Privacy policy
This page explains which personal data the scopemy.city service processes, why, for how long, with which service providers, and how to exercise your rights. It is based on the Federal Act on Data Protection (FADP) and, where it applies, on the European Union's General Data Protection Regulation (GDPR).
In brief
- We process what is necessary to receive, moderate, publish and forward your reports.
- Reports are published without your name or your number.
- No advertising and no sale of data. An in-house audience measurement, without cookies and without recording your IP address (section 7).
- Only two cookies: the login session and the language choice. The embeddable widget and the API set none.
- Maps and geocoding come from swisstopo, in Switzerland. Some service providers process data outside Switzerland, in particular Meta (WhatsApp) and Resend (e-mails) in the United States. If you do not wish to use WhatsApp, you can report from the website, without an account.
- Published reports are also made available as open data (CC BY 4.0 licence), without any data that identifies you.
- To access, correct or delete your data: contact@scopemy.city.
1. Who is responsible
For the scopemy.city citizen observatory, the controller is:
Help4Housing Sàrl
Route de Thonon 119a, 1222 Vésenaz, Switzerland
UID: CHE-421.813.985
Contact: contact@scopemy.city
On an instance provided to a public authority (municipality, canton, grouping of municipalities, property management agency, campus), the public authority is the controller. We then act as its processor, under a data processing agreement, and we process the data only on its instructions. The public authority's privacy policy, displayed on the instance, prevails. We forward to the public authority any requests that concern it.
We do not have a representative in the European Union within the meaning of Art. 27 GDPR.
2. Data processed
2.1 Reporting via WhatsApp
- your WhatsApp number and the profile name that WhatsApp transmits to us;
- the photo or photos, the description, the location (shared position or entered address), the chosen category;
- the date and time of the messages, your language, the state of the ongoing conversation;
- if you send a voice note instead of a description: the audio file. It is kept in private storage, is never published and is listened to only by the moderation team, who write the description from it. It is not transcribed automatically: transcription is switched off, and no recording leaves our server;
- a record that the information about your data was given to you with your first message: a fingerprint of your number (the number itself is not stored there), the language, the version of the text and the date;
- any request you make to stop messages (STOP).
2.2 Reporting from the website and user account
- e-mail address, name or pseudonym, password (stored in hashed form, never in plain text);
- telephone number if you provide it;
- your reports, confirmations, votes, notification preferences;
- temporary verification and reset tokens and codes;
- without an account: the e-mail address entered to confirm the report and receive updates, and the IP address of the submission, deleted upon confirmation (an unconfirmed report is deleted after 48 hours);
- by e-mail or SMS, where the local authority offers these channels: the sending address or number and the content of the message;
- if you turn on notifications on a device: the subscription address provided by your browser and its encryption keys;
- your optional opinion on how a report was resolved (rating and comment), used for satisfaction statistics;
- if you press "Me too" without an account: a fingerprint valid for a single day and specific to that report, calculated from your IP address and your browser with the daily key of the audience measurement (section 7). Your IP address is not stored;
- if you subscribe to an area (a radius around an address, or a street): your e-mail address, the area and the language. The subscription only starts once you have confirmed it through the link you receive; you then receive, at most once a week, the published and resolved reports of the area;
- the details requested by the form: subcategory, fields specific to the public authority (for example the number of a street light) and, for a thank-you, the service being thanked;
- the origin of the report: the channel used and, if you scanned a QR sticker, the code of that sticker, which identifies a place and not a person;
- if you prepare a report while offline: the draft (text, location, photos, e-mail address) stays in your browser, on your device, until it is sent (section 7);
- if you reopen a resolved report ("Not really resolved?"): the reason and, if you attach one, a photo, which remains private.
2.3 Contact form
Name, e-mail address, message, language, date and IP address of submission.
2.4 Technical data
- IP address, date, requested page and browser type, in the server logs;
- IP address and identifier used to limit abuse (number of login attempts or messages);
- the cookies described in section 7;
- for audience measurement, an anonymous fingerprint valid for a single day, the key page viewed and the step reached in the reporting form (section 7);
- the website's technical error reports (error message, page concerned without parameters), without request body, cookie or header, with e-mail addresses and numbers masked.
