: sign-ins, plan usage and errors, used to run and protect the service.
05Landowner and Public Register Data
ALP shows parcels, buildings, zoning and risk data taken from official public registers in each covered country (listed in our Legal Notice). Outside France, ALP does not identify landowners. In France, owners that are companies or public bodies are identified from the public SIRENE and BODACC registers. We never look up the name or address of a private individual: those details are only in ALP if a customer records them, for example after the owner has replied to that customer's letter. If you are a landowner and want us to stop processing your data or to stop being contacted through ALP, write to [email protected] and we will act on it and pass your objection to the customer concerned. How a letter is addressed: ALP never looks up a private individual's name or address. The customer types the postal address on the parcel record, from a source they are entitled to use, and the letter is addressed to the owner of the parcel unless the customer has recorded a name. For a company or public body identified in France from SIRENE, the letter is addressed to that company at its registered office. ALP refuses to post a letter without a complete address, and every letter shows the sending customer's name and contact details, not Nordath's.
06Why We Use Your Data and on What Legal Basis
- To provide ALP and customer support: performance of our contract with you. - To secure our services, prevent fraud and enforce our Terms: our legitimate interest. - To send the alerts, digests and service emails you set up or need to use the service: performance of the contract. - To keep invoices and accounting records: our legal obligations. - To measure and improve the website through PostHog analytics: your consent, which you can withdraw at any time. - To contact landowners about a possible sale of their land: the legitimate interest of the customer who sends the letter, who decides whom to contact and is responsible for it; Nordath only processes that data on the customer's behalf, as set out on the GDPR Compliance page. We do not sell personal data, and we do not use it for advertising profiles or cross-site tracking.
07Who Receives Your Data
Only the service providers we need to run Nordath, each bound by a data processing agreement: Railway (application hosting and database, EU region), Cloudflare (network delivery, security, bot protection and staff access control), Stripe (payments), Resend (transactional email), PostHog (analytics, EU hosting, only with consent), Google (the Gemini AI models behind the chat assistant and the zoning-document reader, and Google sign-in), Microsoft (Microsoft sign-in) and Merci Facteur (printing and posting of outreach letters, France). Within your organisation, your workspace content is visible to your teammates according to their roles. We disclose data to authorities only when the law requires it.
08International Transfers
Our database runs in the EU. Some of the providers above are based in the United States or may access data from there. Such transfers rely on an adequacy decision (for example the EU-US Data Privacy Framework, where the provider is certified) or on the European Commission's Standard Contractual Clauses, together with the UK and Swiss equivalents for users in those countries.
09How Long We Keep Data
- Account and workspace data: for as long as your account is active, then deleted or anonymised after you close it, unless you ask for earlier deletion. - Invoices and accounting records: for the period required by French law (currently 10 years). - Shared dossier links: 30 days. - Contact form and chat messages: as long as needed to answer you, and no longer than 3 years after our last exchange. - Language preference: until you clear your browser storage (the cookie itself expires after one year). - Analytics: until you withdraw your consent.
10Your Rights
You have the right to access, rectify and erase your data, to restrict or object to its processing, to data portability, and to withdraw your consent at any time. To exercise them, write to [email protected]; we answer within one month. You may also lodge a complaint with a supervisory authority: the CNIL in France, the authority of the EU or EEA country where you live, the Information Commissioner's Office in the United Kingdom, or the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland.
11Hosting
This website is hosted by Railway Corporation (548 Market St, PMB 68956, San Francisco, CA 94104, USA) and served through the network of Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Both process connection metadata such as IP addresses as part of their infrastructure; see their own privacy policies for details.
12Changes to This Policy
We update this policy when our services, our coverage or the law change. The date at the top shows the latest version, and material changes are announced on the website or by email to active customers.