StreetSmart Privacy Policy
Last updated: June 1, 2026
Project: StreetSmart
Contact: [email protected]
Data controller: Reena Mahajan, operating the StreetSmart private beta
Legal entity: In formation
1. Scope of this policy
This privacy policy applies to the StreetSmart private beta, including audits, walkshops, pilot studies and related research or engagement activities carried out through the StreetSmart web app.
StreetSmart collects street-level information to understand how public spaces are experienced and how they perform in everyday use. This may include uploaded street photos, location data, participant responses, optional demographic information and open-ended comments.
We do not ask for your name, email address or account details. However, because photos, precise location data and comments may sometimes reveal information about a person, we treat beta and pilot submissions as personal data.
2. Who we are
StreetSmart is a civic-tech platform and methodology for understanding how streets and public spaces are experienced. We collect and analyse street-level information to support urban research, audits, pilot studies, planning conversations and public-space decision-making.
Until the StreetSmart legal entity is created, Reena Mahajan, operating the StreetSmart private beta, is the data controller for the information collected through the app, unless a specific pilot agreement states otherwise.
For questions about this policy or your data, contact [email protected].
3. What data we collect
When you use the StreetSmart beta, we collect the following categories of data, depending on what is submitted and how the app is used.
3.1 Uploaded street photo
You may upload a photo of a street, public space or selected street segment.
We use the uploaded image to analyse visible street conditions, such as pavements, crossings, shade, greenery, traffic conditions, public-space quality and other liveability indicators.
Before storing uploaded images, we use automated tools designed to blur faces, licence plates and visible house numbers where detected. Because automated detection may not be perfect, participants should avoid uploading images where people, private addresses or other identifying details are clearly visible.
Temporary, unblurred images are transitively processed by our AI provider to analyze street conditions, after which a blurred version is permanently stored. Unblurred images are not permanently stored or visible to the StreetSmart team, developers, or pilot partners.
3.2 Location data
StreetSmart collects location data for the street or public space shown in the uploaded photo.
Participants are asked whether they are at the location where the photo was taken. If they answer yes, StreetSmart stores the location to assess the street in context. If they answer no, StreetSmart does not store the location.
Location data comes from image metadata and device/browser geolocation. StreetSmart stores full-precision GPS coordinates. StreetSmart may request browser or device geolocation permission.
We use location data to assess the street in context, map responses, and analyse conditions at the level of specific street segments or public spaces.
3.3 Street perception responses
StreetSmart asks participants to respond to short prompts about how a street or public space feels and functions. This may include questions about safety, comfort, ease of movement, crossing, waiting, resting, shade, noise, traffic, greenery or other street-level conditions.
3.4 Optional demographic information
StreetSmart may ask for optional demographic information, such as age range and gender.
This information helps us understand whether different people experience the same street or public space differently. For example, it may help reveal whether safety, comfort or accessibility is experienced differently by different groups.
This information is not linked to your name, email address, or account details.
The demographic questions asked are:
- What is your age group?
- How are you using this street today?
- Please share your gender if you're comfortable.
Demographic responses are optional. Demographic responses are stored with the same submission record. Demographic responses can be linked to the uploaded photo, location and responses through a submission ID.
3.5 Free-text comments
Participants may leave open-ended comments about the street or public space.
Please do not include personal information in comments, such as your name, address, contact details, details about other individuals, or information that could identify you or someone else. Free-text comments are reviewed before being used in reports. Free-text comments are stored with the same submission record.
3.6 Technical data
Even though StreetSmart does not ask for names, email addresses or account details, some technical data may be collected automatically when the app is used. This may include IP address, browser type, device type, operating system, date and time of access, referring page, error logs, security logs or analytics events. We use this technical data only to operate, secure, and debug the app.
When a user connects to api.livestreetsmart.com (usually via try.livestreetsmart.com), we collect IP addresses and aforementioned other technical data in server logs. These logs are retained for up to 15 days, after which they are automatically deleted.
Cookies, local storage or similar technologies are used to verify the user has obtained a valid access code for the app. Cookies are not correlated with submitted photos, locations, or responses. Cookies are also used to store privacy policy consent.
