Privacy policy

Controller

Responsible for processing your personal data under the Swiss Federal Act on Data Protection (FADP): Nsystem GmbH, ⚠ [nicht konfiguriert], ⚠ [nicht konfiguriert], Schweiz – ⚠ [nicht konfiguriert].

What we process

• Account: email address, display name, preferred language, password (stored only as an Argon2id hash), time of email confirmation.
• Listings: your texts, place, canton, postcode, price, details and photos. Photos are re-encoded on upload, which removes all metadata such as GPS location, camera model and capture date.
• Messages: conversations between interested people and advertisers are stored on Rones (text, if translated also your original text, time, read/unread). The other side sees your display name, not your email address. You get an email notification containing the text of new messages. If a conversation is reported, our moderation team can view that conversation; we do not read other conversations.
• Business accounts: company name, UID, address, phone, website, description and logo. Once verified, these details are public on the company page.
• Viewings: booked appointments (time, listing, conversation). Both sides receive a confirmation with a calendar file and a reminder. An advertiser can subscribe to their viewings through a private calendar link, which contains the display names of the people booked but no email addresses.
• View counts: we count how often a listing is viewed (once per person and day). For this, a key derived from the IP address and browser is computed in memory only, scrambled with a random value that changes daily and never stored; only the daily total is saved.
• Automatic assistant: if an advertiser turns it on, it replies automatically (labelled “Automatic reply”) and can book one of the offered viewing times. The conversation's messages, the listing data and the advertiser's information are processed by a language model on the operator's own servers; no email addresses are sent and nothing goes to external AI providers.
• Saved listings: which listings you saved.
• Saved searches: criteria, name and chosen frequency of email alerts. Every alert contains an unsubscribe link.
• Sessions: sign-in tokens are kept in your browser's session storage and removed when the tab closes. The server stores a hash of each token, its expiry and the browser's user agent.
• Server logs: time, requested address without parameters, status code, duration and IP address. Form contents are never logged.

No cookies, no tracking

Rones uses no tracking or advertising cookies, no analytics services and no social media plugins.

Maps

Maps are loaded from the Federal Office of Topography swisstopo (map.geo.admin.ch). swisstopo therefore receives your IP address and the map tiles shown, as with any web page request. Listings appear on the map only approximately (postcode level), never with an exact address. Place data: GeoNames (CC BY 4.0).

360° tours and videos

Tours (Matterport, Kuula, Momento360) and videos (YouTube in privacy-enhanced mode, Vimeo with “Do not track”) are only loaded when you click them. Only then is data such as your IP address sent to that provider.

Purposes and legal bases

Providing your account, listings, messaging and saved listings (contract); preventing abuse and spam and keeping the platform secure (overriding interest). Where the EU GDPR applies: Art. 6(1)(b) and (f) GDPR.

Moderation

New listings, changes and new photos are reviewed before publication. Decisions and their reasons are logged; the reason for a rejection is shown to you.

Translation help (AI)

When available, AI translation runs on the operator's own servers; your texts are not sent to external AI providers. Only what you explicitly approve is sent.

Recipients and location

Data is stored in Switzerland (Rechenzentrum in der Schweiz). An email service delivers messages on our behalf.

Retention

Account, listings and messages: until you delete your account; if either side deletes their account, the whole conversation is deleted for both. Unconfirmed accounts: deleted after 30 days. Expired sessions and links: deleted after 7 days. Backups: kept for at most 30 days.

Your rights

• You can request access, have incorrect data corrected and object to processing.
• In “My Rones” you can download all data stored about you and delete your account yourself. Deletion takes your listings offline, removes photos, saved listings, saved searches, conversations, business details and sessions, and anonymises your account.
• Contact: ⚠ [nicht konfiguriert]. You may also lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC).

Security

The connection is encrypted (HTTPS), passwords are stored only as hashes, sessions can be ended at any time, and access is restricted by role.