What we collect, why, and what we do with it.

1. Who is responsible

The controller for the processing described here is [Legal name as registered], [Street and number], [Postcode] Lucerne, Switzerland, represented by Diego Miescher. Contact for anything about your data: the contact form. Full details are in the legal notice.

We process data under the Swiss Federal Act on Data Protection (FADP, revised 1 September 2023). For visitors and clients in the European Economic Area or the United Kingdom, the General Data Protection Regulation (GDPR) or the UK GDPR also applies, and this policy is written to meet both.

2. What we collect on the public website

Server logs

When you open a page, our hosting provider, Vercel, records the request: IP address, date and time, the page requested, the referring page, your browser and operating system. This is needed to deliver the page, to keep the site secure and to diagnose faults. Logs are kept for a short period by Vercel and are not combined with any other data about you. Legal basis: our legitimate interest in running a secure website (Art. 6(1)(f) GDPR; Art. 31 FADP).

Booking a call

Every "book a call" button leads to our booking page, where Calendly provides a short qualification form and, if you qualify, a calendar. Whatever you enter there, typically your name, email address, business details and your answers to the qualification questions, plus the slot you choose, is processed by Calendly and sent to us. Calendly notifies our team in a private Slack channel so we can prepare, and sends you the confirmation and reminder emails for the call. We use this data to prepare and hold the call and to follow up. Legal basis: steps prior to a contract at your request (Art. 6(1)(b) GDPR). If we do not work together, we keep the form data for 24 months in case you come back, then delete it, unless you ask us to delete it sooner.

Videos

Videos on this site are shown as a still image until you click play. Our own videos stream from Vercel. Loom videos load Loom's player only after your click, at which point Loom receives your IP address and may set its own cookies. Before the click, nothing is sent to Loom.

Email

If you email us, we keep the correspondence for as long as needed to deal with it and for our records, which is usually no longer than three years after the last message.

Newsletter

If you subscribe to the newsletter, we store your email address and the date and source of your consent, and use it only to send the newsletter. Every email carries an unsubscribe link. Legal basis: your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.

Calculators

The calculators run entirely in your browser. The numbers you enter are not sent to us.

Cookies on the public website

The public website sets no cookies of its own. Calendly on the booking page and the Loom player on client testimonials are third-party embeds that may set cookies once you interact with them, as described above. We do not use advertising cookies, analytics cookies, fingerprinting or cross-site tracking, so there is no cookie banner because there is nothing to consent to. If that changes, this page and the site will change with it.

3. What we collect in the client portal

The portal is for clients who have signed an engagement with us and for our team. Access requires an account we create for you.

Account data

Name, email address, role, a hashed password (we cannot read it), and a session cookie named portal_session that keeps you logged in. The session cookie is strictly necessary for the portal to work and is deleted when you log out or when it expires.

Onboarding and project data

The answers you give in the onboarding interview, your game plan, tasks, notes, results and updates, files you upload and files we upload for you. We use this to deliver the engagement. Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

Invoices and billing

Invoice details, amounts and payment status. Where you give us card details for billing, the card number and expiry are encrypted at rest with a key held outside the database, are never shown in the portal, and are revealed only to the person authorised to charge them. We keep invoices for ten years as required by Swiss accounting law (Art. 958f CO).

Communication channels

If you choose to work with us in Slack or share files through Google Drive, we create the channels and folders and the respective provider processes the messages and files under its own terms.

Drafting assistance

Some portal features use Anthropic's Claude models to draft or summarise text, for example a first draft of a game plan from your onboarding answers. The text sent for that purpose may include your business details. Anthropic processes it as our processor and does not use it to train models.

4. Who we share data with

We share personal data only with the service providers below, each of which processes it on our instructions under a data processing agreement, and only to the extent needed for the purpose stated. Some are in the United States. Switzerland recognises the US Data Privacy Framework for certified companies, and where a provider is not certified we rely on the standard contractual clauses recognised by the Swiss and EU authorities.

We may also disclose data when the law requires it, to enforce our terms, or to protect the rights and safety of a person. We do not sell personal data and we do not share it with advertisers.

5. How long we keep data

• Server logs: as set by Vercel, typically days to weeks.
• Booking form data where no engagement follows: 24 months.
• Client account and project data: for the duration of the engagement and three years after it ends, then deleted or anonymised, unless a legal retention period applies.
• Invoices and accounting records: ten years.
• Newsletter: until you unsubscribe.
• Email correspondence: up to three years after the last message.

6. Your rights

You can ask us to tell you what personal data we hold about you, to correct it, to delete it, to restrict how we use it, to give it to you in a portable format, and to stop processing that rests on legitimate interest. Where processing rests on consent, you can withdraw it at any time without affecting what happened before. To exercise any of these, write to us through the contact form. We answer within 30 days and may ask you to confirm your identity first.

If you believe we have handled your data unlawfully, you can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if you are in the EEA or the UK, to your local supervisory authority.

7. Security

All traffic to this site and the portal is encrypted in transit. Portal access requires a login. Passwords are hashed. Card data is encrypted at rest with a separate key. Access to client data inside our team is limited to the people working on that engagement. No system is perfectly secure; if a breach affecting your data ever occurs, we will tell you and the authorities as the law requires.

8. Children

This site and our services are for businesses. We do not knowingly collect data from anyone under 16.

9. Changes

When this policy changes, the date at the top changes with it. Material changes that affect portal clients are announced in the portal.

See also the terms of use, the legal notice and the results and testimonials disclosure.