Skip to content
FR Sign in Try without an account

General terms of use and sale of the while service

Version of November 1, 2026, effective as of that date.

This English version is a translation provided for information only. In the event of any discrepancy, the French version, published at https://while.sh/fr/conditions/2026-11-01/, prevails (Article 24.6).

Preamble

The while service is published and operated by NXT Initiative, a French simplified joint-stock company (société par actions simplifiée) with a share capital of €2,000, registered with the Paris Trade and Companies Register under number 818 451 114, whose registered office is at 106 rue de Patay, 75013 Paris, France, trading under the name “Nextmap” (hereinafter “Nextmap”). VAT number: FR17818451114. Telephone: +33 1 84 17 51 51. Email: hello@while.sh. Publication director: Grégoire Mougeolle, President.

These general terms of use and sale (hereinafter the “General Terms”) set out the conditions under which Nextmap provides the Service to the Customer, as well as the respective rights and obligations of the parties.

Article 1 – Definitions

The following terms, when capitalized, have the meaning set out below, whether used in the singular or the plural:

Article 2 – Scope and professional status

2.1. The Service is intended exclusively for professionals. It is offered neither to consumers nor to non-professionals within the meaning of the preliminary article of the French Consumer Code.

2.2. The person who accepts the General Terms, including for a Trial Without an Account, declares by this acceptance (i) that they are acting for purposes that fall within the scope of their commercial, industrial, craft, liberal or agricultural activity, or on behalf of a legal person acting for such purposes, and (ii) that they have the authority to bind the Customer. Nextmap enters into the Agreement in reliance on this declaration. Anyone who has made it inaccurately shall indemnify Nextmap against all consequences of that inaccuracy, and Nextmap may terminate the Agreement without notice or charge. A person who accepts the General Terms on behalf of a legal person without having the authority to do so is personally bound by the Customer’s obligations, unless the Customer ratifies the acceptance.

2.3. The Customer provides Nextmap with the information required for invoicing, including, where regulations so require, its SIREN number or its VAT identification number. Nextmap may at any time ask the Customer to prove its professional status. Failing such proof within fifteen (15) days, Nextmap may refuse, suspend or terminate access to the Service.

2.4. The Service is offered to Customers established in France and abroad, subject to Article 11.4.

2.5. The General Terms apply to the exclusion of any other document, including the Customer’s general terms of purchase, even if Nextmap was aware of them.

2.6. The Customer guarantees (se porte fort) that its Users comply with the General Terms.

Article 3 – Contractual documents

3.1. The Agreement consists of the following documents, listed in decreasing order of priority:

  1. any contract signed between Nextmap and the Customer, including under the Enterprise plan, which prevails over any other document;
  2. Annex 1 (Personal data processing agreement), with respect to the processing of personal data;
  3. these General Terms and their Annex 2 (Switching providers and exportable data);
  4. the Pricing in force.

In the event of any contradiction between these documents, the higher-ranking document prevails.

3.2. The Documentation, the while.sh website and marketing materials describe the Service as of their date of publication. In the event of any difference with the Agreement, the Agreement prevails.

3.3. The Agreement constitutes the entire agreement of the parties regarding its subject matter and supersedes any prior exchange or document.

Article 4 – Acceptance, electronic conclusion and evidence

4.1. The Customer accepts the General Terms:

  1. when creating an Account, by clicking the creation button, below which a link to the General Terms appears; this acceptance applies to every Organization opened from that Account;
  2. for an Organization opened by Nextmap or before the publication of the General Terms, by an email from its Owner accepting them;
  3. for the Trial Without an Account, by an Agent’s call to the tool that creates it, whose description presents the conditions of the trial and refers to the General Terms.

The Customer is bound by any acceptance given from an Account of its Organization or by means of its Access Credentials.

4.2. The General Terms are dated. They are permanently accessible on the while.sh website, prior to any acceptance, in a format that allows them to be stored and reproduced. For each acceptance, Nextmap keeps the accepted version and its date.

4.3. In accordance with Article 1127-3 of the French Civil Code, the parties, acting as professionals, agree to derogate from the provisions of items 1° to 5° of Article 1127-1 and from those of Article 1127-2 of that code.

4.4. Pursuant to Article 1356 of the French Civil Code, Nextmap’s computer records, including the logs, timestamps and histories of actions and acceptances, kept under reasonable security conditions, constitute proof between the parties unless proven otherwise.

