StreetSmart Privacy Policy
Last updated: August 6, 2026
Project: StreetSmart
Contact: [email protected]
Data controller: StreetSmart
Legal entity: StreetSmart
1. Scope of this policy
This privacy policy applies to the StreetSmart private beta, including audits, walkshops, pilot studies and related research or engagement activities carried out through the StreetSmart web app.
StreetSmart collects street-level information to understand how public spaces are experienced and how they perform in everyday use. This may include uploaded street photos, location data, participant responses, optional demographic information and open-ended comments.
We do not ask for your name or account details to use the free version of StreetSmart. If you choose to purchase a paid feature or request a report export by email, we will collect the minimum contact and payment information needed to deliver it, as described in Section 3. Because photos, precise location data and comments may sometimes reveal information about a person, we treat beta and pilot submissions as personal data.
2. Who we are
StreetSmart is a civic-tech platform and methodology for understanding how streets and public spaces are experienced. We collect and analyse street-level information to support urban research, audits, pilot studies, planning conversations and public-space decision-making.
StreetSmart, incorporated in France, is the data controller for information collected through the app, unless a specific pilot agreement states otherwise. Data previously collected while Reena Mahajan operated the beta as an individual controller has transferred to StreetSmart as of 1 July 2026.
For questions about this policy or your data, contact [email protected].
3. What data we collect
When you use the StreetSmart beta, we collect the following categories of data, depending on what is submitted and how the app is used.
3.1 Uploaded street photo
You may upload a photo of a street, public space or selected street segment.
We use the uploaded image to analyse visible street conditions, such as pavements, crossings, shade, greenery, traffic conditions, public-space quality and other liveability indicators.
Before storing uploaded images, we use automated tools designed to blur faces, licence plates and visible house numbers where detected. Because automated detection may not be perfect, participants should avoid uploading images where people, private addresses or other identifying details are clearly visible.
Temporary, unblurred images are transitively processed by our AI provider to analyze street conditions, after which a blurred version is permanently stored. Unblurred images are not permanently stored or visible to the StreetSmart team, developers, or pilot partners.
3.2 Location data
StreetSmart collects location data for the street or public space shown in the uploaded photo.
Participants are asked whether they are at the location where the photo was taken. If they answer yes, StreetSmart stores the location to assess the street in context. If they answer no, StreetSmart does not store the location.
Location data comes from image metadata and device/browser geolocation. StreetSmart stores full-precision GPS coordinates. StreetSmart may request browser or device geolocation permission.
We use location data to assess the street in context, map responses, and analyse conditions at the level of specific street segments or public spaces.
3.3 Street perception responses
StreetSmart asks participants to respond to short prompts about how a street or public space feels and functions. This may include questions about safety, comfort, ease of movement, crossing, waiting, resting, shade, noise, traffic, greenery or other street-level conditions.
3.4 Optional demographic information
StreetSmart may ask for optional demographic information, such as age range and gender.
This information helps us understand whether different people experience the same street or public space differently. For example, it may help reveal whether safety, comfort or accessibility is experienced differently by different groups.
This information is not linked to your name, email address, or account details.
The demographic questions asked are:
- What is your age group?
- How are you using this street today?
- Please share your gender if you're comfortable.
Demographic responses are optional. Demographic responses are stored with the same submission record. Demographic responses can be linked to the uploaded photo, location and responses through a submission ID.
3.5 Free-text comments
Participants may leave open-ended comments about the street or public space.
Please do not include personal information in comments, such as your name, address, contact details, details about other individuals, or information that could identify you or someone else. Free-text comments are reviewed before being used in reports. Free-text comments are stored with the same submission record.
3.6 Technical data
Even though StreetSmart does not ask for names, email addresses or account details, some technical data may be collected automatically when the app is used. This may include IP address, browser type, device type, operating system, date and time of access, referring page, error logs, security logs or analytics events. We use this technical data only to operate, secure, and debug the app.
When a user connects to api.livestreetsmart.com (usually via try.livestreetsmart.com), we collect IP addresses and aforementioned other technical data in server logs. These logs are retained for up to 15 days, after which they are automatically deleted.
Cookies, local storage or similar technologies are used to verify the user has obtained a valid access code for the app. Cookies are not correlated with submitted photos, locations, or responses. Cookies are also used to store privacy policy consent.
Similar technical information may be shared with our data processors as detailed in Section 9 to operate, secure, and debug the services they supply to us.
3.7 Email address (report exports and receipts)
If you request a report export or purchase a paid feature, we ask for an email address so we can send you the report or a payment receipt. We do not require an email address to use the free StreetSmart beta.
Your email address is stored separately from your anonymous submission data and is used only to deliver the report or receipt you requested, respond to related support questions, and meet our accounting/tax obligations. We do not use it for marketing unless you separately opt in.
