Legal notices

The site https://croustillant.menu is the official site of CROUStillant, a free and open-source project for browsing the menus of university restaurants in France and its overseas territories.

CROUStillant is an independent project: it is not affiliated with the CROUS, the Cnous or any public body.

The information shown on the site is provided for guidance only and has no contractual value.

The site is published by Paul Bayfield, a private individual acting in a non-professional capacity, on behalf of CROUStillant Développement.

CROUStillant Développement is a group of volunteers. It is neither a registered association nor a company, and has no legal personality.

Publication director: Paul Bayfield.

Contact: [email protected]

The site is designed and developed by the volunteers of CROUStillant Développement and by the contributors to the open-source project, who are listed on GitHub.

The site was designed to be simple, intuitive and accessible to all.

The site is hosted on servers administered by Paul Bayfield, located in France (Paris and Lille).

Traffic passes through the network of Cloudflare, Inc. (101 Townsend Street, San Francisco, CA 94107, United States), which delivers and protects the site.

The site's source code is published under the Apache 2.0 licence and available on GitHub.

Restaurant and menu data comes from the CROUS. The names, trademarks and logos of the CROUS remain the property of their owners.

Menus, opening hours and practical information are shown as published by the CROUS and may be changed by the restaurants without notice. If in doubt, particularly if you have an allergy or a specific diet, check directly with the restaurant.

CROUStillant Développement cannot be held liable for inaccuracies, or for damage resulting from the use of the site or its unavailability.

The site is governed by French law.

The data controller is Paul Bayfield, for CROUStillant Développement. For any question: [email protected]

The site works without accounts, forms or advertising. Your data is never sold, rented or used for profiling.

Audience measurement: we use Umami, a tool hosted on our own servers, which sets no cookies and does not track you across sites. It records the pages viewed, where the visit came from, the device type, browser, operating system, language and country, as well as some actions (a click on a button, for example). Your IP address is not kept by this tool.

Technical logs: requests sent to our API are recorded with their date, the address requested, the technical headers sent by your browser (including the IP address and User-Agent) and a hashed fingerprint of the IP address.

No other personal data is collected.

This data is used to detect and block abuse, to keep the service secure and available, and to understand how it is used in order to improve it.

This processing is based on our legitimate interest (Article 6(1)(f) GDPR) in securing the service and measuring its audience.

Technical logs are kept for three months on the main database, then archived on a remote database, also located in France.

All data is stored in France (Paris and Lille). Only the team members who administer the service have access to it.

Cloudflare, which routes and protects traffic, processes your IP address and technical connection data. This processing may involve a transfer outside the European Union, governed by standard contractual clauses and the Data Privacy Framework.

When you display a map, your browser downloads the map tiles directly from CARTO and OpenStreetMap, which then receive your IP address.

Links to external services (Google Maps, Marmiton, online calendars…) send no data until you click on them.

You have the right to access, rectify, erase, restrict and object to the processing of data concerning you.

To exercise these rights, write to [email protected]. As the site works without accounts, we may ask you for details that let us find your data (the IP address and period concerned, for example).

If you believe your rights are not being respected, you can lodge a complaint with the CNIL (www.cnil.fr).

Exchanges with the site are encrypted (HTTPS), the main database is backed up every day and access to the servers is limited to their administrator, Paul Bayfield.

In the event of a data breach posing a risk to your rights and freedoms, the CNIL is informed within 72 hours.

The site sets no advertising or tracking cookies. That is why you are not shown a consent banner.

A single cookie may be set: NEXT_LOCALE, which remembers the language you chose when you switch. It is deleted when you close your browser.

Your preferences (theme, favourite restaurants, followed dishes, favourite region, display and accessibility options), the dish notifications already sent and the banners you have dismissed are saved in your browser's local storage. This information stays on your device.

You can clear it from the site's Settings page, or by deleting the site's data in your browser.

The search for restaurants near you only uses your position if you allow it in your browser.

The calculation is done on your device: your position is neither sent to our servers nor stored.

By accessing the site, you agree to these terms of use.

If you do not agree to them, please do not use the site.

The terms of use may be changed at any time. The date of the last update is shown at the top of this page.

Continuing to browse the site after a change means you accept the new terms.

The site is free and intended for browsing. Automated extraction of its content (scraping) and large-scale automated access are not permitted and may be blocked.

A public API is provided instead: use it to reuse the data in your own project, in accordance with its terms of use.

The source code may be reused under the terms of the Apache 2.0 licence.

No page may be presented as originating from this site if its meaning has been altered.

The site contains links to other sites.

CROUStillant Développement is not responsible for the content of those sites, or for any damage resulting from their use.