Article 5 – Description and evolution of the Service

5.1. The Service enables the Customer, its Users and its Agents to deploy and run Apps, with the features offered by the Service at the time of their use, such as databases, storage, scheduled jobs, data sources, an Enterprise Sign-In, versions and previews.

5.2. Nextmap may at any time evolve, modify, limit or remove all or part of the features of the Service, in particular for reasons of security, capacity, cost or technical evolution. Where such a change removes a substantial feature used by the Customer, Nextmap endeavors to inform the Customer within a reasonable time.

5.3. Features presented as early access, beta or preview are provided as is, without any commitment from Nextmap, and may be discontinued at any time, without notice or compensation.

5.4. If Nextmap ceases to provide the Service as a whole, it informs the Customer within the period provided for in Article 20.3.

5.5. The Service works with third-party services chosen by the Customer, including its Agents and their providers, its identity providers, its code repositories and the services it connects as data sources. The Customer complies with the terms of these services. Nextmap does not control them and is not liable for them.

5.6. Apps, their databases and their object storage are hosted in France. The sub-processors listed in Appendix B of Annex 1 may process Customer Content in another Member State of the European Union.

5.7. The Customer acknowledges that it was able, prior to its commitment, to review the Documentation and the Pricing. It alone assesses, under its own responsibility, whether the Service is suited to its needs, before its commitment and throughout the Agreement. The Service is not a substitute for a security review of the Apps, for the copies of its data that the Customer must keep, or for the advice of a specialist. Recommendations made by the Service, the Documentation or the Service’s responses to Agents are general in nature, and the Customer alone decides whether to act on them.

Article 6 – Accounts, Organization and Users

6.1. The Customer provides accurate and complete information when creating its Account and keeps it up to date.

6.2. The Customer determines its Users and their rights. It is responsible for all the Users of its Organization, for the access links it shares and for the persons it lets access the Service through its Enterprise Sign-In.

6.3. The Customer ensures the confidentiality of its Access Credentials. Any action performed using the Access Credentials of its Organization is presumed to have been performed by the Customer, unless proven otherwise. The Customer informs Nextmap without delay, at abuse@while.sh, of any loss, disclosure or unauthorized use of its Access Credentials. Nextmap may at any time revoke an Access Credential that it considers compromised.

6.4. Opening several Accounts or Organizations in order to benefit several times from a trial, Credits or a limit of the Service is prohibited.

Article 7 – Agents

7.1. The Customer may connect Agents to the Service, with the rights it grants them. Agents are the Customer’s tools. Nextmap does not provide them, does not control them and is not liable for them.

7.2. Any action performed by an Agent using the Access Credentials of the Organization is deemed to have been performed by the Customer, including deployments, modifications and deletions, as well as the resulting consumption, which is borne by the Customer. The Customer is responsible for the instructions it gives its Agents, for the code and content they produce, and for its Agents’ compliance with the terms of their providers. Nextmap is liable for the consequences of an unauthorized use of the Customer’s Access Credentials only in the event of gross negligence or wilful misconduct on its part; this limitation does not apply where the compromise results from a breach of the security of Nextmap’s systems, liability for which is governed by Article 17. The activity log of the Service constitutes proof under the conditions of Article 4.4.

7.3. Certain decisions are reserved to a natural person within the Service, including the approval of a request, the entry of a secret or the acceptance of terms. The Customer ensures that they are made by an authorized person.

7.4. The approval rules, security scans, vulnerability monitoring and other protection mechanisms of the Service are tools made available to the Customer, which determines their configuration. They guarantee neither the absence of errors by an Agent or a User, nor the security of the deployed code.

7.5. The Customer may withdraw an Agent’s access at any time. Nextmap may limit, suspend or refuse the access of an Agent that threatens the security or the operation of the Service, or whose use breaches the Agreement.

Article 8 – Trial Without an Account

8.1. The Trial Without an Account makes it possible to evaluate the Service, for professional purposes, without creating an Account. It constitutes a non-production version of the Service, provided for testing and evaluation purposes and for a limited period of time.

8.2. The Trial Without an Account lasts for the time indicated when it is launched. At its end, the App concerned is stopped. The Customer Content related to the trial is permanently deleted twenty-four (24) hours after its end, unless a different period is indicated when it is launched, without further notice.

8.3. The Trial Without an Account is subject to the limits indicated by the Service. Nextmap may refuse a trial, limit the number of trials per person, per network or per country, restrict access to certain countries, and interrupt a trial at any time, without notice or compensation.

8.4. During the Trial Without an Account, the Customer uses only test data. It refrains from processing personal data of third parties, sensitive data or health data in it. The trial App may be used neither for production use nor for public use.

