Aireon privacy policy

Who is responsible

The controller for the processing described here is Aireon, Switzerland. You can reach us for any privacy question or request at contact@aireon.ch.

What this policy covers

This policy covers the Aireon hub, every Aireon application published under an aireon.ch subdomain, the RES API that those applications call, the aireon-mcp server on mcp.aireon.ch, and the Aireon app you can add to ChatGPT, Claude, Gemini and similar assistants through that server.

The assistant itself is run by its own provider. What you type into ChatGPT is handled by OpenAI under OpenAI’s privacy policy, and the same applies to Anthropic, Google and any other assistant vendor. We only receive what the assistant sends to our tools, as described below.

What we collect

We collect only what each feature needs. Most of the suite works without an account. The list below is grouped by where the data comes from.

• Account data. When you sign in, our identity provider gives us your user ID, display name, email address and an avatar icon. We add the role and plan tier of your account, your credit balance and the time of your first and last visit.
• Connector tokens and usage. When you connect an AI assistant, we issue you a personal connector token and store it together with its label, status and the date it was created or revoked. Every tool call made with it is metered: tool name, whether it succeeded, the HTTP status, the duration and the timestamp. We do not store the inputs you send to a tool or the data it returns.
• What AI assistants send us. When you use the Aireon app inside ChatGPT or another assistant, the assistant sends our tools the inputs it needs to answer you, typically an address, coordinates, an EGRID, a municipality name or a set of search filters, together with your connector identity. We do not receive the rest of your conversation.
• Search history. When you search for an address while signed in, we store the label you searched for, its coordinates, the app you were in and how often you searched it, so the history is shared across the suite. Anonymous visitors get a short local history kept in a cookie in their own browser.
• Saved parcels, saved searches and notes. Parcels you track, the tags, states and priorities you assign, saved search filters and an activity log of those changes are stored under your account.
• AI assistant conversations. Threads with Claire, the assistant built into several apps, are stored under your account so you can return to them. Reports you generate are stored the same way.
• Error reports. When an application fails, it sends us the error message, the stack trace, the page URL, the application version and the browser and operating system, and, if you are signed in, your user ID, so we can find and fix the defect.
• Session replays. Our applications use OpenReplay, self-hosted on our own server (openreplay.zeroo.ch), with no third-party processor. Recordings are anonymous by default: no name, email address or account ID is attached, even when you are signed in. We record the page structure and your interactions (clicks, scrolls, navigation), console errors, request metadata (URL, method, status and timing), your browser and device type, and technical connection data such as your IP address as processed by the server. Before anything leaves your browser, email addresses, numbers and dates in text are masked and every form input is masked. Request and response bodies are not recorded, and authorization headers and cookies are removed.
• Support mode for session replays. Only if you explicitly confirm a consent dialog, which opens through a support link, your current session is linked to your account for 24 hours so that support can help you. You can decline, and the application then works as usual.
• Server logs. Our web servers keep standard access logs with the requesting IP address, the requested URL, the time, the user agent and the response status.
• Bot protection. Some capture and report endpoints are protected with Cloudflare Turnstile, which evaluates the request in your browser and sets a short-lived clearance cookie.
• Email. If you subscribe to a newsletter or ask us to email you, we store your address and the sending history.

Property data is not your personal data

The parcels, buildings, zones and values shown in the suite come from public registers and models: the official cadastral survey, the Federal Register of Buildings and Dwellings (GWR), the cadastre of public-law restrictions (ÖREB), cantonal geoportals, swisstopo and market statistics. We do not collect, store or display the names of property owners.

When you search for an address, the query is sent to the geo.admin.ch search service of the Swiss Federal Office of Topography, which answers it under its own terms.

Why we process it and on what basis

We use the data above for the following purposes. Under the GDPR, the legal basis is given in brackets.

• To provide the service you asked for: signing you in, answering tool calls, keeping your saved parcels, searches and conversations (performance of a contract, Art. 6(1)(b) GDPR).
• To meter usage against the quota of your plan, to keep the credit ledger correct and to prevent abuse of tokens and endpoints (contract and legitimate interest, Art. 6(1)(b) and (f)).
• To find and fix defects and to keep the applications fast and secure, using error reports, session replays and server logs (legitimate interest, Art. 6(1)(f)).
• To send you email you asked for (consent, Art. 6(1)(a); you can withdraw it at any time).
• To comply with legal obligations, for example accounting records (Art. 6(1)(c)).