4. Lawful basis for processing
StreetSmart relies on consent for data actively submitted by participants, including uploaded photos, location data, street perception responses, optional demographic information and free-text comments.
For other individuals who may incidentally appear in an uploaded photo, StreetSmart relies on legitimate interest as the lawful basis, since it is not practical to obtain consent from every person who might appear in a public street photo. We limit this processing through automated blurring of faces and licence plates before permanent storage, and by never using photos to identify individuals. Because it is not possible to directly contact individuals incidentally captured in a photo, we rely on the availability of this public privacy policy to meet our transparency obligations to them.
StreetSmart relies on legitimate interest for limited technical data needed to operate, secure, maintain and debug the app. Where analytics, cookies or similar technologies require consent, StreetSmart will request consent before using them.
StreetSmart relies on performance of a contract for your email address and payment information when you request a paid feature or report export — this data is necessary to deliver the specific product or service you asked for. Where we retain transaction records beyond delivery for accounting or tax purposes, we rely on legal obligation as the lawful basis for that limited retention.
Where you opt in to receive news and insights, we rely on your consent as the lawful basis, which you may withdraw at any time as described in Section 11.
Participants may withdraw consent at any time by contacting [email protected]. Because StreetSmart does not ask for names, email addresses or account details, we may need the submission ID to locate and delete a specific submission. If you’re not able to provide the submission ID, please provide information like the approximate submission time, location, and photo to help us identify your submissions.
We will respond to requests to exercise your rights within one month of receiving a verifiable request, or explain any delay if more time is needed for complex requests, as permitted by law.
5. What we do not collect
StreetSmart does not ask participants to create an account.
We do not ask for:
- name;
- phone number;
- postal address;
- account login.
If you purchase a paid feature or request a report export, we collect an email address and limited payment confirmation details as described in Section 3.7 — this is the only part of StreetSmart where identifying contact information is collected.
We do not use participant data for advertising, individual tracking, commercial resale, or automated decision-making that produces legal or similarly significant effects.
The app does not create a user session, device identifier or persistent user ID.
Some of our infrastructure providers (see Section 9) use technical identifiers strictly to operate and secure the service — these are not used to build a profile of you or track your activity across sessions.
6. How we use the data
StreetSmart uses beta and pilot data to:
- analyse how streets and public spaces are experienced;
- assess visible street conditions from uploaded images;
- compare lived experience with physical street conditions;
- identify priority areas for improvement;
- produce visual maps, summaries, reports and recommendations;
- support audits, walkshops, pilot studies and planning discussions;
- improve the StreetSmart methodology and beta platform.
Where StreetSmart is used as part of a specific audit, walkshop or pilot, the methodology and outputs may be adapted to the context and objectives of that project.
7. AI-assisted analysis
StreetSmart uses AI-assisted tools to analyse visible street conditions in uploaded images, such as pavements, crossings, shade, greenery, traffic conditions and other liveability indicators.
These tools support street-level urban analysis. They are not used to identify individuals.
AI-assisted analysis may be reviewed, validated or corrected by the StreetSmart team or project partners as part of the audit, walkshop or pilot process.
Unblurred, uploaded images are sent to Gemini which is an AI provider listed in Section 9. Text responses and comments are not sent to external AI providers. AI outputs are stored with the original submission. AI outputs are not manually reviewed before being shown to participants at the time of photo upload. AI outputs are reviewed and validated by the StreetSmart team before being included in any report, map, or output shared with pilot partners or the public.
8. Who can access the data
Access to beta and pilot data is limited to authorised members of the StreetSmart team, technical collaborators, and service providers who need access for the operation, maintenance, analysis or delivery of the beta, audit or pilot.
Access is limited through role-based permissions and appropriate security controls. Pilot partners can access aggregated outputs only.
9. Who we share data with
Where StreetSmart is used as part of a specific audit, walkshop or pilot, aggregated findings and selected aggregated or minimized data outputs may be shared with the organisation commissioning, hosting or participating in that project, such as a municipality, university, NGO or planning partner.
These outputs may include maps, charts, summaries, visual evidence, street-level observations, priority areas, recommendations and selected comments where they do not directly identify an individual.