8.5. Keeping the Trial Without an Account beyond its end requires the creation of an Account under the conditions of Article 4.1, the trial then becoming an Organization subject to the general provisions of the Agreement.

8.6. In accordance with Article 31(2) and (3) of Regulation (EU) 2023/2854 (the “Data Act”), the Customer is informed, prior to the conclusion of the Agreement, that the obligations laid down in Chapter VI of that regulation do not apply to the Trial Without an Account. The same applies, for as long as they are in force, to the obligations of Articles 27 to 29 of French Law No. 2024-449 of May 21, 2024 to secure and regulate the digital space. Accordingly, no notice period, no transitional period and no data retrieval period apply to the Trial Without an Account.

8.7. The Trial Without an Account is provided as is, without any warranty. Nextmap’s liability in this respect is limited under the conditions of Article 17.3.

Article 9 – Credits and free offers

9.1. Nextmap may, at its sole discretion, grant Credits. Any free use of the Service constitutes a Credit. The conditions of Credits, including their amount, their purpose and their expiry date, are those indicated when they are granted.

9.2. Credits are attached to the Organization that receives them. They are non-transferable, non-refundable and have no monetary value. They expire on the date indicated when they are granted, and at the latest twelve (12) months after they are granted, renewals included. Their grant is not subject to any exclusivity condition.

9.3. Nextmap may withdraw Credits obtained by fraud, by opening several Accounts or in breach of the Agreement. It may modify or discontinue any free offer at any time, for the future.

Article 10 – Prices, invoicing and payment

10.1. The applicable prices are those of the Pricing in force at the time of consumption. They are expressed excluding taxes, with applicable taxes added at the rate in force. Where the Customer is established in another Member State of the European Union and identified for VAT purposes, VAT is self-assessed by the Customer under the reverse-charge mechanism.

10.2. The Service is invoiced according to the plan subscribed for the Organization and according to the consumption measured by the Service. The Customer monitors its consumption in the interface of the Service. Nextmap provides the Customer, upon request, with the method used to calculate the amounts invoiced.

10.3. Nextmap issues an electronic invoice every month. It may also invoice during the month when consumption exceeds a threshold, and require an advance payment or a guarantee where the risk of non-payment justifies it.

10.4. Where the interface of the Service so requires, the creation of an Account is subject to the registration of a valid payment card with Nextmap’s payment provider. Nextmap may verify its validity by means of a temporary authorization. Invoices are payable upon receipt, by charge to that card or, if no card is registered, by bank transfer. The Customer authorizes Nextmap to charge that card for all amounts due as soon as each invoice is issued, and undertakes to maintain a valid card throughout the term of the Agreement.

10.5. In accordance with Article L. 441-10 of the French Commercial Code, any amount not paid by its due date automatically bears, from the following day and without any reminder being necessary, late payment penalties calculated at the interest rate applied by the European Central Bank to its most recent refinancing operation, plus ten (10) percentage points. The Customer is also automatically liable for a fixed compensation for recovery costs of forty (40) euros, without prejudice to additional compensation upon proof.

10.6. In the event of a failed charge or of non-payment, Nextmap informs the Customer by email. Failing regularization within ten (10) days of this information, Nextmap may suspend the Organization, including the Apps, under the conditions of Article 13, and then terminate the Agreement under the conditions of Article 20.4. Costs resulting from a payment rejection or from an unjustified payment dispute are borne by the Customer.

10.7. Any dispute regarding an invoice must be sent in writing within thirty (30) days of its issue. Failing this, the invoice is deemed accepted, except for a material or calculation error established by the Customer. Amounts paid are non-refundable, except in the event of an invoicing error attributable to Nextmap or, for the portion paid in advance beyond the end of the Agreement, of termination by Nextmap without fault of the Customer.

10.8. Nextmap may modify the Pricing. Any increase is notified to the Customer by email thirty (30) days before it takes effect; a Customer who refuses it may terminate the Agreement free of charge before that date and export its data. Any decrease and any new plan apply as soon as they are published. A change in the Pricing applies only to consumption after it takes effect.

Article 11 – Use of the Service

11.1. The Customer uses the Service in accordance with the applicable laws and regulations and with the Agreement. It is solely responsible for the Customer Content, the Apps and their use.

11.2. The following are prohibited in particular:

11.3. Nextmap may limit the resources allocated to an Organization in order to preserve the operation of the Service and of its other customers.