Similar technical information may be shared with our data processors as detailed in Section 9 to operate, secure, and debug the services they supply to us.
4. Lawful basis for processing
StreetSmart relies on consent for data actively submitted by participants, including uploaded photos, location data, street perception responses, optional demographic information and free-text comments.
StreetSmart relies on legitimate interest for limited technical data needed to operate, secure, maintain and debug the app. Where analytics, cookies or similar technologies require consent, StreetSmart will request consent before using them.
Participants may withdraw consent at any time by contacting [email protected]. Because StreetSmart does not ask for names, email addresses or account details, we may need the submission ID to locate and delete a specific submission. If you’re not able to provide the submission ID, please provide information like the approximate submission time, location, and photo to help us identify your submissions.
5. What we do not collect
StreetSmart does not ask participants to create an account.
We do not ask for:
- name;
- email address;
- phone number;
- postal address;
- account login;
- payment information.
We do not use participant data for advertising, individual tracking, commercial resale, or automated decision-making that produces legal or similarly significant effects.
The app does not create a user session, device identifier or persistent user ID.
Cloudflare, GitHub Pages, and other security/performance services listed below may create persistent identifiers as described in Section 9.
6. How we use the data
StreetSmart uses beta and pilot data to:
- analyse how streets and public spaces are experienced;
- assess visible street conditions from uploaded images;
- compare lived experience with physical street conditions;
- identify priority areas for improvement;
- produce visual maps, summaries, reports and recommendations;
- support audits, walkshops, pilot studies and planning discussions;
- improve the StreetSmart methodology and beta platform.
Where StreetSmart is used as part of a specific audit, walkshop or pilot, the methodology and outputs may be adapted to the context and objectives of that project.
7. AI-assisted analysis
StreetSmart uses AI-assisted tools to analyse visible street conditions in uploaded images, such as pavements, crossings, shade, greenery, traffic conditions and other liveability indicators.
These tools support street-level urban analysis. They are not used to identify individuals.
AI-assisted analysis may be reviewed, validated or corrected by the StreetSmart team or project partners as part of the audit, walkshop or pilot process.
Unblurred, uploaded images are sent to Gemini which is an AI providers listed in Section 9. Text responses and comments are not sent to external AI providers. AI outputs are stored with the original submission. AI outputs are not manually reviewed before being shown to users. AI outputs will be reviewed before being included in reports.
8. Who can access the data
Access to beta and pilot data is limited to authorised members of the StreetSmart team, technical collaborators, service providers and project partners who need access for the operation, maintenance, analysis or delivery of the beta, audit or pilot.
Access is limited through role-based permissions and appropriate security controls. Pilot partners can access aggregated outputs only.
9. Who we share data with
Where StreetSmart is used as part of a specific audit, walkshop or pilot, aggregated findings and selected aggregated or minimized data outputs may be shared with the organisation commissioning, hosting or participating in that project, such as a municipality, university, NGO or planning partner.
These outputs may include maps, charts, summaries, visual evidence, street-level observations, priority areas, recommendations and selected comments where they do not directly identify an individual.
We may also use service providers to host, store, process, analyse or secure the data. These providers may only process data for the purposes described in this policy and under appropriate contractual safeguards.
