What's new

26 September 2026

For citizens

• An email on every status change, for real: emails go out through a real delivery provider, with a queue that retries when a send fails.
• Privacy notice on the form (GDPR article 13) and a link to each town’s privacy page.
• Zero cookies on the form and status page: the language goes in the address or is kept in the browser.
• Bot protection on the form: a honeypot field, a Tor-network block and Cloudflare Turnstile when the town enables it.

For town halls

• Permanent QR links (/q/<code>): the destination can change without reprinting the poster, and every scan is counted. Printable QR poster from the back office.
• Automatic anonymisation: contact data, photos and stored email copies of closed requests are anonymised 24 months after closing (configurable per town). Requests nobody confirms are deleted after 30 days.
• Back office in Catalan, Spanish and English.
• The back office’s classification suggestion is now labelled as an automatic suggestion: it is keyword-based, not artificial intelligence.

Documentation

• The compliance page explains each party’s role (the town hall is the controller; EnaInbox, the processor), the notice on the form, data retention and how to publish the accessibility statement.
• Features that do not exist yet were removed from the docs and are now marked “coming soon”: automatic translation, a one-line form embed, history import and more languages.
• Prices were removed: EnaInbox is contracted with a quote for each town, always within a Spanish minor contract.