2.5 Photos
Photos may show third parties or contain metadata (date, device model, sometimes location). Each photo is re-encoded on receipt, which removes its metadata. Until it is published, it is kept outside the public part of the website. Before publication, we blur or reject photos that make it possible to identify a person or a number plate.
We use neither Google Analytics, nor advertising pixels, nor any third-party measurement tool, and do not build any profile. The in-house audience measurement described in section 7 sets no cookie and does not record your IP address.
2.6 Public authorities, staff and appointed contractors
- request for a demonstration or a free trial, preparation of a quote: name, position, public authority, professional e-mail address, telephone number if you provide it, proposed time slots, language, and a fingerprint of the sending IP address to limit abuse;
- newsletter for public authorities: your e-mail address, subscribed only once you have confirmed it through the link you receive;
- accounts of the staff and administrators of a public authority: name, e-mail address, role, service they belong to and two-factor authentication secret;
- if the public authority turns on single sign-on (OpenID Connect): the identifier that its identity provider transmits to us, the e-mail address and the name. We do not receive the password;
- audit log: administration actions (author, action, object, date, IP address), which the administrators of the public authority concerned can consult;
- contractor appointed by a service: it accesses a single report through a personal link that is time-limited and revocable, without an account. It sees the report without the contact details of its author; its comments and photos remain internal, and each of its actions is logged.
3. Purposes and legal bases
Under Swiss law, we process your data in compliance with the principles of the FADP (lawfulness, good faith, proportionality, recognisable purpose). For data subjects covered by the GDPR, the legal bases are as follows:
| Purpose | Data | Legal basis (GDPR) |
|---|---|---|
| Receiving, moderating and publishing a report | Photo, description, location, category, date, number or account | Performance of the requested service (Art. 6(1)(b)) |
| Forwarding the report to the competent public service | Photo, description, location, category. Never your number or your e-mail without your consent | Legitimate interest in having the problem dealt with (point (f)); on a public authority instance: the public authority's task (point (e)) |
| Keeping you informed of progress (WhatsApp, e-mail) | Number, e-mail, language | Performance of the service (point (b)) |
| Managing your account | E-mail, name, hashed password, activity | Performance of the service (point (b)) |
| Weekly summary by e-mail | E-mail, preferences | Consent, which may be withdrawn at any time (point (a)) |
| Notifications on your device | Browser subscription address, encryption keys, followed reports | Consent, which may be withdrawn at any time from the report page or the browser (point (a)) |
| Satisfaction survey and reopening of a report | Rating, comment, reason, optional photo | Legitimate interest in measuring and improving the quality of handling (point (f)) |
| Publishing open data and serving it through the API and the widget | Public content of reports, without the author's identity | Legitimate interest in transparency (point (f)); on a public authority instance: the public authority's task (point (e)) |
| Asking you, once only, whether a report that has stayed open for 30 days is still relevant | Verified e-mail address or WhatsApp number, report reference | Legitimate interest in keeping reports up to date (point (f)) |
| Sending you the news of an area you have subscribed to | E-mail, area, language | Consent, which can be withdrawn through the unsubscribe link in each e-mail (point (a)) |
| Counting the "Me too" supports given without an account | Fingerprint of the day, specific to the report | Legitimate interest in counting only one support per person per day (point (f)) |
| Replying to a request for a demonstration, a free trial or a quote | Name, position, public authority, e-mail, telephone | Pre-contractual measures (point (b)) |
| Sending the newsletter to public authorities | Consent, which can be withdrawn through the unsubscribe link in each issue (point (a)) | |
| Keeping the audit log and the record of the information given on WhatsApp | Administration actions; fingerprint of the number, version of the text, date | Legitimate interest in security and evidence (point (f)) |
| Replying to a contact message | Name, e-mail, message | Legitimate interest (point (f)) or pre-contractual measures (point (b)) |
| Preventing abuse, securing the service, correcting errors, responding to a complaint | IP, number, moderation logs, error reports | Legitimate interest (point (f)) |
| Measuring the website's audience and the effectiveness of the reporting form | Anonymous daily fingerprint (computed from the IP address and browser, which are not kept), key page, form step | Legitimate interest in improving the service (point (f)) |
| Producing aggregated statistics on the public space | Category, date, area, status, without identifying data | Legitimate interest (point (f)) |
| Complying with a legal obligation or responding to an authority | Depending on the request | Legal obligation (point (c)) |
No decision producing legal effects concerning you is taken on a fully automated basis: the WhatsApp program guides you, but the category is chosen by you and publication is decided by a person.