We may also use service providers to host, store, process, analyse or secure the data. These providers may only process data for the purposes described in this policy and under appropriate contractual safeguards.
| Provider | What they do, data involved | Location & transfer basis |
|---|---|---|
| Oracle | VPS hosting; stores and processes all user submitted data and photos. VPS stores blurred images. | Arizona, USA. Privacy policy includes DPA. Oracle America, Inc. (and its covered U.S. subsidiaries) is fully certified under the EU-U.S. Data Privacy Framework (DPF), the UK Extension, and the Swiss-U.S. DPF. |
| Cloudflare, Inc | CDN/security in front of the app; processes IP + request metadata and proxies all user submitted data to our Oracle VPS. Cloudflare uses its data to share anonymized usage statistics with us. | Global network including EU edge. International transfers are covered by Standard Contractual Clauses and/or Cloudflare's certification under the EU-U.S., Swiss-U.S., and UK Data Privacy Frameworks. See Cloudflare's privacy policy and DPA for full details. |
| Google, LLC (Gemini AI) | AI analysis of submitted images via a paid Gemini API. Receives your un-blurred photo. | US company. Transfers outside EEA are protected by appropriate safeguards including Google’s self-certification under the EU-U.S. Data Privacy Framework (DPF). Additionally, our data processing agreement with Google incorporates the European Commission’s Standard Contractual Clauses (SCCs) to secure these transfers contractually. Under our enterprise agreement, Google is restricted from using your data to train its public models. Privacy policy includes DPA. |
| Microsoft (GitHub) | Hosts www.livestreetsmart.com; logs IP/request data | US company with global CDN. Transfers outside EEA are protected by appropriate safeguards including Standard Contractual Clauses and GitHub's Data Privacy Framework certification. GitHub's handling of this data is described in the GitHub Privacy Statement. |
| OpenStreetMap Foundation | Geocode photo in background of analysis; receives your IP address/request data and the photo’s location | Their terms of use say for residents EU, EEA, or EFTA, your information will be stored and processed in accordance with the GDPR. Privacy policy. |
| Geoapify | Map tile in background of analysis; receives your IP address/request data and photo’s approximate location | European company processing in EU; privacy policy |
| OpenFreeMap | Map tiles; receives your IP address/request data | European company processing in EU; privacy policy |
10. International access and transfers
StreetSmart is based in France, Europe, but our team, technical collaborators, service providers, pilot partners or project contexts may involve countries outside the European Economic Area.
Where personal data is accessed from or transferred outside the European Economic Area, we use appropriate safeguards where required, such as contractual, organisational and technical measures designed to protect the data.
11. How long we keep data
We retain beta and pilot submission data for up to 24 months after collection, unless a shorter retention period is agreed for a specific audit, walkshop or pilot.
Email addresses collected for report delivery are retained only as long as needed to send the report and resolve any related support request, and are then deleted within 30 days.
If you opt in to receive news and insights when providing your email address, we retain your email address for that purpose until you unsubscribe or withdraw consent, whichever comes first. You can withdraw this consent at any time using the unsubscribe link in any email we send, or by contacting us at [email protected]. Withdrawing consent does not affect emails already sent or the delivery of a report you've already requested.
Where a paid transaction requires us to retain payment confirmation records for accounting or tax purposes, we retain that limited transaction metadata for the period required by applicable law, after which it is deleted.
After this period, submission data (photos, location data, responses, demographic information, comments, and AI outputs) will be deleted or irreversably anonymized. This includes deletion from our active cloud storage and analytics tools. Technical logs described in Section 3.6 (such as IP addresses and API server logs) are not linked to a specific submission and are therefore retained and deleted on their own fixed schedule regardless of submission deletion requests.
12. Security measures
StreetSmart uses practical security measures to reduce the risk of unauthorised access, misuse, loss or disclosure of beta and pilot data. These measures may include limiting data collection, restricting access, and using automated tools designed to blur identifying details where detected.
13. Your rights
Depending on your location and applicable law, you may have the right to:
- access the personal data we hold about you;
- request correction of inaccurate data;
- request deletion of your submission;
- withdraw consent;
- object to certain types of processing;
- request restriction of processing;
- request a copy of your submitted data in a structured, commonly used, machine-readable format;
- lodge a complaint with a data protection authority.
Because StreetSmart does not ask for your name, email address or account details, we may need your submission (run) ID to locate your data. You can retrieve this ID through your browser history. If you’re not able to provide the submission ID, please provide information like the approximate submission time, location, and photo to help us identify your submissions.
To exercise your rights, contact [email protected].
If you are in France, you may lodge a complaint with the CNIL. If you are in another EU country, you may contact your national data protection authority.
14. Consent
Before using StreetSmart beta, participants must confirm that they have read this privacy policy and consent to StreetSmart processing their uploaded photo, location data and responses for the purposes of street-level urban research and analysis.
Participation is voluntary. Participants may choose not to submit a response. Optional questions may be skipped.
The consent checkbox appears before upload. Optional demographic questions can be skipped.
15. Children and young participants
StreetSmart beta is intended for participants aged 18 and over. People under 18 should not use the app unless they are taking part in a supervised audit, walkshop or pilot with appropriate consent and safeguards.
16. Changes to this policy
We may update this privacy policy as the StreetSmart beta develops or as audits and pilots evolve.
If we make significant changes, we will update the ‘last updated’ date at the top of this page.
17. Contact
For questions about this privacy policy or your data, contact:
StreetSmart
Email: [email protected]