We do not use your data for advertising, we do not sell it, and we do not train machine-learning models on it.

AI features

Claire and the other assistants inside the suite send the text you type, together with the property context needed to answer, to a large-language-model provider such as Google or Anthropic through our backend. Only the current request is sent, never your account record. Which provider is used is shown on the hub’s AI models page.

When you use Aireon through ChatGPT or another external assistant, the roles are reversed: that assistant decides what to send to our tools, and its provider is responsible for your conversation.

Who receives your data

We work with a small number of service providers who process data on our behalf and are bound by contract to use it only for that purpose.

• Identity and sign-in: Zitadel, a Swiss identity provider; our instance is hosted in Switzerland.
• Web hosting and content delivery for the hub and the applications: Vercel Inc., United States, with delivery from edge locations worldwide.
• Backend, database, MCP server and session replay: a dedicated server rented from Contabo GmbH (Germany), located in the European Union (France). We run these components ourselves.
• DNS and bot protection: Cloudflare, Inc., United States.
• Transactional email and newsletters: Resend, Inc., United States.
• Large-language-model providers for AI features: Google LLC and Anthropic PBC, United States, receiving only the current request.
• External AI assistants you connect yourself, such as OpenAI (ChatGPT), Anthropic (Claude) or Google (Gemini), which receive the results of the tool calls they make.
• Public data services we query on your behalf, such as geo.admin.ch (Swiss Federal Office of Topography).

We disclose data to authorities only where the law obliges us to.

Where your data is processed

Our own systems are in Switzerland and the European Union. Some providers listed above are in the United States. Where data leaves Switzerland or the EU, we rely on the recognised safeguards of the FADP and the GDPR, in particular the Swiss-U.S. and EU-U.S. Data Privacy Framework where the provider is certified, or standard contractual clauses.

How long we keep it

We keep personal data only as long as it serves the purpose it was collected for.

• Account data: for as long as your account exists. When your account is deleted, the record is removed.
• Saved parcels, saved searches, search history, assistant conversations and reports: until you delete them or your account is deleted.
• Connector tokens: until you rotate or revoke them. A revoked token stays on file in a revoked state so it can never be reused; it is detached from your identity when your account is deleted.
• Usage metering and the credit ledger: kept as an accounting trail. When your account is deleted these records are detached from your identity and kept only in pseudonymous form.
• Error reports: up to 12 months.
• Session replays: up to 90 days.
• Server access logs: 30 days.
• Email sending records: for as long as you are subscribed, plus what accounting law requires.

Cookies and local storage

We use no advertising or cross-site tracking cookies. What we do store in your browser:

• Preferences in local storage: your language, theme, favourite and recently used tools, and the last release notes you have seen.
• A sign-in hint cookie so that the applications know an Aireon session exists and can sign you in silently.
• A short search-history cookie for visitors who are not signed in.
• A Turnstile clearance cookie on protected endpoints, and a capture clearance cookie that lets a report render for a few hours.
• Session cookies that keep you signed in to the API for the duration of a visit.

Security

All traffic is encrypted in transit with TLS. Connector tokens are personal, can be rotated or revoked at any time on the hub, and a leaked token affects only its owner. Access to the backend is limited to the people who operate it, and administrative actions are recorded in an audit log.

Your rights and controls

You can ask us at any time for access to the personal data we hold about you, for its correction, its deletion or its transfer in a portable format, and you can object to processing based on our legitimate interest. If processing is based on consent, you can withdraw it at any time with effect for the future. Write to contact@aireon.ch; we answer within 30 days. You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, to your local supervisory authority.

Controls you can use yourself:

• Rotate or revoke your connector token on the hub’s MCP page.
• Disconnect the Aireon app in the settings of your AI assistant; it loses access immediately.
• Delete individual search-history entries, saved parcels and conversations inside the applications.
• Unsubscribe from any email with the link in its footer.
• Ask us to delete your account entirely.

Children

The services are intended for professionals and adults. We do not knowingly collect data from children under 16.

Changes to this policy

We update this policy when the service or the law changes. The effective date at the top tells you which version you are reading, and material changes are announced on the hub’s What’s new page.