11.4. The Service may not be used by or for the benefit of any person, entity or country subject to restrictive measures of the European Union or of France. The Customer declares that it is not subject to such measures.

11.5. The Customer, as publisher of its Apps, includes in them the information required by Article 1-1 of French Law No. 2004-575 of June 21, 2004, designating Nextmap as the hosting service provider.

Article 12 – Hosted content, notices and moderation

12.1. For Customer Content, Nextmap acts as a hosting service provider within the meaning of Regulation (EU) 2022/2065 (the “DSA”) and of Article 6 of French Law No. 2004-575 of June 21, 2004 on confidence in the digital economy. It is not subject to any general obligation to monitor such content.

12.2. Nextmap may analyze Customer Content by automated means, in particular to detect exposed secrets, known vulnerabilities or phishing pages. Certain analyses produce automatic effects, described in the Documentation, such as removing secret files from a build, holding a production deployment until an authorized person of the Organization approves it, rolling back to the previous version in the event of an abnormal error rate, or refusing a trial. The Customer may have a person on Nextmap’s team review a decision made by automated means, by simply sending a request to hello@while.sh.

12.3. Anyone may report content they consider unlawful to abuse@while.sh, stating in particular the exact electronic location of the content, the reasons why they consider it unlawful, their name and email address, except for child sexual abuse material, and a statement confirming their good faith. This address is also the single point of contact for authorities and for recipients of the Service within the meaning of Articles 11 and 12 of the DSA, and the point of contact provided for in Article 15 of Regulation (EU) 2021/784. Communications may be sent to it in French or in English.

12.4. When it becomes aware of content or an activity that is unlawful or contrary to the Agreement, Nextmap may remove that content or disable access to it, and suspend an App or the Organization. It notifies the Customer of its decision, unless the law or an authority prevents it, stating the measure, its scope and its duration, the facts relied on, any use of automated means, its legal or contractual basis, and the means of redress: a complaint in reply to the notification message, then an action before the courts.

12.5. Nextmap responds to requests from authorities under the conditions provided for by law. It retains, including after the deletion of the Organization or of the Trial Without an Account, the data it is required by law to retain, for the legal period.

Article 13 – Suspension

13.1. Nextmap may suspend an App, an Access Credential or the Organization, immediately and without notice:

13.2. In the event of any other breach of the Agreement, Nextmap may proceed with the suspension after a formal notice sent by email that has remained unheeded for forty-eight (48) hours.

13.3. The suspension applies primarily to the App or the Access Credential concerned, and extends to the Organization only if necessary. Nextmap notifies the Customer of it under the conditions of Article 12.4. Nextmap lifts the suspension when its cause has ceased.

13.4. In the event of a serious incident, Nextmap may suspend the builds and deployments of all customers, for the time necessary to restore the security of the Service.

13.5. Amounts due for a period of suspension attributable to the Customer remain payable.

Article 14 – Customer Content and personal data

14.1. The Customer retains all its rights in the Customer Content. It grants Nextmap, worldwide and for the term of the Agreement, extended by the periods provided for in Article 21, by the retention periods of backups and by the retention periods required by law, the non-exclusive right to host, reproduce and process it to the extent necessary for the provision of the Service, its security and compliance with Nextmap’s legal obligations.

14.2. Nextmap does not use Customer Content to train an artificial intelligence model and does not transfer it to any third party. It may produce, from the usage data of the Service, excluding the content of the Apps and of the databases, anonymized statistics in order to improve the Service.

14.3. For the personal data that the Customer entrusts to the Service, Nextmap acts as a processor, under the conditions of Annex 1. For Account, invoicing, Service security and prospecting data, Nextmap acts as a controller, under the conditions of its privacy policy.

Article 15 – Backups

15.1. The Service backs up the PostgreSQL databases it manages for the Customer, except those of the Trial Without an Account: one full backup per day. Each backup is kept for at least seven (7) days, in France. Caches, even those declared persistent, are not backed up.

15.2. Nextmap performs these backups and keeps them available to the Customer for their retention period. The integrity of each copy and the success of a restoration are subject to a best-efforts obligation. In the event of a loss of data from a database attributable to Nextmap, Nextmap first restores the latest available backup; any direct damage that remains is compensated within the limit of Article 17.3.

15.3. Items other than the databases backed up under Article 15.1, including code, files, object storage, caches, App disks and data held outside the Service, are the sole responsibility of the Customer, which keeps its own copies of them. The same applies to databases, prior to any operation that modifies them.

