Privacy

Controller

Ubivo (sole proprietorship Marco Scherer) · Switzerland · Contact for data protection requests: hallo@ubivo.ch

Full provider details in the imprint.

What data Ubivo stores

• When you visit anonymously: no account, no name, no email address. We count address searches only pseudonymously in the usage statistics (see below), there are no third-party tracking cookies and no analytics scripts (for the campaign cookie after clicking an ad, see Cookies). We keep your IP only transiently in memory for the rate limit against bot sweeps (max. 30 reports/h), not in a database, not linked to your account. The entry is removed automatically once the time window (up to 1 hour) elapses.
• When you log in: your email address, solely for sending the magic link and recognising your account. No further login identifiers (we do not store passwords).
• When you save profiles: a name you choose yourself + the factor weightings you selected for your life situation. Optionally profile fields such as income, household, age, health-insurance deductible, only if you enter them yourself.
• When you bookmark an address (☆ Save): the address + coordinates are linked to your account. That is the point of the saved list. Removable again at any time.
• When you buy (Quick Check or Dossier): your user ID, starting address, product tier (Quick Check or Dossier), purchase status, Stripe session ID as well as the project name you choose. We do not see any credit card data. The payment provider Stripe handles the payment.
• When you buy without signing in first: Stripe passes us the email address you enter there. So that you can open the purchase on other devices too, we credit it to a Ubivo account with this address (an existing one or one we create for this purpose) and send you a login link there. This serves to fulfil the purchase contract. Only someone who opens the link in that mailbox gets into the account; the purchase alone signs no one in.
• Within a search project: the addresses you add as comparison alternatives to your starting address (max. 1 or 5 depending on tier). Addresses can be removed at any time. We store how many swap actions you have already performed, in order to enforce the contractually agreed swap allowance (max. 2 or 12). Optionally the purchase price per address, if you enter it in the project. It is used only for the calculations in your dossier (purchase costs, affordability, ten-year total) and is not part of the purchase receipt. You can clear it at any time; when you delete your account it is deleted immediately.
• If you share your dossier (read-only link): for a paid project you can create up to three links at a time that let another person read the dossier without an account. For this we store: which project the link belongs to, the name you give for it (optional), when the link was created, until when it is valid (30 days), whether you revoked it and when it was last opened. We do not store the link itself, only an irreversible check value (SHA-256). The other person does not see your email address.
  What the other person sees: the dossier for the addresses in this project, calculated with your default profile and the purchase prices you entered in the project, plus the names of the project and the profile. It contains details such as income, purchase price, household, workplace and equity. So only share the link with people who may see this. They cannot change anything or create a PDF. About the other person we store nothing except the time of the last opening; we keep their IP address only transiently for the rate limit, otherwise their visit is treated like an anonymous visit.
  Note: some messengers open a link themselves to show a preview. "Last opened" may then come from that preview.
• With the "Switch health insurer" tool: the calculator inputs (municipality or postcode, year of birth, deductible, accident cover, model, current insurer and premium) are sent to our server, used only to calculate the premiums, and neither stored nor logged. The details for the cancellation letter (names, address, dates of birth, insurance numbers) stay in your browser: Ubivo does not receive, store or see them, not even in browser storage. Ubivo passes nothing on to health insurers.
• With the "Check your rent" tool: the calculation and the letter requesting a reduction are created entirely in your browser. Rent, dates, names, address and the rented property are not sent to our server, not stored and not kept in browser storage. Ubivo passes nothing on to your landlord.
• With the "Ubivo · Check a listing" browser extension: the extension reads the listing open on ImmoScout24, Homegate, Comparis or Newhome only in your browser. Only when you click its button does it open ubivo.ch with the address, postcode, town, price, rooms, area and the listing link in the page address. The extension sends nothing else and stores nothing. Ubivo only saves these details if you save the listing to your account yourself.
• NOT stored: no browsing history beyond the usage statistics described below, no user-agent profiles tied to an account, no server logs linked to your account.

Usage statistics (funnel telemetry)

To understand which parts of Ubivo lead visitors to a purchase (and which do not), we record individual events of your visit: views of the home page, the topic pages, a report, the pricing page and the comparison; submitting an address; which sections of a report you reach; whether the dossier preview in the free report comes into view and is clicked; clicks on the links to BauCheck; starting the Stripe checkout, completed purchases and PDF downloads.