4. Recipients and processors
- The public: published reports (photo, description, location, category, status) are visible to everyone, without your name or your number.
- The competent public services: they receive the content of the report, without your contact details unless you consent. On the instance of a client public authority, its staff handle the report in the services portal; their internal notes, attachments and e-mail exchanges are never published, and are erased or emptied when the report is deleted or anonymised.
- The moderation team: access limited to the people who need it, according to their role.
- Our processors, which process data on our behalf:
| Service provider | Role | Location |
|---|---|---|
| Tizoo SA (AlpHosting) | Hosting of the website, the database and the photos; back-up e-mail delivery | Switzerland |
| Meta Platforms Ireland Ltd. and Meta Platforms, Inc. (WhatsApp Business Platform) | Routing of WhatsApp messages | Ireland, United States and other countries |
| Resend (Plus Five Five, Inc.) | Sending of service e-mails (verification, notifications, summary) | United States (account data and logs); sending possible from the EU |
| Federal Office of Topography swisstopo (Swiss Confederation) | Base maps (tiles) and geocoding of addresses in Switzerland, without account or cookie | Switzerland |
| OpenStreetMap Foundation | Fallback geocoding (Nominatim), outside Switzerland or during a swisstopo outage. No map tiles any more | United Kingdom |
| Institut national de l'information géographique et forestière (IGN), Géoplateforme | Geocoding of addresses with the Base Adresse Nationale, only for a public authority located in France, without account or cookie | France |
| MapTiler AG, or Stadia Maps, Inc. | Base maps for an instance outside Switzerland, only if it is configured that way | Switzerland (MapTiler), United States (Stadia Maps) |
| CARTO | Base maps for reports reserved for administrators | Depending on the provider's content delivery network |
| Mailgun Technologies, Inc. (EU region) | Receiving inbound e-mails: the services' e-mail replies and, where this channel is activated, reports sent by e-mail | European Union (US company) |
| Postmark (ActiveCampaign, LLC) | Option: receiving reports sent by e-mail, instead of Mailgun | United States |
| Twilio Inc., or ASPSMS (VADIAN.NET AG) | Receiving and sending SMS, only where this channel is activated | United States (Twilio), Switzerland (ASPSMS) |
| Browser notification services (Google, Mozilla, Apple, Microsoft) | Delivery of notifications, received in encrypted form, only if you turn them on | United States and other countries |
| Sentry (Functional Software, Inc., EU region) or GlitchTip | Collection of technical error reports, without personal data, only if this service is configured | European Union |
Meta's role. For the transmission of messages between you and our business account, Meta acts as our processor. Meta also processes, as a separate controller, the data relating to your WhatsApp account and your use of its application, in accordance with its own privacy policy. We have no control over that processing.
Mapping and geocoding. When the map is displayed, your browser downloads the base maps from swisstopo (Federal Office of Topography, in Switzerland), which receives your IP address and the area viewed. On the instance of a public authority located outside Switzerland, this provider may be MapTiler or Stadia Maps. To convert an address into a position or vice versa, our server queries swisstopo, and as a fallback the OpenStreetMap Foundation's Nominatim service: these services receive the address or coordinates searched for, never your IP address, name or number. Your browser does not query any geocoding service itself. For a public authority located in France, our server first queries the Base Adresse Nationale (the geocoding service of the IGN Géoplateforme), under the same conditions. The boundaries of French municipalities come from the French State's API Géo: they are downloaded in advance, and no personal data is transmitted.
Notifications and other channels. Notifications on your device are end-to-end encrypted and delivered by your browser vendor's notification service (Google, Mozilla, Apple or Microsoft), which cannot read their content. Where the local authority offers them, reports by e-mail and SMS are received by an inbound e-mail provider (Mailgun, in the EU region, or Postmark) or an SMS operator (Twilio or ASPSMS). These channels remain disabled until they are configured.
