Privacy policy
Version of 20 October 2026. This translation is provided for convenience; the French version prevails. This page explains what data Nuitées processes, why, for how long, and your rights under the EU General Data Protection Regulation (GDPR).
Who is responsible
The data controller is the publisher of the service, named in the legal notice. To get in touch, see the Contact page.
What data, and why
| Data | Purpose | Kept for |
|---|---|---|
| Account: email, name, password (hashed) | Identifying you and writing to you (confirmations, deadline reminders, password resets) | As long as the account exists |
| Login for your host area on the council's tourist-tax portal (password encrypted) | Reading your past returns and filling in new ones, at your request | Until the property is deleted |
| Uploaded export files and the stays extracted from them (dates, guests, amounts, platform, reference) | Calculating and preparing your returns | Until the property is deleted |
| Robot log and screenshots, nights register, portal receipts | Proving what was declared | Until the property is deleted |
| Payments (amount, date, Stripe reference) | Invoicing | 10 years (accounting obligation) |
What we don't do
Nuitées never logs in to your Airbnb or Booking accounts or your property-management software: you upload your files yourself. We never sell or share any data. No advertising cookies and no third-party analytics: only technical cookies for your session and your language.
Processors
- Stripe (payments): your card details never pass through our servers.
- Brevo (sending emails): your email address and the content of the messages.
- OpenAI (recognising the columns of an unfamiliar file format): only the header row and three sample rows of the file, for the time it takes to suggest a match; under OpenAI's API terms, nothing is kept to train their models.
- Server host: named in the legal notice, with servers in the European Union.
Your rights
Access, correction, erasure, portability, restriction and objection: just email us from your account address. You can also delete a property or your whole account yourself in the app, which erases the related data. If you believe your rights are not being respected, you can complain to the CNIL, the French data protection authority (cnil.fr).
Security
Encrypted connections (HTTPS), hashed passwords, portal logins encrypted (AES-256-GCM) with a key kept separate from the database, and access restricted to the publisher.