Skip to content
UeliUeliAssistent
Beta-Phase Notice: The software is in beta: features and availability may still change. The legal texts below remain binding in their published version, regardless of the beta status.

This translation is provided for convenience. The German version is legally binding.

Privacy Policy

Effective 10 June 2026 · Version 1.0 · Beta · Governed by the Swiss Federal Act on Data Protection (revDSG, in force since 1 September 2023).

1. Controller

Controller within the meaning of Art. 5(j) revDSG (Swiss DPA):

Ueli Iff
Address on request, Switzerland
Email: [email protected]

You can exercise your right of access and right to erasure at any time directly inside the application under «My account».

2. Overview

  • No third-party trackers, no advertising tracking. Only strictly necessary authentication cookies.
  • AI models run sovereignly on our own infrastructure in Switzerland. Your inputs are not sent to OpenAI, Anthropic or other third parties unless explicitly enabled in tenant settings.
  • Hosting in the EU (Germany), GDPR-compliant. All content data resides on servers in a certified data centre in the EU (Germany). AI processing runs sovereignly in Switzerland.
  • Strict tenant isolation enforced at database level.

3. Data we process

3.1 When visiting the website (no login)

  • IP address (truncated after 24h, fully deleted after 30 days)
  • Date and time
  • URL and HTTP status
  • Bytes transferred
  • Referrer
  • User agent (browser, OS)

Legal basis: Art. 31(1)(d) revDSG (legitimate interest in security). Retention: 30 days.

3.2 At sign-up (account)

  • Email address (required)
  • First and last name (optional)
  • Encrypted password (industry-standard hashing, per-user salt)
  • Assigned roles and tenant memberships
  • Last login timestamp
  • Optional: second factor if enabled

Legal basis: Art. 31(1) revDSG. Retention: until account deletion or 24 months of inactivity.

3.3 When using the chatbot

  • Your questions and AI answers (per session, for history)
  • Uploaded documents (encrypted object storage in the EU / Germany, GDPR-compliant)
  • Search indexes and mathematical representations of your documents
  • Audit log of document accesses (pseudonymised, Art. 12 revDSG)

3.4 When contacting us

Email contact data is processed to handle your request. Retention 36 months from last contact.

4. Cookies

We exclusively use strictly necessary cookies (session, SSO, locale, theme). No separate consent required under Swiss law because these cookies are indispensable for providing the service expressly requested by the user.

5. AI processing of your content

All language models run on our own infrastructure in Switzerland. Your inputs never leave our infrastructure. We exclusively use models that are not trained on user input. Model logs are pseudonymised and deleted after 7 days at the latest.

Tenant admins may opt in to commercial third-party providers in tenant settings; their respective privacy terms apply additionally. Disabled by default.

6. Recipients

6.1 Processors

  • EU hosting provider (Germany) — hosting of the application (servers, database, object storage) in a certified data center in the EU (Germany), GDPR-compliant. DPA under Art. 28 GDPR / Art. 9 revDSG in place. AI processing runs separately and sovereignly on our own infrastructure in Switzerland.
  • Cloudflare Inc., San Francisco (US) — DNS, CDN, DDoS protection. Transfer of network metadata only under Swiss SCCs; no content data.

6.2 Authorities

Only upon legal obligation under Swiss law.

6.3 Business transfer

On sale or merger, data becomes part of the transferred assets. You will be notified in advance and may object.

7. Cross-border disclosure

Application and all content data (documents, chat history, AI answers) are hosted in a certified data center in the EU (Germany); the EU is recognised under revDSG as a country with an adequate level of data protection and processing is GDPR-compliant. Network metadata only is transferred to Cloudflare (US) on the basis of Swiss SCCs (Art. 16 ff. revDSG). Content data is not transferred to the US or other third countries. AI processing runs sovereignly in Switzerland.

8. Your rights under the Swiss DPA

  • Right of access (Art. 25 revDSG)
  • Rectification (Art. 32(1) revDSG)
  • Erasure (Art. 32(2) revDSG) — 30-day grace period applies
  • Restriction of processing — upon request
  • Data portability (Art. 28 revDSG)
  • Objection on legitimate-interest grounds
  • Complaint with the Federal Data Protection and Information Commissioner (FDPIC), edoeb.admin.ch

9. Security

  • Industry-standard transport encryption (HTTPS only), HSTS one year
  • Strict tenant isolation at database level
  • Encrypted password storage with per-user salt
  • Token-based authentication, short-lived (1 hour) access tokens
  • Audit log of all document reads and writes
  • Daily encrypted off-site backups on separate hardware
  • Rate-limiting on all API endpoints
  • Server hardening: SSH key only, firewall, regular security updates

10. Changes to this policy

Material changes will be notified to registered users at least 14 days in advance.