Privacy notice

The controller for data processing on this platform is Jubati Gehrig, sole proprietorship (contact).

Autonio is aimed at people in Switzerland. Swiss data protection law applies, in particular the Federal Act on Data Protection (nFADP, in force since 1 September 2023) and the Data Protection Ordinance (DPO).

This notice describes the processing actually performed on autonio.ch and in the Autonio app for iOS and Android. It is no substitute for legal advice – the version published here prevails in each case.

Jubati Gehrig, sole proprietorship, Sagenmattstrasse 11, 6344 Meierskappel, Switzerland

Data requests: info@autonio.ch

We have not appointed a data protection adviser within the meaning of Art. 10 nFADP.

• Account data: name, email address, password (hashed), login data, organization membership and blocked contacts.
• Seller data: display name, location address, contact details (phone, WhatsApp, fax, email, website) and opening hours, plus logo and description for businesses.
• Listing data: vehicle details, photos, prices, location (town and postal code, never private coordinates), seller identity. Vehicle identifiers you enter (VIN, matrix number, number plate, type approval) are stored encrypted and never published. Photos and logos you choose in the app or take with the camera are scaled down on the device and uploaded without embedded metadata such as where they were taken.
• Usage data: pages visited, search and filter settings, saved searches and vehicles, your browsing history while signed in, device and browser details (in the app, its version and the operating system), and IP addresses in server logs. We do not collect your device's location; for a radius search you enter a postal code yourself.
• View statistics: to count how many different visitors viewed a listing on a given day, we derive a pseudonymous value from the IP address, browser or app details, the listing and the date using a secret key. We store only that value, never the IP address or those details, and nothing is stored on your device for this. The value differs for every listing and every day and contains no reference to your account.
• Communication data: chat messages, reports (without an account, the email address if you give one), support requests, and what the automatic check described below records, including your account's trust score.
• Notification data: your notifications and settings and, if you turn on push, your browser's push address (stored encrypted). The app uses no push notifications.

There are no payments during the pilot, so we process no payment data.

• Providing the marketplace: search, listings, accounts, messages, saved items and notifications.
• View statistics for sellers: how often their listings were viewed, never by whom.
• Security and abuse prevention: rate limits, bot protection, moderation and enforcing the listing rules and GTC.
• Automatic check: an AI model reads chat messages before delivery, with the conversation's last six messages as context, and listing texts (title and description) after publication for signs of fraud. It can deliver a message with a warning for the recipient or hold it back. A message with a link imitating an Autonio address is held back without any AI model. Someone writing as a buyer is locked out for 72 hours if their message was held back for such a link or a second, larger model confirms the assessment; nobody who belongs to a business we set up is ever locked. The lock ends by itself. Suspicious listings are only reported to us; people decide about them. In the app we ask for your explicit permission before your first message or publication. Without it you cannot send messages or publish listings in the app; everything else stays available. You can withdraw the permission at any time in the app under Account › Automatic check.
• Trust score: what the check records across all of an account's conversations adds up to an internal score. It is lowered by messages delivered with a warning and messages held back, reports we upheld, listings the check reported, reaching the daily limit for new conversations, and the same text sent to many listings. Each event counts in full on its first day and loses its weight over 90 days. With a low score the check reads more strictly, and the account can start only five, or one, new conversations within 24 hours. Only we see the score; it is shown neither to you nor to anyone else.
• Review by a person: for a message held back, a lock or a restriction, you can ask at support@autonio.ch for a person to decide.
• Communication: support replies and security messages; newsletters only with consent.

We do not ask for particularly sensitive personal data within the meaning of Art. 5 let. c nFADP. Free text such as chat messages or reports may still contain it – only write it when necessary.

• The public: listings with vehicle details, photos, price and town, and the seller profile – a private seller's first name; for a business its name, logo, description, website, opening hours and, if the business chooses, its street address. A private seller's street address is never public. We hand out phone numbers and other contact details only after a bot check, and only where the seller has opened them.
• Conversation partners: a chat message goes to the other side of the conversation, and for a business to every member with access to its inbox.
• Moderation and support: people we authorize see what they need for it – reported listings, reported messages with an excerpt of the conversation, messages the automatic check held back or delivered with a warning, and an account's trust score.
• Cloudflare: hosting and delivery, security and bot protection (Turnstile), photo storage, sending our emails, and running the AI model of the automatic check (Workers AI). For Workers AI, Cloudflare commits not to retain inputs and outputs after the request and not to use them to train models; we have the texts neither logged nor cached.
• PlanetScale: our database.
• Push services of your browser's maker (for example Google, Mozilla, Apple or Microsoft): only if you turn on push in your browser, and they receive the notification encrypted. The app uses no push services.
• Apple and Google: getting and updating the app through the App Store and Google Play, under their own terms. The app contains no third-party analytics, advertising or crash-reporting software.
• Authorities: only where required by law.