• Identification:a pseudonymous identifier, computed as a SHA-256 hash of your IP address, your browser's identifier (user agent) and the calendar day. We set no cookie, and neither the IP address nor the browser identifier is stored. Because the calendar day is included, the identifier changes daily. We do not recognise you from one day to the next. No cross-site tracking, no link to ad networks.
• A/B tests:We occasionally test two text variants against each other (e.g. a choice of words on the factor cards) and use the events above to measure which is more helpful. The assignment uses a hash of the IP address and browser identifier, here without the calendar day, so that you see the same variant within an experiment. Only the variant's name is stored with the event; no cookie is used for this.
• Signed-in users: If you are signed in, we store your account ID with most events (not with clicks to BauCheck). These events appear in your data export. If you delete your account (DSG Art. 32), we immediately remove the account ID from all events.
• What is stored: for each event its type and time, the pseudonymous identifier and, depending on the event, a short additional detail (e.g. the report section reached, the position of the BauCheck link, the page an address was submitted from, or whether a purchase was made without an account), the product bought, the variant of an A/B test, the coarse device category (desktop/mobile/bot/unknown) and the host name of the referring page (e.g. a search engine, not the full URL). We store addresses only as a shortened hash (SHA-256, the first 16 hex characters), never in plain text. This is pseudonymisation, not anonymisation: by hashing a list of addresses one could match a hash to an address. We do not do this and analyse trends, not individual visits.
• What is NOT stored: no mouse movements, no clicks other than those listed above, no scroll depth in pixels, no measured time on page, no precise device data. For the report, however, we record which sections were scrolled into the upper half of the screen; this roughly shows how far someone read. Because every event carries a timestamp, it is also possible to tell roughly how long a report was open.
• Retention: 90 days. An hourly job deletes older events. The daily totals for our analysis are also computed from these events and therefore go back no further than 90 days.
• Legal basis: our overriding private interest in improving the product (DSG Art. 31 para. 1). Without a way to measure, we could not decide which parts of Ubivo benefit buyers.
• Objection: The identifier is computed pseudonymously from the IP address and browser (no cookie) and therefore cannot be switched off by clearing cookies. Events are deleted after 90 days; without signing in they contain nothing that points directly to you. For an objection under DSG Art. 30 or questions about the processing, contact us at hallo@ubivo.ch.

Where the data resides

All user data resides in a PostgreSQL instance at the provider HostBott (Blumenweg 8, 7204 Untervaz GR); the servers stand in Swiss data centres. No US cloud, no third country for storage. Data transit to the recipients named below is encrypted (TLS).

To whom data is passed on

Ubivo shares data with third-party providers only where it is technically necessary, and each time limited to the minimum:

• Stripe (payment provider): for purchases of Quick Check and Dossier. Data: for a purchase with an account, your user ID and your email address (Stripe pre-fills it), the purchase address, product choice, your amount and, if present, the campaign identifier from the ubivo_utmcookie (see Cookies). For a purchase without signing in, Stripe collects your email address and passes it to us to assign the purchase to an account. We see no credit card data. Stripe processes the payment data mostly under its own responsibility (payment processing, fraud prevention, legal obligations); Stripe's privacy policy applies to that (stripe.com/ch/privacy). Insofar as Stripe keeps the checkout sessions with the purchase details for us (purchase ID, address, product and, if present, account ID and campaign identifier), Stripe is our processor.
  Disclosure abroad:Ubivo's contracting party is Stripe Payments Europe, Limited, in Ireland. For authorised payment services in Switzerland, Stripe names Stripe Payments UK, Ltd., in the United Kingdom. The Federal Council has found that both countries provide adequate data protection (DSG Art. 16 para. 1). Stripe may also transfer data to the United States. For this, Stripe is certified under the Swiss-U.S. Data Privacy Framework, which the Federal Council has recognised as adequate; in addition, Stripe agrees standard data protection clauses with a Swiss addendum (DSG Art. 16 para. 2 lit. d). Information as stated in the Stripe Privacy Center, retrieved on 2 October 2026.
• ZeptoMail (email delivery): ZeptoMail of Zoho Corporation B.V., Utrecht (Netherlands), data centres in the Netherlands and Ireland: for the login link and transactional emails (purchase confirmation). Data: your email address and the content of the email. For operations and support, Zoho Corporation Pvt. Ltd. may access it from India; India does not have an adequate level of data protection, and Zoho safeguards such transfers with standard contractual clauses (Art. 16(2)(d) FADP). Details at zoho.com/privacy.
• swisstopo, BAFU, BFS, ARE, MeteoSchweiz, ESTV and other official CH bodies: geo and statistical data are retrieved publicly by us. These bodies receive NO data about you (requests come from Ubivo servers). For municipal queries, the server IP may go to the respective WMS server, without any link to the user.
• Open-Meteo + Copernicus CAMS: weather and air data are retrieved server-side, with no link to the user.
• swisstopo WMTS tile service: when you open the marker picker for new-build addresses, your browser loads swisstopo map tiles directly (standard WMTS protocol). swisstopo thereby sees your IP address and the requested tile coordinates, equivalent to when you visit map.geo.admin.ch. We pass nothing on and store nothing about it.
• Otherwise NOBODY. We do not sell data, we do not give it to advertising networks or data brokers, we do not share it with authorities without a court order.

