Privacy Policy

1. Controller

The party responsible for processing your personal data within the meaning of the Swiss Federal Act on Data Protection (revFADP) and — where applicable — the EU General Data Protection Regulation (GDPR) is:

Hasijew Applications, c/o Wladimir Hasijew
Terrassenweg 4, 5507 Mellingen, Switzerland
Email: [email protected]

Note for business customers: Where you use the Service as a business and upload personal data about your own users or employees, you are the controller for that data and we act as your processor. In that case our Data Processing Agreement governs that processing, and this Privacy Policy covers only the data we process as controller (such as your account and billing data).

2. Scope & EU/EEA Users

Our applications are operated from Switzerland and are not specifically directed at individuals in the EU/EEA or the United Kingdom: we do not use EU/UK languages or currencies to target those markets and do not market to them. The mere fact that the Service is accessible from, or used by individuals located in, the EU/EEA does not by itself make it "directed" at that market. We have therefore not appointed a representative under Art. 27 GDPR. Where the GDPR or UK GDPR nonetheless applies to a particular processing activity, we honour the data subject rights set out in this policy regardless.

3. Categories of Personal Data We Process

• Account data: name, email address, password hash, selected plan.
• Usage data: log data, feature usage, session duration.
• Technical data: IP address, browser type, operating system, device and timezone.
• Communication data: support requests and email correspondence.
• Payment data: processed exclusively by Stripe Payments Europe, Ltd. We never receive or store full card numbers or CVV codes — only a tokenised reference, the last four digits, card brand and expiry, plus billing metadata (amount, date, plan).

4. Purposes and Legal Bases

Under the revFADP, processing personal data does not generally require a specific legal basis but must be lawful, proportionate, transparent and in good faith. Where the GDPR applies, we rely on the legal bases shown below.

5. Service Providers (Processors)

We share personal data only with carefully selected providers who process it on our behalf under a data processing agreement, and only to the extent necessary to operate the Service.

6. International Data Transfers

Our hosting infrastructure (Hetzner and OVHcloud) is located in the EU/EEA, for which Switzerland and the EU recognise an adequate level of protection. Some providers may process data in the United States:

• Cloudflare provides our content delivery, security and object storage. It processes connection data (including IP addresses) and stores content data on a global network, which may include locations in the US. Transfers are safeguarded by EU Standard Contractual Clauses (with the Swiss addendum recognised by the FDPIC) and the EU-US / Swiss-US Data Privacy Framework.
• Google (Analytics) may transfer data to the US under the same safeguards. Analytics is loaded only after consent, and IP addresses are anonymised.
• Stripe operates through its EU entity; limited support and fraud-prevention functions may involve US systems, safeguarded by SCCs and the DPF.

7. Retention

• Account data: until you delete your account, then erased within 30 days unless statutory retention applies.
• Accounting / invoice data: 10 years, as required under Art. 958f of the Swiss Code of Obligations.
• Log data: maximum 90 days.
• Support correspondence: 3 years after the matter is closed.

8. Your Rights (Switzerland & EU/EEA)

Subject to legal limits, you have the right to:

• Access your personal data (Art. 25 revFADP / Art. 15 GDPR);
• Rectify inaccurate data (Art. 32 revFADP / Art. 16 GDPR);
• Erasure of your data (Art. 32 revFADP / Art. 17 GDPR);
• Restrict or object to processing (Art. 18 / 21 GDPR);
• Data portability (Art. 28 revFADP / Art. 20 GDPR);
• Withdraw consent at any time with future effect.

To exercise these rights, contact [email protected]. You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch) or, if the GDPR applies to you, with your local EU/EEA supervisory authority.

9. Your U.S. State Privacy Rights

If you are a resident of a U.S. state with a comprehensive privacy law (such as California, Colorado, Connecticut, Virginia, Texas and others), you may have additional rights, including the right to know, access, correct and delete your personal information, and to opt out of its sale or of targeted advertising.

We do not sell your personal information and do not share it for cross-context behavioural advertising. To exercise any U.S. privacy right, email [email protected]; we will verify your request and respond within the timeframe required by applicable law.

10. Data Security

We apply appropriate technical and organisational measures to protect your data against unauthorised access, loss or manipulation. All data is transmitted over TLS-encrypted connections (HTTPS), passwords are stored as salted bcrypt hashes, and access is restricted on a need-to-know basis.

11. Changes to this Policy

We may update this Privacy Policy to reflect changes in the law or our service. For material changes, registered users will be notified by email. The version in force at the time of use applies.