We sign processor agreements with processors within the meaning of Art. 9 nFADP. No disclosure to third parties for their own advertising purposes.

• Cloudflare (US company) runs a worldwide network. Connection data, delivered content and the texts Workers AI reads for the automatic check (chat messages and listing texts) may therefore be processed in any country where Cloudflare runs data centres, including the United States. Cloudflare is certified under the Swiss-US Data Privacy Framework; its processor agreement also contains standard contractual clauses adapted to Swiss law.
• PlanetScale (US company) hosts our database in the eu-central-1 (Frankfurt, EU) region. Access from states without an adequate level of protection is covered by the standard contractual clauses in its processor agreement.
• Browser makers' push services, mostly US companies, may process notifications outside Switzerland; they receive them encrypted.

Transfers to states without an adequate level of protection rely on appropriate safeguards within the meaning of Art. 16 para. 2 nFADP.

• Account data: while your account exists. When you close it, sign-in data, favourites, saved searches, browsing history, notifications, push addresses and your trust score are deleted at once, and so are the photos, texts and vehicle identifiers of your listings; what remains is kept without your name (see below).
• Drafts: empty ones for 7 days, others until six months after their last edit.
• Deleted listings: photos at once, unless an open report still needs them; the rest once no chat or report refers to it. Archived listings: 12 months after archiving.
• Chats: 12 months after the last message.
• Reports and moderation decisions about deleted listings and chats: 24 months after resolution.
• Browsing history while signed in: 90 days after the last view.
• Notifications: 90 days once read or dismissed, unread ones for 12 months.
• Pseudonymous values for view statistics: 100 days.
• What the automatic check recorded for an account's trust score: 12 months; at once when you close your account.
• Security logs (audit events), including messages the automatic check held back: 24 months.
• Email address of a report made without an account: 12 months after the report is settled.
• After an account is closed: listings no chat, report or moderation decision refers to, at the next daily deletion run; the others without photos, text and vehicle identifiers for as long as that reference exists. Messages you wrote stay readable to the other side for up to 12 months, so they can reread and report their conversation; a reported conversation for as long as the report. Where a report or moderation decision concerns a listing, its text and earlier versions stay as evidence for as long as that record is kept. Reports and moderation decisions about the person: 24 months after resolution.
• Server logs: 7 days.

Where the purpose lapses and no duties stand in the way, we delete or anonymize the data.

You have the right of access (Art. 25 nFADP – generally within 30 days), rectification and erasure (Art. 32 nFADP), release and portability of your data (Art. 28 nFADP) and objection to certain processing. Write to info@autonio.ch.

Complaints may be addressed to the Federal Data Protection and Information Commissioner (FDPIC): edoeb.admin.ch.

You can close your account yourself at any time: in the app under Account › Close account, or on the web under Close account once signed in. Closing happens at once. What is deleted and what stays without your name is set out under “How long we keep data”.

Until they are resolved, two cases prevent closing: you are the last owner of a business that still has other members (make another member an owner first), or a payment, refund or billing matter is open. Staff accounts are closed by support.

If you forgot your password, reset it when signing in. If you are stuck or can no longer reach your email address, write to support@autonio.ch, from your account's address if you can. You can ask for particular data to be deleted at info@autonio.ch.

To withdraw a permission: the automatic check in the app under Account › Automatic check, push in your account or your browser.

We protect personal data with state-of-the-art technical and organizational measures (Art. 8 nFADP): encrypted transmission, access controls and regular review. Absolute security does not exist on the Internet – please report anomalies immediately via contact.

We use no advertising or tracking cookies and no third-party analytics. We count listing views without a cookie (see “What data we process”).

In the browser:

• Sign-in cookie: keeps you signed in; necessary.
• Language cookie: remembers the language you chose.
• Browser storage on your device: drafts in progress, your browsing history while signed out, and notices you dismissed. It stays in your browser; we do not store it.
• Push: only if you turn it on; you can turn it off in your account or your browser at any time.

In the app:

• Sign-in: the session cookie and the session details are kept in the operating system's protected storage (the keychain on iOS, encrypted with the Android Keystore on Android); necessary. Signing out clears it.
• App storage on your device: public catalogue data and the app configuration (up to 7 days), a copy of the listing you are editing (per account, up to 30 days), your browsing history while signed out (discarded when you sign in), the results layout you chose and your answer about the automatic check, plus cached business logos. Unsent messages and the comparison list stay in memory only. If you close your account in the app, it deletes that account's listing copies and answer.
• Photos and camera: the app receives only the photos you pick in the system's photo picker, and uses the camera only when you take a photo and allow it.
• The app does not use location, contacts, the microphone or push notifications.
• The app opens help and legal pages in the system's browser, which keeps its own cookies.

We adapt this notice when our offering or the legal situation changes. Material changes are communicated appropriately.