Privacy policy.

lagrandecarte.fr is designed to work without needing to identify you. Most features — exploring the map, looking up parcels, rankings, the comparison tool — require no account at all.

Where collection is necessary (contacting us, submitting a report), we apply the principle of data minimisation required by the GDPR: we collect only what is strictly needed for the stated purpose.

When you browse lagrandecarte.fr or use its API, the following may be processed:

AI assistants (MCP server). When you connect an assistant such as Claude or ChatGPT, it only sends the parameters of the tool it calls — a municipality code, an address, coordinates — never your conversation. We receive neither your messages, nor your history, nor the name of your account with the assistant. Each call increments your account’s counter; its parameters are not kept. The assistant receives from us only the key created for it, never your email or your password.

We use no third-party audience measurement tools: no Google Analytics, no Matomo, no Plausible. Our technical statistics are computed from our server’s nginx logs and viewed internally in a self-hosted Grafana instance. None of this data leaves our infrastructure.

Logs are kept for 30 days for debugging and abuse detection, then deleted automatically. No individual identifier is built: we do not know, and do not seek to know, who visits which page.

lagrandecarte.fr sets no third-party cookies. No advertising cookies, no audience measurement cookies, no social media cookies. That is why you see no consent banner when you arrive — there is no reason for one.

Without an account, we use your browser’s local storage (localStorage) to remember your display preferences. This data never leaves your device.

If you pick a language in the language switcher, we set a preference cookie (lgc_lang, 1 year) that contains only the code of the chosen language (for example en). It is used to show you that language when you land on a page whose address does not specify one. It is set only as a result of your choice and is never used to track you.

If you create an account for the API, we set a session cookie (lgc_session, HttpOnly, 30 days) whose only purpose is to keep you signed in, and, for the duration of a Google sign-in, a 10-minute technical cookie that protects the exchange against forgery. Signing out deletes the session cookie.

These cookies are strictly functional: they are necessary for the service you request, or merely remember a choice you made. They are therefore exempt from consent (Article 82 of the French loi Informatique et Libertés, CNIL guidelines), which is why there is no banner.

Your data is never sold, never rented, never shared with third parties for commercial purposes. No advertising partnerships, no data brokers.

The only transfers to technical third parties are:

• Our hosting provider — to run the site.
• Stripe (Stripe Payments Europe Ltd, Ireland) — if you subscribe to a paid plan. Payment takes place on Stripe’s pages: your card number, name and billing address are processed by Stripe and never pass through our servers. In return we receive a customer ID, the plan and the subscription status. Stripe’s privacy policy.
• Google — only if you choose “Continue with Google”. Google sends us your verified email address and a technical identifier; Google then knows that you signed in to lagrandecarte.fr. We request no other access to your Google account.
• Our email delivery provider — to deliver service emails (address confirmation, password reset). It sees your address and the content of those emails, nothing else.
• IGN’s Géoplateforme — for address search (on the site, in the API and via MCP), the search text is sent to the public geocoding service of the Base Adresse Nationale, without any identifier relating to you.
• Public authorities — upon a court order, within the framework of French law.

None of these providers is permitted to use your data for its own purposes.

Retention periods are listed in the table in Article 2. When they expire, the data is permanently deleted or irreversibly anonymised.

Under the GDPR, you have the following rights at any time over the data we hold about you:

• Right of access — to know what data we hold about you.
• Right to rectification — to correct inaccurate information.
• Right to erasure — to request the deletion of your data.
• Right to object — to refuse a particular processing.
• Right to data portability — to obtain your data in a reusable format.
• Right to lodge a complaint with the CNIL (the French data protection authority) if you believe your rights have been infringed.

To exercise these rights, simply email contact@lagrandecarte.fr. We reply within 30 days at most.

If you have an account: you can revoke your keys and sign out from your account. To delete the account itself, write to us from the account’s email address; it is deleted within 30 days, together with its keys and counters. Invoices issued by Stripe are kept for as long as our accounting obligations require.

All communications with the site are encrypted (HTTPS, TLS 1.3). The site is hosted on dedicated servers located in Europe.

Passwords are hashed (scrypt) and are never stored or transmitted in plain text — we cannot read them, only reset them. API keys and session tokens are kept only as SHA-256 hashes. No payment data is stored on our side.

No system is infallible. In the event of a data breach affecting your personal information, we will inform you within 72 hours, in accordance with the GDPR.

This policy may be amended to reflect technical or regulatory changes. You will be notified of any substantial change. The version in force is always the one available at lagrandecarte.fr/privacy.

For any question about your personal data, write to us at contact@lagrandecarte.fr.

For general questions about using the site, see the terms of use.