| Provider | What they do, data involved | Location & transfer basis |
|---|---|---|
| Oracle | VPS hosting; stores and processes all user submitted data and photos. VPS stores blurred images. | Arizona, USA. Privacy policy includes DPA. Oracle America, Inc. (and its covered U.S. subsidiaries) is fully certified under the EU-U.S. Data Privacy Framework (DPF), the UK Extension, and the Swiss-U.S. DPF. |
| Cloudflare, Inc | CDN/security in front of the app; processes IP + request metadata and may proxy all user submitted data to our Oracle VPS. Cloudflare uses its data to share anonymized usage statistics with us. | Global network including EU edge; Privacy policy includes DPA. When Cloudflare transfers personal data from the EEA, Switzerland, or the United Kingdom (“UK”) internationally, we rely on the European Commission's Standard Contractual Clauses (“SCCs”), including supplementary measures as necessary, or, for transfers to the United States, we have also certified our compliance with the EU-U.S. Data Privacy Framework (“EU-U.S. DPF”), the Swiss-U.S. Data Privacy Framework (“Swiss-U.S. DPF”), and/or the UK extension to the EU-U.S. DPF. Our standard Data Processing Addendum (“DPA”) will continue to incorporate the EU SCCs to ensure we have multiple legal bases for processing data. |
| Google, LLC (Gemini AI) | AI analysis of submitted images via a paid Gemini API. Receives your un-blurred photo. | US company. Transfers outside EEA are protected by appropriate safeguards including Google’s self-certification under the EU-U.S. Data Privacy Framework (DPF). Additionally, our data processing agreement with Google incorporates the European Commission’s Standard Contractual Clauses (SCCs) to secure these transfers contractually. Under our enterprise agreement, Google is restricted from using your data to train its public models. Privacy policy includes DPA. |
| Microsoft (GitHub) | Hosts www.livestreetsmart.com; logs IP/request data | US company with global CDN. Transfers outside EEA are protected by appropriate safeguards including Standard Contractual Clauses and GitHub's Data Privacy Framework certification. GitHub's handling of this data is described in the GitHub Privacy Statement. |
| OpenStreetMap Foundation | Geocode photo in background of analysis; receives your IP address/request data and the photo’s location | Their terms of use say for residents EU, EEA, or EFTA, your information will be stored and processed in accordance with the GDPR. Privacy policy. |
| Geoapify | Map tile in background of analysis; receives your IP address/request data and photo’s approximate location | European company processing in EU; privacy policy |
10. International access and transfers
StreetSmart is based in France, Europe, but our team, technical collaborators, service providers, pilot partners or project contexts may involve countries outside the European Economic Area.
Where personal data is accessed from or transferred outside the European Economic Area, we use appropriate safeguards where required, such as contractual, organisational and technical measures designed to protect the data.
11. How long we keep data
We retain beta and pilot submission data for up to 24 months after collection, unless a shorter retention period is agreed for a specific audit, walkshop or pilot.
After this period, the data will be deleted or irreversibly anonymised. Deleted submissions are deleted from backups, logs, analytics tools, AI providers and cloud storage. Technical logs, IP addresses and error logs are retained as explained above.
12. Security measures
StreetSmart uses practical security measures to reduce the risk of unauthorised access, misuse, loss or disclosure of beta and pilot data. These measures may include limiting data collection, restricting access, and using automated tools designed to blur identifying details where detected.
13. Your rights
Depending on your location and applicable law, you may have the right to:
- access the personal data we hold about you;
- request correction of inaccurate data;
- request deletion of your submission;
- withdraw consent;
- object to certain types of processing;
- request restriction of processing;
- lodge a complaint with a data protection authority.
Because StreetSmart does not ask for your name, email address or account details, we may need your submission (run) ID to locate your data. You can retrieve this ID through your browser history. If you’re not able to provide the submission ID, please provide information like the approximate submission time, location, and photo to help us identify your submissions.
To exercise your rights, contact [email protected].
If you are in France, you may lodge a complaint with the CNIL. If you are in another EU country, you may contact your national data protection authority.
14. Consent
Before using StreetSmart beta, participants must confirm that they have read this privacy policy and consent to StreetSmart processing their uploaded photo, location data and responses for the purposes of street-level urban research and analysis.
Participation is voluntary. Participants may choose not to submit a response. Optional questions may be skipped.
The consent checkbox appears before upload. Optional demographic questions can be skipped.
15. Children and young participants
StreetSmart beta is intended for participants aged 18 and over. People under 18 should not use the app unless they are taking part in a supervised audit, walkshop or pilot with appropriate consent and safeguards.
16. Changes to this policy
We may update this privacy policy as the StreetSmart beta develops or as audits and pilots evolve.
If we make significant changes, we will update the ‘last updated’ date at the top of this page.
17. Contact
For questions about this privacy policy or your data, contact:
StreetSmart
Email: [email protected]
Legal entity: In formation