Legal
Data Processing & Sub-processors
Last updated: 25 October 2026. NEB RADAR is an independent project in a closed beta. This page lists who processes personal data for it, which data, on which basis and for how long. The privacy notice describes each processing in full.
Controller
The NEB RADAR project is the controller for all personal data processed through this service. For requests about your data (access, rectification, erasure, portability, objection) write to info@neb-radar.eu. We answer within one month (Art. 12(3) GDPR).
Sub-processors
All processors are in the European Union. This list and the privacy notice are updated before a processor is added or replaced; the date at the top shows the last change.
| Sub-processor | Purpose | Location | Transfers |
|---|---|---|---|
| Scaleway SAS (Paris, France) | Hosting of the website and server functions, database, authentication, file storage | Amsterdam, the Netherlands (EU) | None outside EEA |
| Mistral AI (Paris, France) | AI for text and for checking photos - only when an AI feature is used; never receives the beta form data; requests are not used for training | France (EU) | None outside EEA |
| IONOS SE (Montabaur, Germany) | Sending e-mails (sign-in links, invitations, notifications) from beta@neb-radar.eu, replies to info@neb-radar.eu | Germany (EU) | None outside EEA |
| Black Forest Labs GmbH (Freiburg, Germany) | AI pictures of the virtual neighbourhoods and of Urban Ideation designs through its EU-only service (api.eu.bfl.ai); scene descriptions, and design texts with personal details removed; under its terms it may use what it receives to improve its models; the picture is kept in NEB RADAR's storage | EU regions (Germany-based company) | None outside EEA |
Data categories
| Category | Examples | Lawful basis | Retention |
|---|---|---|---|
| Beta access requests | Name, organisation, role, type of participation, connection to the NEB, e-mail, optional phone, country, website, confirmation of age 18+, consent, page language, salted hash of the IP address | Consent (Art. 6(1)(a)) | New or declined requests: 6 months; requests that led to an invitation: for the duration of the beta |
| Accounts of invited participants | E-mail address, display name, role, sign-in records | Contract (Art. 6(1)(b)) | Until the account is deleted, plus 30 days in backups |
| Usage statistics | Pages visited, referring domain, device type and screen-width band, country, a visit ID that expires after 30 minutes; while signed in also buttons used, search words and errors | Consent (Art. 6(1)(a)); storage on the device: § 25(1) TDDDG | 12 months |
| Image requests from project owners | Name, organisation, e-mail, the request, image link and credit, salted hash of the IP address | Legitimate interest (Art. 6(1)(f)): showing images only with the project's agreement | 6 months after the request is closed |
| AI companion and Agent Advisory Council | No question or answer is stored; only a record without content (feature, time, length, cost) | Contract (Art. 6(1)(b)): providing the feature you asked for | Content: not stored. Content-free record: 12 months |
| Group sessions in the Mediator Space | Hash of a random browser key (never the key), ratings, optional comments, Space quest notes, suggested changes; the group's confirmed statement and group card | Participants 18 to 30: consent when joining (Art. 6(1)(a)). Sessions with 13 to 17-year-olds are not open yet | Comments and notes: deleted 30 days after the session closes, the key link is cut; the group's pattern, short themes and the published statement stay |
| Place photos added by organisations and participants | Photos without people; metadata (location, camera, time) removed before storage; Creative Commons licence and the name for the credit; checked by AI for people, personal details and whether a place is shown; clear cases shown at once, others reviewed by a person | Organisations: legitimate interest (Art. 6(1)(f)) in showing the place. Participants: consent when adding the photo (Art. 6(1)(a)) | Until the photo is removed by whoever added it, or the organisation leaves the beta |
| Content reports | The report, the page it concerns, an optional e-mail address | Legal obligation and legitimate interest (Art. 6(1)(c) and (f)) | 6 months after a decision |
AI processing
All AI runs through one gateway on European providers: Mistral AI in France for text and photo checks, Black Forest Labs in Germany for pictures. What a person types reaches the model only after a deterministic safeguarding check and after personal details in the text have been masked. The gateway keeps a record without content (feature, time, length, cost); questions and answers are not stored and are not used for training. Every AI surface is labelled as AI. In the Lab for invited testers, pictures are created by Black Forest Labs from NEB RADAR's own scene texts or from a design (personal details removed) and are labelled as AI pictures; Black Forest Labs may use what it receives to improve its models. Place photos are checked for people and personal details by Mistral AI before a person reviews them. AI assesses places, never young people. See the DPIA summary.
International transfers
All sub-processors listed above operate in the European Union. Sign-in works with an e-mail address only; no US sign-in service is used.
Your rights
You have the right of access, rectification, erasure, restriction and data portability, the right to object and the right to withdraw consent. Write to info@neb-radar.eu. You may lodge a complaint with a data protection supervisory authority at any time, in particular in the EU member state where you live or work.