Article 16 – Availability and support

16.1. Nextmap provides the Service under a best-efforts obligation. It does not guarantee that the Service will be available without interruption, free of errors or suited to a particular use. It may interrupt it for maintenance operations, notifying the Customer where possible. No service level commitment applies, unless provided for in a signed contract.

16.2. Support is provided through the Documentation and by email at hello@while.sh, with no commitment as to response time.

Article 17 – Liability

17.1. Nextmap is liable only for direct damage. It is not liable for indirect damage, including loss of revenue, profit, customers or reputation, or business interruption. Nextmap is not liable for the loss or alteration of the items mentioned in Article 15.3. Nor is it liable for damage caused by the Customer, its Users, its Agents, the Customer Content, the third-party services chosen by the Customer mentioned in Article 5.5, a use of the Service that does not comply with the Agreement, or an event of force majeure.

17.2. The Customer acknowledges that the Pricing takes into account the allocation of risks and the limitations of liability provided for in this article, which are a decisive element of it.

17.3. Nextmap’s total liability under the Agreement, for all damages, whatever their number, duration and basis, including in respect of advice and recommendations provided by the Service, the Documentation or members of Nextmap’s team, is limited to the higher of the following two amounts: (i) the amounts excluding taxes actually paid by the Customer for the Service during the six (6) months preceding the first claim, or (ii) one hundred (100) euros. This limit also applies to the Trial Without an Account and to any free use of the Service.

17.4. The limitations of this article do not apply in the event of gross negligence or wilful misconduct, to personal injury, or where the law prohibits limiting liability.

17.5. The Customer shall indemnify and hold Nextmap harmless against any claim, action or demand by third parties relating to the Customer Content, the Apps, the Users, the Agents or a use of the Service that does not comply with the Agreement, and compensates Nextmap for all resulting consequences, including defense costs, except to the extent that the claim results from a breach of the Agreement by Nextmap.

17.6. Pursuant to Article 2254 of the French Civil Code, any action by one party against the other under the Agreement is time-barred one (1) year after the day on which its holder knew or should have known the facts enabling it to bring the action. This period does not apply to actions for payment of the amounts due under the Agreement.

Article 18 – Intellectual property

18.1. Nextmap is and remains the holder of all intellectual property rights in the Service. It grants the Customer, for the term of the Agreement, a personal, non-exclusive and non-transferable right to use the Service in accordance with the Agreement.

18.2. Suggestions and feedback sent to Nextmap by the Customer, its Users or its Agents may be freely used by Nextmap, without consideration.

18.3. The open source software components included in the Service remain subject to their own license.

18.4. Nextmap may mention the Customer’s name and logo as a commercial reference, unless the Customer objects by email to hello@while.sh.

Article 19 – Confidentiality

Each party undertakes to keep confidential the non-public information of the other party of which it becomes aware in connection with the Agreement, throughout its term and for two (2) years after it ends, except where required by law or by a decision of an authority. Customer Content remains confidential for as long as Nextmap holds it.

Article 20 – Term and termination

20.1. The Agreement is concluded for an indefinite term from its acceptance.

20.2. The Customer may terminate the Agreement at any time, from the interface of the Service where it allows it, or by email to hello@while.sh. Consumption up to the closure of the Organization remains due.

20.3. Nextmap may terminate the Agreement without cause, subject to thirty (30) days’ notice sent to the Customer by email. During this notice period, the Service, access and prices are maintained under the same conditions and the Customer may export its data; the retrieval period of Article 21.6 then begins.

20.4. Nextmap may terminate the Agreement without notice, by reasoned email: (i) in the event of unlawful content or activity, of fraud, or of a threat to the security of the Service attributable to the Customer, its Users, its Agents or its Apps; (ii) in the event of non-payment not regularized thirty (30) days after the suspension; (iii) in performance of a legal obligation or of a decision of an authority. In the event of a breach by the Customer of any of its obligations under Articles 2.2, 6, 7, 10, 11 or 14, the Agreement is automatically terminated forty-eight (48) hours after a formal notice that has remained unheeded, sent by email and referring to this article.

20.5. The end of the Agreement, for whatever reason, makes the amounts due immediately payable. Customer Content is returned and deleted under the conditions of Article 21.

20.6. The provisions of Articles 4.4, 6.3, 7.2, 10 for the amounts due, 12.5, 14, 17, 18, 19, 20.5, 21, 24.5 and 25, as well as Annex 1 for the processing that continues, survive the end of the Agreement.

