Privacy policy

The controller for processing carried out through NLocale is JAK MOOH, a French single-member simplified joint-stock company registered with the Rouen Trade and Companies Register under number 105 005 334. Its registered office is at 3 rue de Stalingrad, 76500 Elbeuf. Its NLocale editorial office and correspondence address are at 4 rue Paul Doumer, 02000 Laon.

Privacy contact: nadege@nlocale.fr, with “Personal data” in the subject line. No data protection officer has currently been appointed; this will be reassessed if the nature or scale of processing requires one.

This policy covers nlocale.fr, its forms, NLocale account areas and, when enabled, administrator, business and local authority areas. It also covers transactional messages and digital assistance features offered under the name Tata Nadège.

When a user is redirected to a business website, messaging service or social network, that third party then processes the data under its own responsibility. Its privacy policy applies in addition to this policy.

• Identity and contact: surname, first name, email address, telephone number and postal address.
• Account: identifier, role, organisation, preferences, login dates and security events. Passwords are protected by the authentication service and cannot be read by NLocale.
• Businesses and local authorities: legal name, SIREN/SIRET registration numbers, position, authority to act, territory, contact details, contractual and billing information.
• Listings and events: descriptions, opening hours, prices, accessibility, contact details, links, media, authors, sources and modification history.
• Direct enquiries: subject, message, intended establishment, contact details and information voluntarily supplied.
• Business relationships: selected plan, quotation, order, subscription status, invoices and support history.
• Browsing: IP address, technical logs, device, browser, pages viewed, referral source, consents and audience measurements when enabled.
• Moderation: reports, evidence, responses, decisions and history relevant to security or dispute resolution.

Data may come from:

• the user, business or local authority directly;
• an authorised member of the same organisation;
• public or open sources, including official websites, public registers and tourism datasets such as DATAtourisme;
• an organiser, tourist office or partner authorised to supply the information;
• technical systems needed to operate and secure the service and measure its audience.

Where contact details were not obtained directly from the individual, NLocale informs them in accordance with applicable rules no later than the first contact or within the applicable statutory period, unless a statutory exception applies.

Required fields are marked in the interface. Without them, NLocale may be unable to create an account, forward an enquiry, publish a listing, enter into a subscription or respond. Other fields are optional. Refusing non-essential trackers does not prevent access to essential features.

Within the scope of their responsibilities, data may be received by:

• authorised JAK MOOH personnel working on NLocale;
• the business, organiser or local authority expressly selected by the user for a direct enquiry;
• authorised members of an organisation, according to their back-office role;
• technical providers and advisers subject to confidentiality obligations;
• authorities, courts or authorised bodies where required by law.

NLocale does not sell or rent personal data. A public listing must contain only business contact details intended and approved for public disclosure.

NLocale uses, in particular, Netlify for hosting and web functions, Supabase for authentication, databases and storage, and Resend for email delivery once activated. Other strictly necessary providers may be added; this policy will be updated if there is a significant change.

When a business requests help translating its showcase, NLocale sends OpenAI, through Netlify AI Gateway, the business name, category, location and four saved French texts: title, description, SEO title and SEO description. NLocale does not attach private account contact details, photos or received enquiries. However, the texts may include contact details entered by the business itself; confidential information must not be included. Suggested translations require review and are neither saved to the showcase nor published automatically.

Some providers are established or have teams outside the European Economic Area. Where transfers occur, they rely, as applicable, on an adequacy decision, European Commission standard contractual clauses and appropriate supplementary measures. Available information about these safeguards may be requested from the contact address, subject to confidentiality restrictions.

NLocale retains each category for a period proportionate to its purpose, then deletes or anonymises it. Longer intermediate retention may apply to meet a legal obligation or establish, exercise or defend a right.

The contact form on business showcases shares your name, email address and message with the business you select. NLocale makes the enquiry available in the business account for 90 days, then deletes it during the daily cleanup. These details are used to handle your enquiry. This form does not sign you up for marketing or trigger any automatic email, booking or payment.

When booking features are activated for a property, NLocale processes information needed to quote and manage the stay: the guest account, property, dates, guest count and, depending on completed fields, children’s ages, pets, extras, tax-exemption reason, amounts, accepted terms and booking status. This supports the quote, booking and stay arrangements; required fields are identified in the journey.

A stay record may additionally contain a name, telephone number and arrival note. These three supplementary fields are optional and help arrange arrival and stay-related communication. Do not enter sensitive information, identity documents, card numbers or security codes. A stay summary is private; these details are not published in the property listing or public AI catalogue.

Guests access their own records. The business and its team access records according to their permissions, authorised properties and permitted actions. Task, assignment and progress information helps organise arrival, departure and housekeeping. A subscription or local-authority role grants no general access to guest contact details. Access through Tonton Jak or a connected assistant follows the same limits and applicable MCP mandate.

