Privacy Policy
1. Data Controller
ZEONEQ LLC
Maschinengasse 7
CH-6330 Cham
Switzerland
Contact: Contact form
2. Scope
This Privacy Policy describes the processing of personal data when using the platform topinserate.ch, including platform features, communication, and AI-assisted functions (listing creation, content review, communication surveillance and search engine optimisation).
It is intended to comply with the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).
3. Categories of Personal Data
- Master data (name, email address, phone number, address)
- Listing data (title, description, images, categories, prices)
- Usage data (IP address, browser and device information, log files)
- Communication data (platform messages, contact forms)
- Account data (login data, encrypted passwords, account management)
- Security data (reports, blocking records, abuse indicators)
- Billing data (only if paid services are introduced in the future)
- Data from AI-assisted functions (uploaded photos, text inputs and hints, and the titles, descriptions and meta texts generated from them)
- Pseudonymous identifier: a checksum (HMAC) derived from your user ID that does not directly reveal your identity, transmitted to the AI service provider for abuse prevention
4. Purposes and Legal Bases
Personal data is processed for the following purposes:
- Operation, provision, and improvement of the platform
- Management of listings and user accounts
- Communication between users and with the operator
- Fraud and abuse prevention
- IT security and platform stability
- Analytics and optimisation
- Compliance with legal obligations
- Generation of listing drafts from uploaded photos, at the user's explicit request
- Automated review of messages and listings for prohibited content
- Automated generation of meta descriptions for search engines
Legal bases include:
- Contract performance
- Legitimate interests (e.g. security, operations, aggregated statistics)
- Consent (e.g. cookies, tracking, advertising)
- Legal obligations
- Contract performance (AI-assisted listing creation on request)
- Overriding private interest (Art. 31 FADP) or legitimate interest (Art. 6(1)(f) GDPR) in abuse prevention, platform security, and listing discoverability
5. Cookies & Consent Management
We use a consent management platform (CMP) in accordance with the IAB Transparency & Consent Framework (TCF).
Users may grant or withdraw consent for cookies and tracking at any time.
Without consent, only technically necessary cookies are used.
6. Google Services (Analytics & Ads)
We use Google Analytics for audience measurement and Google Ads for personalised advertising.
Personal data may be transferred to Google servers, including outside Switzerland or the EU (e.g. the United States).
Processing takes place exclusively based on user consent via the CMP.
Google may combine this data with other information.
7. Use With and Without Login
- Without login: browsing and search functions; processing of usage and possibly tracking data.
- With login: additional processing of master, listing, and communication data.
Users may delete their account at any time. Statutory retention obligations remain unaffected.
8. AI-assisted Functions
We use AI services to simplify the creation of listings, to detect prohibited content, and to make listings discoverable in search engines. For these purposes, content is transmitted to and processed by our AI service provider (see section 9).
8.1 Listing creation from photos
If you explicitly request AI assistance while creating a listing, the photos you have uploaded (at reduced resolution) and your text inputs are transmitted to the AI service provider in order to generate a suggested title, description and category. This also applies to photos you subsequently choose not to publish. The suggestions are non-binding; you remain responsible for the final content of the listing.
8.2 Automated content review
Listings by private individuals are automatically reviewed for prohibited content before publication. For this purpose the title, description and photos of the listing are transmitted to the AI service provider. When a listing is edited, the review is repeated if the title, description or photos have changed. For the possible outcomes and your rights, see section 8.4.
8.3 Meta descriptions for search engines
A short search-engine description is generated automatically for every listing — including listings you have written entirely by hand. The description, the completed listing fields, the location and the category are transmitted for this purpose. For listings imported from commercial partners, the same applies to the product data from the partner catalogue.
8.4 Automated decisions and human review
The review described in section 8.2 may result in a listing being published automatically, flagged for manual inspection, or blocked. A block takes effect without a prior human assessment. You have the right to state your position and to request a review of the decision by a natural person (Art. 21 FADP, Art. 22 GDPR). Please contact us via the contact form.
8.5 No sensitive data
Please do not upload photos or text containing particularly sensitive data — such as identification, payment or health data — or images of uninvolved persons, vehicle number plates or third parties' home addresses. Such content does not belong in a listing and would be transmitted as part of the AI processing.
9. Recipients and Third Parties
- Hosting, file storage and site performance measurement (USA)
- Database, login and in-app messaging (EU/Ireland)
- Transactional e-mail (EU/Ireland)
- SMS verification codes (USA)
- Bot protection on forms (USA)
- Maps and postcode lookup: these services receive your IP address when the map or address form loads (Switzerland for postcodes)
- Only with your consent: Google (Analytics, AdSense, consent management, YouTube embeds; Ireland/USA), PostHog (product analytics, EU data centre)
- AI service provider: OpenAI Ireland Ltd., Dublin, Ireland. A data processing agreement (Data Processing Addendum) is in place with OpenAI. Ireland provides an adequate level of data protection within the meaning of Art. 16(1) FADP. Where OpenAI passes data to group companies or sub-processors outside Switzerland and the EEA — in particular to the United States — in order to provide the services, OpenAI has contractually undertaken to do so on the basis of Standard Contractual Clauses or a recognised adequacy decision. The current list of sub-processors is available at https://platform.openai.com/subprocessors
Transfers to third countries are subject to appropriate safeguards, in particular Standard Contractual Clauses (SCCs).
10. Data Retention
- Master and listing data: until account deletion or as required
- Log and security data: in accordance with legal obligations
- Billing data: in accordance with tax and commercial retention periods (only for paid services)
- Data from AI-assisted functions: generated draft texts are deleted 90 days after creation. The uploaded photos themselves are not stored for this purpose — we retain only a non-reversible checksum in order to recognise repeated requests. Published listing photos are subject to the ordinary retention rules for listing data.
- For the automated content review no additional copy of the uploaded photos are created; the photos reviewed are those already belonging to the listing.
- At the AI service provider, requests are not stored as retrievable objects. Storage takes place solely in abuse-monitoring logs for a maximum of 30 days. An exception applies to the legally mandated screening for child sexual abuse material: images are screened on submission, and a suspected match is retained for manual review.
- Billing and usage records of the AI functions (time, volume, cost) are retained for accounting and statistical purposes and are anonymised when your account is deleted. Accounting records are subject to the statutory ten-year retention period (Art. 958f CO).
11. User Rights
Users have the right to:
- Access
- Rectification
- Erasure
- Restriction of processing
- Data portability
- Withdrawal of consent
- Objection to processing
- Review of an automated decision by a natural person (see section 8.4)
Requests may be submitted via the contact form.
12. Data Security
We implement appropriate technical and organisational measures, including encryption, access controls, backups, and logging.
13. Amendments
We may amend this Privacy Policy at any time.
The current version is available on this page.
Last updated: September 2026