Article 21 – Switching providers and return of data

21.1. This article implements Article 25 of the Data Act. It does not apply to the Trial Without an Account.

21.2. The Customer may, at any time and without notice, request to switch to another provider of data processing services, to port its exportable data and digital assets to an on-premises ICT infrastructure, or to have them erased. The request is made from the interface of the Service where it allows it, or by email to hello@while.sh.

21.3. From the request, a transitional period of no more than thirty (30) days begins, during which the Agreement remains applicable and Nextmap (i) provides reasonable assistance to the Customer and to the third parties it authorizes, (ii) acts with due care to maintain the continuity of the functions for which it is responsible, (iii) informs the Customer of the known risks to that continuity, and (iv) maintains a high level of security, including during the retrieval period. If this period is technically unfeasible, Nextmap informs the Customer within fourteen (14) working days of the request, giving reasons for this unfeasibility, and indicates an alternative transitional period, which may not exceed seven (7) months. The Customer may extend the transitional period once, for the period it considers appropriate.

21.4. Nextmap provides the Customer with the information useful for its exit strategy, described in Annex 2.

21.5. Exportable data and digital assets, as well as the data excluded from export, are exhaustively defined in Annex 2.

21.6. At the end of the transitional period or, where no switching request is made, from the end of the Agreement, the Customer has a period of at least thirty (30) days to retrieve its data. No exportable data is deleted before the end of this period, except for deletion requested or carried out by the Customer and excluding content removed pursuant to Article 12.4.

21.7. Upon expiry of this period, Nextmap permanently deletes all of the Customer’s exportable data and digital assets, backups included, subject to the data it is required by law to retain. Residual copies contained in the backups and in the technical histories of the Service are deleted upon expiry of their retention period, and at the latest forty-five (45) days afterwards. Nextmap confirms the deletion in writing upon the Customer’s request.

21.8. The Agreement ends, and Nextmap notifies the Customer: (i) when the switching is successfully completed; (ii) upon receipt of the request, where the Customer requests the deletion of its data without switching providers, the deletion taking place upon expiry of the retrieval period, unless immediate deletion is requested.

21.9. Switching providers and exporting data do not give rise to any switching charges or data egress charges. Only the consumption of the Service up to the end of the Agreement remains due.

21.10. Annex 2, published on the while.sh website with the General Terms and kept up to date, constitutes the register of the structures and formats of exportable data and of the export procedures, and indicates the jurisdictions to which the infrastructure of the Service is subject, as well as the measures taken against access by authorities of States outside the European Union.

Article 22 – Amendment of the General Terms

22.1. Nextmap may amend the General Terms to take account of changes in the Service, its costs, the law, case law or security requirements. It notifies the Customer of the new version by email thirty (30) days before it takes effect.

22.2. A Customer who refuses the new version may terminate the Agreement free of charge before it takes effect and export its data. Otherwise, continued use of the Service after that date constitutes acceptance of the new version.

22.3. An amendment required by law or by an authority, or strictly necessary to address an identified security threat, applies as soon as it is notified; the Customer may then terminate free of charge within the following thirty (30) days. An amendment that removes an obligation of the Customer or adds an obligation for Nextmap applies as soon as it is published.

Article 23 – Force majeure

23.1. Neither party is liable for a failure resulting from an event of force majeure within the meaning of Article 1218 of the French Civil Code.

23.2. The following may in particular constitute an event of force majeure, where they meet its conditions: the failure of an energy or telecommunications supplier external to Nextmap and to its subcontractors, a cyberattack of exceptional scale, a flood, an epidemic or a decision of an authority.

23.3. If the event of force majeure continues beyond thirty (30) days, either party may terminate the Agreement as of right, without compensation.

Article 24 – Miscellaneous

24.1. The Customer consents in advance to the assignment of the Agreement by Nextmap to any company of its group or to any acquirer of all or part of its business. The assignment takes effect upon its notification to the Customer by email and releases Nextmap for the future. The Customer may not assign the Agreement without Nextmap’s prior written consent.

24.2. Nextmap may subcontract all or part of the performance of the Agreement, subject to Annex 1.

24.3. A party’s failure to invoke a breach does not constitute a waiver of the right to invoke it later. The nullity of a provision does not affect the validity of the other provisions of the Agreement.

24.4. The parties are independent contractors.

24.5. Communications between the parties are made by email: to the Owner’s address for the Customer, and to hello@while.sh for Nextmap.

24.6. The General Terms are drafted in French. Any translation is provided for information only; in the event of any discrepancy, the French version prevails.

