Privacy policy
Last updated:
Who is responsible
The person responsible for the processing of personal data on vscn.ch (the “controller”) is Joshua Binswanger, reachable at info@vscn.ch. “We” in this policy means him. VSCN is currently run in a private capacity and is not a registered organisation.
This policy follows the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation (GDPR) applies to you, it is also written to meet that.
Visiting the site
The site is a set of static pages served by Firebase Hosting, a service of Google LLC. When you open a page, Google’s servers receive and log the technical data any web server sees: your IP address, the page requested, the time, and your browser and operating system. We use these logs only to run the site and to find faults; they are kept by Google for a limited time (typically 30 days) and then deleted.
The site sets no cookies of its own, runs no analytics, and embeds no advertising or tracking. Fonts are served from our own site, not from a third party.
Bot protection (Cloudflare Turnstile)
To keep automated abuse away from sign-up, sign-in and uploads, the site uses Cloudflare Turnstile, a service of Cloudflare, Inc. When you open a page that talks to our database, Turnstile runs a check in your browser and, in doing so, Cloudflare processes technical data such as your IP address and characteristics of your browser to tell a person from a script. Cloudflare does not use this data for advertising. The result is handed to Firebase App Check, which lets your browser talk to our database for a limited time. Nothing about you is stored on our side from this step.
Creating an account
If you register, Firebase Authentication (Google) stores your email address and a hashed form of your password, and sends you a verification email. We never see the password itself. Your browser keeps you signed in using its own local storage (not a cookie); signing out clears it.
When an account is created, and when a member publishes an image, an automatic notice is sent to the controller so that new registrations and uploads can be attended to. For a new account it lists the email address used and the profile details entered; it is sent from our Infomaniak mailbox to a private mailbox of the controller and is kept only as an ordinary email.
Email between us and you
Mail sent to and from info@vscn.ch — the address given on the contact page, and the address we write from when we approach members directly — is hosted by Infomaniak Network SA (Geneva, Switzerland). Infomaniak keeps our mailbox on servers in Switzerland and therefore processes the email addresses and the contents of the messages we exchange with you.
Your profile and your works
The point of VSCN is a public directory, so most of what you enter is meant to be public. You decide what to enter. The following is shown to everyone on the site once your email address is verified and you have finished setting up:
- your display name, member type, role, affiliation and location,
- your biography, languages, subject tags and what you are open to,
- links to your portfolio and social-media accounts,
- your profile picture and the works you upload, with their captions, descriptions, links and tags.
The following is private — visible only to you and to the site’s administrator: your email address, your phone number if you give one, your onboarding answers, and whether you would like to help with the network.
Pictures are stored in Firebase Cloud Storage (Google). Each has a fixed web address, so anyone who has the address can view it even without opening the site; the address is not guessable. Pictures you remove are deleted from storage by an automatic sweep shortly after.
Search engines index the directory. Your profile page may therefore appear in search results under your name for as long as it is public.
Embedded videos (YouTube, Vimeo)
Members can show a video from YouTube or Vimeo among their works. On the directory and on member pages such a work appears only as a still picture that we store ourselves; while you are just looking, your browser does not contact YouTube or Vimeo at all. When a member adds a video link, our server asks the platform once for the video’s title and thumbnail; that request carries no data about visitors.
Only when you press play is the platform’s video player loaded into the page. From that moment your browser connects to YouTube (Google Ireland Limited / Google LLC) or to Vimeo (Vimeo.com, Inc.), which receive technical data such as your IP address, information about your browser and the page the video is on, and may set cookies or similar identifiers on your device under their own privacy policies. We use YouTube’s privacy-enhanced mode (youtube-nocookie.com) and Vimeo’s “do not track” setting to reduce this, but we cannot switch it off. When you leave the video, the player is removed from the page. If you do not want this, do not press play; the work’s description and links remain available without it.
Why we process this, and on what basis
We process your data to run the network you joined: to show your profile in the directory, to let you edit it, to keep your account secure, and to keep the site working. Where the GDPR applies, the basis is the agreement you enter when you register (Art. 6(1)(b)), our legitimate interest in a working, abuse-free site (Art. 6(1)(f)), and — for making your profile public — your own choice to publish it, which you can reverse at any time.
Who else receives data
We use the following service providers, who process data on our behalf and are bound by contract to do so only as instructed:
- Google LLC (Firebase Hosting, Authentication, Firestore, Cloud Storage, Cloud Functions) — hosting, accounts, database, pictures. Data may be processed on Google servers outside Switzerland, including in the USA.
- Cloudflare, Inc. — bot protection (Turnstile).
- Infomaniak Network SA (Switzerland) — hosting of the info@vscn.ch mailbox: the email addresses and the contents of mail we send to and receive from you. Processed in Switzerland.
- GitHub, Inc. — the site is rebuilt on GitHub’s servers whenever a profile changes; no personal data beyond what is already public in the directory passes through that step.
Google, Cloudflare and GitHub are US companies certified under the Swiss-U.S. Data Privacy Framework and the EU-U.S. Data Privacy Framework, or process under the EU standard contractual clauses, which the Swiss Federal Council recognises as adequate safeguards; Infomaniak processes in Switzerland. We do not sell data and do not pass it to anyone else, except where the law obliges us to.
How long we keep it
Your account and profile exist for as long as you keep them. When you delete your account — you can do this yourself in the profile editor — your profile, your pictures, your private data and your login are removed immediately; there is no waiting period. The public pages are rebuilt shortly after, so your entry disappears from the directory within minutes. Server logs expire on their own as described above.
Your rights
You may ask at any time what data we hold about you, have it corrected or deleted, restrict how it is processed, receive a copy in a common machine-readable format, or object to a processing. Most of this you can do yourself in the profile editor; for the rest, write to the address above. We answer within 30 days.
If you believe we handle your data unlawfully, you may complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC), or — where the GDPR applies — to the supervisory authority of your country of residence.
Changes to this policy
This policy describes the site as it is. When the site changes in a way that matters for your data — a new service, a new kind of processing — this page changes with it, and the date at the top moves.