Privacy

Version of 2026-10-17. Dossiermap is designed to collect as little as possible: no name, no date of birth, no case number, no address.

Contact

For any question about your data: info@dossiermap.com.

Data collected

• Case report: procedure, département, office handling the case, step dates, outcome. Optional: permit type, how you applied, documents requested, region of origin (never the country).
• Tracking account (optional): your email address, used only for link-based sign-in and, if you turn it on, a monthly reminder.
• Technical: to limit abuse, your IP address is turned into a fingerprint with a key that changes every day, and deleted after 24 hours. It is never stored in clear.

Purposes and legal bases

• Computing and publishing aggregate processing times per office: your consent (GDPR Article 6(1)(a)), given by ticking the box on the form. The version of the accepted text is stored.
• Letting you track your case: performance of the service you request (Article 6(1)(b)).

What is published

Only statistics (medians, numbers of cases). No individual journey is published. The breakdown by region of origin is only shown from 10 cases upwards. Your exact dates are never published.

Retention

• Account inactive for 3 years: warning email, then deletion.
• IP fingerprints: 24 hours. Technical logs: 30 days.
• Case dates: as long as they are used for statistics, unless you delete them.

Your rights

From "My dossier" you can download your data (JSON) and delete your account: either delete everything, or delete the account and leave your dates, anonymised, in the statistics. You can also write to us at info@dossiermap.com to exercise your rights of access, rectification, erasure, objection and withdrawal of consent, and complain to the CNIL (cnil.fr).

The service is for people aged 15 and over.

Processors

• Supabase (database and sign-in, hosted in the European Union).
• Cloudflare (site hosting, Turnstile anti-bot check, cookieless analytics).
• Brevo (sign-in emails, European Union).

A data processing agreement (DPA) is signed with each. For providers established outside the European Union, transfers rely on standard contractual clauses or the EU–US Data Privacy Framework.

Cookies

No advertising or analytics cookies. Only local storage strictly needed for sign-in is used if you create an account.