Article 25 – Governing law and jurisdiction

25.1. The Agreement is governed by French law.

25.2. WHERE THE CUSTOMER HAS CONTRACTED AS A MERCHANT (COMMERÇANT), OR IS ESTABLISHED IN ANOTHER MEMBER STATE OF THE EUROPEAN UNION, ANY DISPUTE RELATING TO THE FORMATION, INTERPRETATION, PERFORMANCE OR TERMINATION OF THE AGREEMENT FALLS WITHIN THE EXCLUSIVE JURISDICTION OF THE COURTS OF PARIS, INCLUDING IN SUMMARY PROCEEDINGS OR IN THE EVENT OF MULTIPLE DEFENDANTS. IN OTHER CASES, THE STATUTORY RULES OF JURISDICTION APPLY.

Annex 1 – Personal data processing agreement

This data processing agreement (the “DPA”) forms an integral part of the Agreement. Its purpose is to set out the conditions under which Nextmap processes personal data on behalf of the Customer, in accordance with Article 28 of Regulation (EU) 2016/679 (the “GDPR”). Capitalized terms have the meaning given to them in the General Terms.

Article 1 – Roles of the parties

1.1. For the personal data that the Customer, its Users or its Agents put into the Service, or that the Apps process by means of the Service, the Customer acts as controller and Nextmap as processor.

1.2. This DPA does not apply to the processing for which Nextmap is the controller, in particular the processing relating to Accounts, invoicing, the security of the Service and prospecting, which is governed by its privacy policy.

Article 2 – Description of the processing

Article 3 – Instructions of the Customer

3.1. Nextmap processes personal data on the documented instructions of the Customer. These instructions consist of the Agreement and of the settings and actions performed in the Service by the Customer, its Users and its Agents. They include the production, from the usage data of the Service, excluding the content of the Apps and of the databases, of anonymized statistics.

3.2. Nextmap immediately informs the Customer if, in its opinion, an instruction infringes the regulations applicable to data protection. The Customer remains solely responsible for the lawfulness of the processing it carries out.

3.3. Where European Union or Member State law requires Nextmap to process personal data, in particular at the request of an authority, Nextmap informs the Customer beforehand, unless that law prohibits it.

Article 4 – Confidentiality and security

4.1. The persons authorized by Nextmap to process personal data are bound by an obligation of confidentiality.

4.2. Nextmap implements the technical and organizational measures described in Appendix A. It may change them while maintaining a level of security appropriate to the risk, in accordance with Article 32 of the GDPR.

4.3. The Customer remains responsible for the security of the elements under its control, including its Access Credentials, its Agents, the code and configuration of the Apps, the rights it grants and the data it chooses to process in them.

Article 5 – Sub-processors

5.1. The Customer grants Nextmap a general authorization to engage the sub-processors listed in Appendix B, as well as any other sub-processor under the conditions of this article.

5.2. Nextmap informs the Customer by email, at least fifteen (15) days in advance, of any addition or replacement of a sub-processor. The Customer may object before the expiry of this period, on legitimate grounds relating to the protection of personal data. If Nextmap maintains its choice, the Customer may terminate the Agreement free of charge, this option being its sole remedy.

5.3. Nextmap imposes on each sub-processor, by contract, data protection obligations equivalent to those of this DPA.

Article 6 – Location and transfers

Personal data is hosted in France. The sub-processors listed in Appendix B may process it in another Member State of the European Union. Nextmap transfers it outside the European Union only in compliance with Chapter V of the GDPR, after informing the Customer under the conditions of Article 5.

Article 7 – Assistance to the Customer

7.1. To respond to requests from data subjects exercising their rights, the Customer uses the features of the Service, which allow it to consult, export, rectify and erase the data. Nextmap forwards to the Customer, without acting on it, any such request that it receives directly.

7.2. For the security of processing, data protection impact assessments and the prior consultation of the supervisory authority, Nextmap makes available to the Customer the information it has about the Service, in particular that of Appendix A.

7.3. Where the features of the Service do not allow the Customer to respond to a request, in particular for runtime logs or backups, Nextmap assists the Customer to the extent possible. This assistance, which does not constitute a personal data protection consulting service, is invoiced on a time-spent basis.

Article 8 – Personal data breaches

8.1. Nextmap notifies the Customer of any personal data breach without undue delay after becoming aware of it, by email to the Owner.

8.2. The notification describes, to the extent known to Nextmap, the nature of the breach, the categories and approximate number of data subjects and records concerned, its likely consequences and the measures taken or proposed. This information may be provided in phases.

8.3. It is for the Customer, as controller, to notify the breach to the supervisory authority and, where applicable, to the data subjects.