How long data is stored

• Account data remains until you delete the account. Deletion flow in the account area. One click, immediate deletion of all account-related data.
• Saved addresses / profiles remain until you remove them yourself or delete the account.
• Purchase receipts we keep for tax and accounting reasons for 10 years (statutory retention obligation). These receipts contain user ID, address, amount, date, but no factor values.
• IP for the rate limit is kept only transiently in memory (no persistent storage) and removed once the time window (up to 1 hour) elapses, never linked to an account.
• Usage statisticsare stored for 90 days, and so are the daily totals computed from them (see section "Usage statistics" above).
• Read-only links are valid for 30 days. We delete expired or revoked links 30 days later. If you delete your account, all links are deleted immediately. If a purchase is refunded, its links stop working immediately.

Your rights

Under revDSG (Swiss Data Protection Act, Art. 25 ff.) you have the following rights:

• Access (Art. 25): everything we have stored about you, you can download at any time as a JSON file · /api/me/export.
• Rectification: correcting wrong data. Most fields you can change yourself in the account area, otherwise email hallo@ubivo.ch.
• Erasure: delete account + all linked data via /account/delete (immediate, no waiting period).
• Data portability: the JSON export linked above is machine-readable. You can take it anywhere.
• Withdrawal of consent: possible at any time, without giving reasons. The withdrawal takes effect for the future.
• Right to complain to the EDÖB (Swiss FDPIC): in case of grievances you can turn to the Federal Data Protection and Information Commissioner.

Cookies

Ubivo sets technically necessary cookies and, only after a click from a campaign, a campaign cookie:

• Session cookie after login (HttpOnly, SameSite=Lax, Secure). It links your session to your account. Required for logged-in features.
• Purchase cookies, only after a purchase without signing in (HttpOnly, SameSite=Lax, Secure): ubivo_kauf_startremembers for at most 24 hours that this browser started a purchase and is only sent to Stripe's return address. ubivo_kauf holds the identifier of your paid purchase for 180 days (not your person and not an account), so that you can open the report in this browser without signing in. Both are signed and cannot be forged.
• Read-only cookie, only when opening a shared dossier (HttpOnly, SameSite=Lax, Secure): ubivo_freigabe remembers for at most 24 hours (never longer than the link is valid) which read-only links this browser has opened (up to three). It contains no person and no account, is signed and cannot be forged. A revoked link stops working immediately, even if the cookie still exists.
• Funnel telemetry:the chaining of your events (see section "Usage statistics") runs cookie-free via a computed pseudonymous identifier (IP address + browser identifier + calendar day). A cookie ubivo_telemetry_sid (HttpOnly, SameSite=Lax) is technically only read, if one already exists; it is currently not actively set. Cross-site tracking does not take place.
• Campaign cookie, only after a click from a campaign (first-party, SameSite=Lax, not HttpOnly, because it is set in the browser): ubivo_utm is only set if the page address carries a campaign parameter (utm_campaign), for example after clicking an ad. For 30 days it holds the source and name of the campaign, cleaned and without any data about you. If you buy during that time, we attach the value to the payment at Stripe. This shows us which campaign leads to purchases. This cookie is not technically necessary; Ubivo works the same without it.

No cookies from ad networks, no third-party tracking, no analytics from Google/Meta/Adobe. The only actively set cookies are the login session cookie, after a purchase without signing in the purchase cookies, when opening a shared dossier the read-only cookie (all technically necessary) and, only after a click from a campaign, the campaign cookie ubivo_utm. The funnel telemetry works entirely without a set cookie; it rests on our overriding private interest in improving the product (DSG Art. 31 para. 1). There is no cookie banner: Swiss data protection law does not require prior consent for these cookies, but information, and it is given here. If you do not want the campaign cookie, delete it or block cookies from ubivo.ch in your browser; this counts as an objection.

Security

HTTPS enforced (HSTS), restrictive CSP headers, no third-party JS scripts. The particularly sensitive details of your personalisation profile (income, health-insurance deductible and place-of-work address) are additionally field-encrypted at rest (pgcrypto/pgp_sym, key kept separate from the database). Report security bugs to security@ubivo.ch. Responsible disclosure welcome.

Changes

We update this page when substantial processing purposes change. For material changes we inform logged-in users by email. Version of this document: 3 October 2026.