Where your data lives and who can see it

Where your data is stored

The website and the subscriber area run on Hostinger web hosting in the EU, which also sends our customer e-mails. Weekly data runs, daily checks and backups run on our own virtual server, rented from Hostinger in a data centre in Vilnius, Lithuania (EU).

All pages and the subscriber area are served over HTTPS only; plain HTTP is redirected.

What we store

Building data from public New York City datasets (DOB facade filings and filing status, HPD registration, PLUTO and other public City data).

Your work data: statuses, notes, follow-up dates, assignments, the activity history, saved views, and the names and business e-mail addresses of the team members you add (up to 10).

Your account: firm, business e-mail, package, payment references and dates.

Who can see your notes

Only your team. Each firm's work list is stored separately under its own account; other subscribers never see your statuses, notes or follow-ups, and we do not tell anyone which buildings your firm works on.

For your work data you are the controller and we act only as your processor (Art. 28 GDPR). Section 8 of our terms is the data processing agreement: we use the data for no other purpose, persons with access are bound to confidentiality, and we inform you without undue delay of any personal data breach affecting your data.

How signing in works

There are no passwords, so we store none. You sign in with a personal link that we e-mail to the address of your subscription. Every team member gets their own link.

The account owner adds and removes team members; a removed member's link stops working immediately. A lost link can be requested again on the Log in page, and it is only ever sent to the e-mail address on file. Please keep the links inside your firm.

Backups

A daily backup of customer, team and work-list data is kept on our server for 30 days.

Once a week an encrypted copy of the same data (AES-256; the key is held only by us) is stored as an e-mail attachment in the owner's Google Workspace/Gmail account and deleted after 30 days. Without the key it cannot be read.

When data is deleted

When a pass or plan ends, the account owner keeps a free basic plan and the work list stays; team members are removed 30 days after the basic plan starts.

30 days after the basic plan ends (after 12 months without a visit, or at your request), or 30 days after a refund, your work data is deleted: work list, notes, follow-ups, history, saved views and team members. Within the same 30 days it is also removed from the backups on our server; the encrypted weekly copies are deleted after 30 days.

Reservations are deleted after 12 months unless they become a purchase. Account and billing records are kept for 7 years, as Austrian accounting law requires, without your work data. You can export your list at any time before the end.

Cookies and tracking

This website uses no cookies and no third-party tracking. We count page views and clicks with our own script on our own web hosting. The IP address is not stored; the visitor ID is a one-way hash that changes every day.

Campaign parameters from a link (such as utm_source) are kept in your browser's session storage until you close the tab. Links in our e-mails and letters to firms may carry a short code (for example fid=k7f3q2, also behind our short addresses /k/…) that tells us which contacted firm opened the page. It contains no name, is kept in your browser's session storage like the campaign parameters, and is stored with the visit statistics. Visits without such a code are counted only under the daily changing visitor ID.

In the subscriber area, local storage only remembers whether you have seen the product tour.

We do not sell data

We do not sell or pass on your work data, and we use it only to run the service for you. FISP Radar does not sell data to building owners or managing agents and does not recommend firms to owners.

No personal data in the lists

The lists are company-level: buildings, owner entities, managing agent companies and inspection firms under their business name. Owners that are individuals appear as "Individual owner", without name or address. We include no personal phone numbers or personal e-mail addresses and buy nothing from data brokers.

For managing agent companies with several open buildings we add a company contact card from the company's own website: website, main office phone, general office e-mail and office address. Listed and want to be removed from our public samples? Use our contact form.

Payment

Online checkout is not open yet: today you reserve a package without any payment details. Once checkout is live, payment, invoice and sales tax run through Paddle.com as Merchant of Record. Card details are entered with the payment provider, never on our website.

Who processes data for us

Hostinger International Ltd. (web hosting, customer e-mail delivery, virtual server in Lithuania) and Google Ireland Limited (the encrypted weekly backup copy). The payment provider receives account and billing data as an independent controller. Map images in the subscriber area come from OpenStreetMap, which receives the viewer's IP address. We inform you before adding or replacing a sub-processor for your work data.

Full details: privacy notice and terms. Questions: our contact form.