Open data, API and widget. Published reports are made available under the CC BY 4.0 licence on the Open data page (CSV and GeoJSON files), through the API and through the widget that public authorities embed in their websites. Only public fields are disseminated: reference, link, title, category, status, description, address and coordinates of the problem, number of votes and confirmations, official response, responsible service, public authority, dates, and in the API the address of the published photo. Your name, your e-mail, your number and your IP address never appear in them. An anonymised report (section 6) only appears in them in statistical form.
The up-to-date list is published on the Processors page. We do not sell your data and do not share it for advertising purposes. We may be required to disclose it to a judicial or administrative authority that legally demands it.
5. Transfers outside Switzerland
The application's data is stored in Switzerland. Some service providers process it elsewhere:
- European Union and United Kingdom: the Federal Council recognises that these countries provide an adequate level of protection. Mailgun processes inbound e-mails in its EU region; as a US company, it remains subject to US law.
- United States (Meta, Resend and, where these options are activated, Postmark, Twilio and Stadia Maps): the transfer is based on the Swiss-U.S. Data Privacy Framework where the provider is certified under it, and failing that on the standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC). The US authorities may, in certain cases, access this data.
- Notifications: browser notification services may be located in the United States or elsewhere; they only receive encrypted content that they cannot read, and your device's subscription address.
6. Retention periods
| Data | Period |
|---|---|
| Published report (photo, description, location, category, status) | Visible for as long as it is useful for follow-up, then 5 years after it is closed (resolved or rejected): photos, description, address, title and confirmations are erased, and the location is rounded to the neighbourhood (about 100 m). The category, dates, public authority and status remain. |
| Link between a report and your number or your account | 2 years after the report is closed, then the link is deleted. |
| Rejected report | 6 months after the decision (appeal period), then deletion together with its photos, unless a challenge is pending. |
| Report submitted without an account and never confirmed | 48 hours, photos included. |
| Unfinished WhatsApp conversation | 30 days, then deletion, photo included. |
| Voice note sent by WhatsApp | Deleted together with what carries it: the unfinished conversation (30 days), the rejected report (6 months) or the anonymisation of the report (5 years). Deleted immediately if you cancel the report. |
| Record of the information given on WhatsApp (fingerprint of the number) | 5 years. |
| "Me too" support without an account | The support remains counted. Its fingerprint can no longer be linked to a visitor from the following night, when the daily key is deleted. |
| Area subscription | Until you unsubscribe (one click in each e-mail); 7 days for an unconfirmed request. |
| 30-day reminder | A single message per report; the reply links are valid for 30 days. |
| Offline draft | On your device only: 7 days for a draft, 14 days for a pending submission; deleted as soon as the report is accepted. |
| Demonstration request | 24 months after it is closed. |
| Free trial | Unconfirmed request: link valid for 48 hours, deletion after 30 days. Trial space: read-only at the end of the trial (30 days), then deleted with its data 60 days later, unless it is converted into a subscription. |
| Newsletter | Until you unsubscribe; 14 days for an unconfirmed subscription. |
| Link of an appointed contractor | 7 days by default, 30 days at most; revocable at any time. |
| Audit log | Kept for as long as the public authority uses the service; no automatic deletion is in place to date. |
| User account | Until it is deleted by you or on request. |
| Notification subscription | Until you turn it off, or your browser invalidates it. |
| Audience measurement | Detailed events and the daily key: until the end of the day. After that, only daily totals are kept, without any fingerprint. |
| Contact messages | 3 years after the last exchange, in our mailbox. |
| Application logs and error reports | Replaced on a rolling basis: each log is limited in size and only the last five files are kept. E-mail addresses and numbers are masked in them. |
| Server access logs | According to the period set by the hosting provider, 12 months at most. |
| Abuse limitation data | A few hours. |
| Back-ups | When the back-up system is in service: 30 days on the server and 90 days on the off-site copy, encrypted. Deleted data disappears from back-ups at the end of this cycle. |
On a public authority instance, the periods are set by the public authority, in compliance with the law applicable to it (for example the cantonal archiving legislation). Until other periods have been agreed with it, the periods above apply. In its administration area, the public authority can set three periods, within limits fixed by the platform: anonymisation (1 to 10 years after closure), deletion of the link with your account or number (3 months to 5 years) and deletion of a rejected report (1 to 12 months).
