Privacy Policy

1. Introduction

NidApp SAS ("NidApp", "we", "us", or "our") operates the NidApp platform at console.nidapp.io and nidapp.io. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our Platform as a Service (PaaS).

For NidApp console accounts, that is the email address, the name and the Google identifier of the users, the IP addresses recorded in the audit logs and the billing data, NidApp acts as data controller. Those processing activities are the ones described by this policy.

For the data that you or your users place in your deployed services, you are the data controller and NidApp acts as processor on your behalf. Those processing activities are governed by the data processing agreement under article 28 of the GDPR, annexed to the signed service agreement, and not by this policy. NidApp processes that data only on your documented instructions, never for its own account, for commercial statistics or for model training.

2. Data Controller

3. Information We Collect

3.1 Authentication Information

When you sign up using Google OAuth, we collect:

• Email address
• Full name
• Profile picture

We do not use analytics tools, tracking pixels, cookies for tracking purposes, or any third-party data collection service.

3.2 Service Data

When you use our platform, we store:

• Organizations, projects, and services you create
• Configuration data for your deployed applications
• Service logs and metrics necessary for platform operation
• IP addresses recorded in the audit logs of the console
• The billing data of your organization

3.3 What We DON'T Collect

We explicitly do NOT collect:

• Browser fingerprints
• Behavioral analytics
• Marketing or advertising data
• Third-party cookies

4. How We Use Your Information

We use your information solely for:

• Account authentication and identity verification
• Providing and operating the NidApp platform
• Managing your organizations, projects, and services
• Communicating with you about your account and services
• Billing and payment processing
• Technical support

5. Data Storage and Security

5.1 Location

Customer data is hosted exclusively in the European Union, on Google Cloud in Paris (europe-west9 region). Backups are stored in the same region. No customer content, file or database, leaves the European Union. The list of sub-processors and their locations is in the sub-processors section below.

5.2 Encryption

We implement industry-standard security measures:

• Data in transit: all access to the platform and to your services uses TLS encryption
• Data at rest: AES-256 encryption, provided by the cloud provider
• The connection credentials of your managed services are encrypted by NidApp at application level (AES-256-GCM) before storage

5.3 Access Control

We implement Role-Based Access Control (RBAC) with owner, admin, and viewer roles to ensure only authorized users can access your data.

5.4 Data Breach

Where NidApp acts as a processor, it notifies the customer concerned of any personal data breach without undue delay, and at the latest within 24 hours of becoming aware of it. Where NidApp acts as the data controller, it notifies the CNIL at the latest within 72 hours of becoming aware of the breach and, where the breach is likely to result in a high risk, informs the persons concerned as soon as possible. Every breach is entered in an internal register, whether or not it is notifiable.

6. Sub-processors

We do not sell your personal data and do not share it with third parties for their own purposes. The following sub-processors may process data in the course of the service. This list is a copy of the one held in the article 28 data processing agreement, which is its single source; it is updated at every addition or replacement, with prior written notice to customers.

• Google Cloud EMEA Limited: hosting of the services and of the backups. Ireland, infrastructure in Paris (europe-west9). All the data hosted on your behalf.
• OVH: DNS and outgoing email. France. Email addresses of the contact requests.
• GitHub: code repositories and GitOps deployment manifests. United States, Data Privacy Framework. Deployment configurations, no customer content.
• Pennylane: invoicing and accounting. France. Identification and billing data of your company.
• Telegram: internal technical alerts for operations. Outside the European Union. Names of organizations and of services, no customer content.
• Google Workspace Sheets (Google Ireland Limited): log of the demo requests received through this website. Ireland. Name, email address, company and message of the request.
• Model provider for the operations agents: alert triage, monthly report, upgrade review. No such provider is used to this day; it will be listed here, with its location, on the day it is adopted.

Authentication goes through Google OAuth, which you explicitly authorize at sign-up. We do not use third-party analytics, advertising networks or marketing platforms. We disclose personal data to a public authority only where the law requires it.

7. Your Rights Under GDPR

As a data subject under the General Data Protection Regulation (GDPR), you have the following rights:

To exercise any of these rights, please contact us at contact@nidapp.io. We will respond within 30 days.

If your request concerns data hosted by NidApp on behalf of one of its customers, NidApp is only the processor: it does not answer the request itself and forwards it within 5 business days to the customer concerned, who is the data controller.

8. Data Retention

The retention period for each kind of data comes from our record of processing activities:

• Customer data hosted in your deployed services: the duration of the contract, then deletion 30 days after its end, backups included
• NidApp console account: deletion 3 years after the last sign-in
• Technical logs of the platform: 30 days
• Logs and metrics of your deployed services: 10 days
• Audit logs of the cloud provider: 400 days
• Demo requests: 12 months after our last contact with you
• Accounting records and invoices: 10 years, under accounting obligations

You can request the deletion of your account at any time by writing to contact@nidapp.io. A dated deletion certificate is issued on written request.

9. Legal Basis for Processing

Under GDPR, we process your data based on:

• Contractual necessity: To provide the services you requested
• Legitimate interests: To operate, maintain, and improve our platform
• Consent: When you explicitly agree (e.g., Google OAuth authentication)
• Legal obligations: When required by law

10. International Data Transfers

Customer data does not leave the European Union. It is hosted in Paris (europe-west9) and the backups stay in the same region. Two technical sub-processors are established outside the European Union: GitHub, in the United States, on the basis of the EU-US Data Privacy Framework, which receives deployment configurations and no customer content; and Telegram, outside the European Union, which receives names of organizations and of services. The data sent to them is limited and listed in the sub-processors section.

11. Children's Privacy

NidApp is not intended for users under the age of 16. We do not knowingly collect personal information from children. If you believe we have inadvertently collected information from a child, please contact us immediately.

12. Changes to This Privacy Policy

We may update this Privacy Policy from time to time. We will notify you of any material changes by:

• Updating the "Last Updated" date at the top of this policy
• Sending an email notification to your registered email address
• Displaying a notice on the platform

Continued use of the platform after changes constitutes acceptance of the updated policy.

13. Contact Us

If you have any questions, concerns, or requests regarding this Privacy Policy or our data practices, please contact us:

We will respond to all requests within 30 days in accordance with GDPR requirements.

14. Demo Request Form

The demo request form on this website is separate from the platform account data described above. When you submit it, we collect:

• Your name
• Your email address
• Your company
• The message you write, if any
• The language of the form (en or fr)
• The page you came from (referer)

Purpose: answering your request. Legal basis: steps taken at your request before entering into a contract. No IP address is stored with the request.

Processor: besides the email notification sent to our team, the request is logged in a Google Workspace Sheets spreadsheet (Google Ireland Limited, Data Processing Agreement in place). No other third party receives it.

Retention: 12 months after our last contact with you, then deletion.

Deletion on request: write to contact@nidapp.io and we remove your request from the log.