For configured payment features, card entry is handled by Stripe. NLocale does not store full card numbers or security codes; provider references, amounts, due dates and operation statuses support the tracking of deposits, balances, guarantees and refunds. Returning to a page is not proof of payment. A payment journey labelled as test mode does not trigger a real payment.

An external connector receives information needed for its scope only when configured and activated for the relevant property. Registration or a paid plan does not automatically connect Channex, Nowistay or another tool. The business must limit sharing and access to the stay’s needs. Provider terms and the recipient and transfer information below supplement this framework.

Data retention criteria · Exercise your data rights

Strictly necessary features

Cookies or local storage may remember a session, language preference, privacy choice, anti-abuse protection or interface state. They are used without consent only when essential to the service requested.

Audience measurement and optional services

Any tracker that is not strictly necessary, including advertising or non-exempt audience measurement trackers, is blocked until consent is given. Refusing must be as easy as accepting, and the choice can be changed at any time through the privacy manager when available. NLocale does not currently use browsing-based advertising targeting.

Third-party websites and social networks

An external link or share button does not, by itself, place a third-party tracker embedded in the page. After a click, however, the relevant website or social network applies its own rules.

Tata Nadège may use search rules and artificial intelligence models to rephrase a request, find places or events, summarise information and suggest responses. Data sent to this feature is limited to what is necessary for the request and security checks.

• Responses may be incomplete or incorrect and must be checked before any decision.
• Tata Nadège does not make decisions that have legal or significant effects on an individual.
• Editorial decisions, moderation and the award of the “Tasted by Tata Nadège” badge remain under human control.
• Do not share secrets, sensitive data or banking information with Tata Nadège.

Under the conditions set out in the GDPR and the French Data Protection Act, individuals may request:

• access to their data and a copy;
• rectification of inaccurate or incomplete data;
• erasure where the conditions are met;
• temporary restriction of processing;
• objection to processing based on legitimate interests, and to direct marketing at any time;
• portability of data supplied where processing is based on consent or a contract and is automated;
• withdrawal of consent, without affecting processing already carried out;
• information about safeguards for an international transfer;
• instructions concerning what happens to their data after their death.

Requests may be sent to nadege@nlocale.fr or by post to JAK MOOH, NLocale editorial office, 4 rue Paul Doumer, 02000 Laon. Specify the right you wish to exercise, the data or account concerned, and a reply address. Proof of identity is requested only where there is reasonable doubt, and only strictly necessary information will then be required.

NLocale normally responds within one month. This period may be extended by two months if requests are complex or numerous; the individual is informed within the first month. In the event of disagreement, a complaint may be submitted to the CNIL.

NLocale applies measures proportionate to the risks: role-based access controls, authentication, encryption in transit, separation of environments, backups, logging, updates and data minimisation. No system provides absolute security, so measures are reassessed as the service develops.

A breach likely to result in a risk is reported to the competent authority within the statutory period and, where it presents a high risk, to the individuals concerned. Suspected incidents may be reported promptly to the contact address.

Local content is available to everyone. Business accounts, local authority mandates and subscriptions are reserved for legally capable and authorised individuals. Where a public-facing feature requires a minor's consent, NLocale applies the age and parental authorisation rules provided by French law.

This policy may change to reflect a new feature, provider or legal requirement. The version date appears at the top of the page and the date of consultation at the bottom. Any material change affecting an active account is brought to the user's attention through appropriate means before it takes effect where required.

Public MCP access covers information intended for publication. Attendee contacts, messages, individual bookings, dashboards and management exports are excluded. Public business contact details do not permit reuse for any purpose.

Private access processes account identity, organisation, permissions and mandate to authenticate the connection and deliver the requested service. Activity data, enquiries and registrations are shared with the selected assistant only within the authorised scope. Technical connection permission does not replace a legal basis for processing personal data. Processing on an organiser’s behalf requires an agreement covering instructions and duties under GDPR Article 28 before activation.

The connected assistant provider receives the data sent to it. Its purposes, retention, data use and any international transfers depend on the selected service and must be reviewed before connection. NLocale does not claim a third party excludes training or transfers without a verified commitment. Revocation ends new access; requests concerning third-party copies must also be addressed to that provider.

Security records contain account and connection identifiers, date, operation, scope and outcome; they are not intended to reproduce messages or attendee lists. The reference retention is 12 months, except for incidents, legal obligations or justified evidential retention. Business data and notifications follow the retention of their associated processing. Rights may be exercised at nadege@nlocale.fr and, for organiser or third-party assistant processing, with the relevant controller.