7. Cookies and local storage
| Name | Purpose | Duration |
|---|---|---|
PHPSESSID | Session: keeping you logged in and protecting forms against cross-site request forgery. Set only when you sign in or display a form, not during simple browsing | Up to 30 days |
scopemy_lang | Remembering the language you have chosen | 1 year |
These two cookies are strictly necessary for the website to function and are not used for any tracking. They therefore do not require consent. The widget embedded in a public authority's website and the API neither set nor read any cookie. The web application may also keep a copy of the pages viewed in your browser's cache in order to work offline. You can delete cookies and the cache from your browser settings. The offline mode of the report form keeps your draft (text, location, photos, e-mail address) in your browser's storage, on your device: nothing reaches us before it is sent, and the draft is deleted as soon as the report is accepted.
Audience measurement
To find out which pages are useful and where the reporting form is abandoned, the website counts visits to the main pages (home, report pages, form, information pages) and the steps of the form (opened, photo added, location chosen, sent, confirmation). We carry out this measurement ourselves, on our server in Switzerland:
- no cookie and no storage in your browser;
- your IP address and browser type are only used to compute a fingerprint (hash) computed with a key drawn at random every day; neither the IP address nor the browser type is recorded;
- the daily key is deleted every night together with the detailed events: only daily totals remain, and a visitor can no longer be recognised from one day to the next;
- if your browser sends the “Do Not Track” or “Global Privacy Control” signal, nothing is counted.
On a public authority's instance, the authority may choose to switch the measurement off, or to hand it over to its own self-hosted Matomo: events are then forwarded by our server, without your IP address and without cookies.
8. Security
We take technical and organisational measures appropriate to the risks, in particular:
- encryption of communications (HTTPS, HSTS);
- passwords hashed with bcrypt;
- access to administration restricted according to each person's role and public authority, with two-factor authentication;
- photos re-encoded on receipt (metadata removed) and kept outside the public part of the website until they are published;
- when the system is in service, daily encrypted back-up with an off-site copy and a monthly restore test;
- verification of the signature of messages received from WhatsApp;
- security headers (content policy, protection against embedding in other websites);
- two-factor authentication secret encrypted in the database, when the encryption key is configured on the server;
- audit log of administration actions;
- limitation of the number of login attempts.
Our measures, their current limitations and the improvement plan are described on the Security and compliance page. In the event of a security breach posing a high risk to you, we will inform you and notify the FDPIC in accordance with the law.
9. Your rights
Within the limits provided for by law, you may:
- obtain a copy of the data concerning you (right of access, Art. 25 FADP, Art. 15 GDPR);
- have inaccurate data corrected;
- request its erasure or object to processing;
- request the restriction of processing (GDPR);
- receive your data in a commonly used, machine-readable format (portability, Art. 28 FADP, Art. 20 GDPR);
- withdraw your consent at any time, without affecting past processing;
- request that a person re-examine a decision concerning you.
Write to contact@scopemy.city. We reply within 30 days. We may ask you to prove your identity, for example by writing from the WhatsApp number concerned.
10. Deleting your data
- Account: delete it from your personal area, or write to us.
- WhatsApp: send STOP to stop receiving messages, then write to us to request the deletion of your number and of the link with your reports.
- A specific report: give us its reference.
A report that has already been published may be kept in anonymised form, with no link to you, where it remains useful for the public follow-up of a problem. We delete it entirely if you ask us to and no overriding interest stands in the way.
11. Minors
The service is intended for people aged 16 and over. If you believe that a younger child has sent us data, write to us: we will delete it. Photos showing recognisable children are blurred or rejected.
12. Contact, complaints, changes
For any questions: Help4Housing Sàrl, data protection, Route de Thonon 119a, 1222 Vésenaz, Switzerland, contact@scopemy.city.
You may lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC), or with the data protection authority of your country of residence in the European Union (in France: the CNIL). On a public authority instance, the competent cantonal data protection authority may also be approached.
We may amend this policy. The version date appears at the top of the page. We announce significant changes on the website and, if you have an account, by e-mail.