Article 9 – Data at the end of the Agreement

At the end of the Agreement, the Customer retrieves its data under the conditions of Article 21 of the General Terms. Nextmap then deletes it, backups included, under the conditions of Article 21.7 of the General Terms, unless legally required to retain it, and confirms this deletion in writing upon the Customer’s request.

Article 10 – Audits

10.1. Nextmap makes available to the Customer the information necessary to demonstrate compliance with this DPA, primarily in written form, in particular through its documentation and its answers to a reasonable questionnaire.

10.2. If this information is not sufficient, the Customer may carry out, or have carried out by an independent auditor that it appoints, who is bound by professional secrecy or by a confidentiality obligation and who is not a competitor of Nextmap, an audit, including an inspection, at its own expense, no more than once a year, except at the request of a supervisory authority or in the event of a data breach concerning the Customer, and subject to thirty (30) days’ prior written notice. The audit takes place during business hours, without disrupting the Service and without access to the data of other customers. The time spent by Nextmap on the audit is invoiced to the Customer.

Article 11 – Liability

Nextmap’s liability under this DPA, including for its sub-processors, is subject to the limitations of Article 17 of the General Terms. The liability of the Customer is not limited.

Appendix A – Technical and organizational measures

As of the date of this version, the main measures are as follows:

Appendix B – Sub-processors

Sub-processorServicesLocation
OVH SAS (OVHcloud), 2 rue Kellermann, 59100 Roubaix, Franceinfrastructure services: storage, backups and builds of the AppsEuropean Union

Annex 2 – Switching providers and exportable data

This annex forms an integral part of the Agreement. It details Article 21 of the General Terms and constitutes, for as long as that provision is in force, Nextmap’s reference technical interoperability offer within the meaning of Article 29 of French Law No. 2024-449 of May 21, 2024. It does not apply to the Trial Without an Account.

1. Exportable data and digital assets

The following list is exhaustive. It includes all exportable data within the meaning of Article 2, point 38, of the Data Act.

Data and assetsFormat
Source code of the Appsarchive of the live version and of the versions from the last seven (7) days; git repository for code pushed via git
PostgreSQL databasesfull logical backup (pg_dump custom format); query result as CSV, within the limits indicated by the Service
Object storageobjects in their original form
Configuration of the Apps and scheduled jobswhile.yaml file; environment variables
Secrets entered by the Customerentered values
Data source keysentered values
Activity logsigned chain (JSONL), verifiable offline
Members, roles, rules, groups, domains, Enterprise Sign-In and its users, data sources without their secrets, consumptionJSON
Runtime logs, metrics and traces of the Appstext or JSON, for their retention period
Security scan resultsJSON; component inventory in CycloneDX format

The Customer exports this data through the API or the MCP server of the Service, described in the Documentation, where applicable through its Agents. Any exportable data that these means do not allow to be exported in full, in particular a database that exceeds the limits of CSV extraction, the content of an object storage bucket or the data source keys, is provided by Nextmap to the Customer who requests it during the transitional period or the retrieval period, free of charge, by secure means.

2. Data excluded from export

The following are excluded from export, as they relate to the internal functioning of the Service or to Nextmap’s trade secrets: Nextmap’s software, configurations and tools; the detection and security analysis rules and their internal results; the internal logs of the platform that are not specific to the Organization; the data that Nextmap retains under a legal obligation; the data of other customers; the container images produced by the Service, which incorporate its build tools and can be rebuilt from the exported code and while.yaml file. These exclusions neither impede nor delay switching.

3. Procedure

  1. The Customer makes its request from the interface of the Service where it allows it, or by email to hello@while.sh.
  2. During the transitional period provided for in Article 21.3 of the General Terms, the Customer exports its data by the means indicated in section 1.
  3. At the end of the transitional period, the Customer has the retrieval period provided for in Article 21.6.
  4. Nextmap then carries out the deletion provided for in Article 21.7.

4. Known limitations

The features specific to the Service, including approval rules, Enterprise Sign-In, data sources whose keys are kept by the Service and access links, cannot be transposed as they are to another provider and must be recreated there.

5. Location of the infrastructure and access by authorities

Apps, their databases, their object storage and the backups of those databases are hosted in France. The infrastructure of the Service is located in the European Union, operated by Nextmap and by sub-processors established there, and is subject to the law of the European Union and of its Member States. Nextmap complies with a request for access from an authority of a State outside the European Union only if European Union law or French law requires it to do so, and informs the Customer, unless prohibited by law.