Privacy policy

Data controller

Controller

Digilac Sàrl

Address

Espace de l'Europe 2, 2000 Neuchâtel, Suisse

Contact

hello@swissopendata.com

Digilac Sàrl determines the purposes and means of the personal-data processing carried out as part of the Swiss Open Data service.

The service is primarily aimed at users in Switzerland and is not specifically directed at the European Union or EEA market.

Data we process

Account data

When you create an account, our authentication provider (Clerk) processes your email address and sign-in credentials. We do not store your password.

Conversation content

The questions you ask and the answers generated are stored so you can find your history across devices, together with any share links you create.

Usage and billing data

We process your credit usage and subscription status. Payments are handled by our payment provider Stripe, which processes your billing data; we never receive your full card number.

Technical data

Like any online service, we process technical logs (IP address, browser type, timestamp) needed for security and reliable operation. Analytics (PostHog) only takes place with your consent — see the Cookies section.

Purposes and legal bases

We process your data to: (a) provide and secure the service; (b) manage your account and subscription; (c) respond to your requests; (d) comply with legal obligations; and (e) with your consent, measure and improve usage of the service.

The FADP permits processing that is necessary to perform our contract with you, based on our legitimate interests (providing a secure and reliable service), or required by a legal obligation; analytics relies on your consent. To the extent that EU law (the GDPR) applies to a given processing activity, the corresponding legal bases would be performance of the contract (art. 6(1)(b)), legitimate interest (art. 6(1)(f)), legal obligation (art. 6(1)(c)) and consent (art. 6(1)(a)).

Email communications

We use your email address for service-related messages (such as the welcome email) and for important product announcements sent to our users as existing customers; every email contains an unsubscribe link. The newsletter is only sent if you explicitly subscribe. You can manage these preferences at any time from the Newsletter page or via the unsubscribe link.

Your conversations and AI

To generate an answer, the content of your question is sent, through the OpenRouter gateway, to an inference host that runs the AI model and processes it as a sub-processor. We only use zero-data-retention hosts: your inputs are neither kept after processing nor used to train models.

Important: do not include in your questions sensitive or confidential data that you do not want processed by a third-party service. The service is designed to query official public data, not to process your sensitive personal data.

Sub-processors and recipients

We use carefully selected providers that process data on our behalf under data-processing agreements:

Clerk

Authentication and account management — United States.

OpenRouter

AI model gateway (request routing) — United States.

AI inference hosts

Run the AI models; hosts selected through OpenRouter, zero data retention — United States.

Stripe

Payment processing and billing — Ireland / United States.

PostHog

Analytics, with consent — EU region.

Neon

Database (conversation history) — EU region.

Vercel

Application hosting — United States.

Resend

Email delivery — EU region.

Infomaniak

Hosting of our mailbox (correspondence with you) — Switzerland.

We do not sell your personal data. We only disclose it to authorities where the law requires it.

Transfers abroad

Some providers are located outside Switzerland, notably in the United States. Such transfers are governed by appropriate safeguards — standard contractual clauses and/or adequacy decisions recognised by Switzerland — to ensure an adequate level of protection consistent with the FADP.

Retention periods

We keep your data for as long as your account is active. Your conversation history is retained until you delete it or close your account. Billing data is kept for as long as required by legal (notably accounting) obligations. When you close your account, your data is deleted or anonymised within a reasonable period, subject to mandatory retention obligations.

Your rights

Under the FADP, you have in particular the following rights:

• access your data and obtain a copy;
• rectify inaccurate data;
• request erasure of your data;
• request restriction of, or object to, certain processing;
• receive your data in a portable format (right to data release);
• withdraw your consent at any time, without retroactive effect.

To exercise these rights, write to hello@swissopendata.com. You may also lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland; to the extent the GDPR applies, you may contact your local supervisory authority in the EU/EEA.

Cookies and analytics

We use cookies that are strictly necessary for the service to work and, only with your consent, analytics cookies. Details and how to manage your choice are in our cookie policy.

Security

We implement appropriate technical and organisational measures (encryption in transit, access control, certified providers) to protect your data against loss, misuse and unauthorised access. No online service can, however, guarantee absolute security.

Children

The service is not directed at children. You must be at least 16 to create an account.

Changes and contact

We may update this policy; the date at the top of the page shows the last revision. For any data-protection question: hello@swissopendata.com.