Privacy policy

The controller responsible for the processing of data is:

• IDS Business Live AG
• Badenerstrasse 808
• 8048 Zürich
• Switzerland
• hello@webfactory-os.ch
• +41 58 590 99 98

When the website is accessed, the infrastructure generates technically necessary server and security logs, in particular the IP address, time of access, requested resource, user agent, and technical error/security information.

Purposes: operating the website, security, protection against abuse, and error analysis.

During the order process we process company data, contact person data, contact details, billing address, project data, requirements, text entries, design preferences, add-ons and other details entered by the Customer.

Even before an order is placed – as a prerequisite for the free visualisation (section 6) – we collect first name, last name, email address, phone number, company name and, where provided, the domain or existing website. Purposes: assigning and providing the visualisation, resuming the project that has been started, and contacting the Customer about the requested project. This does not create any payment obligation.

For a consultation request, we process the details entered in the request form (contact details, company name, domain and message) in order to handle and answer the request. Our team is notified internally by email about a new request (section 10).

A technically necessary order-draft/session cookie is set for this purpose. It is accessible via HTTP only (HttpOnly), restricted to "Lax" (SameSite=Lax), transmitted only over a secure connection in production (Secure), and valid for around 30 days. It is not a marketing or tracking cookie, but a purely technically necessary cookie used to resume a draft that has already been started.

After an order is completed, we store the order, an immutable order snapshot, the invoice, the payment status, the consented document versions (Terms/Privacy Policy) and other data required for the performance of the contract.

Files voluntarily uploaded by the Customer may contain personal data. We process these exclusively for the handling of the respective project, unless another legal basis or purpose agreement applies.

Uploaded documents are not used for unrelated third-party projects.

Before placing an order, the Customer can have three design directions for their project visualised free of charge and without obligation. The visualisations shown serve solely as non-binding guidance; they are not a finished website and do not automatically become the website.

To create these visualisations we use an external AI service: Google Stitch (Google LLC, USA). In doing so, we transmit exclusively project-related details from the project profile, in particular:

• company name and product type (website or online shop),
• industry, description of the company and its offering, target groups, region, unique selling points and goals,
• desired pages, features and shop categories,
• style and design preferences (style direction, colours, fonts, details on an existing corporate design or logo, design notes, reference websites named),
• details on the status of texts, images and available materials as well as the SEO focus.

Contact details of the contact person, billing or payment data, uploaded files and other non-project data are not transmitted. The Customer is asked not to enter personal data of third parties in the free-text fields of the project profile.

We transfer the generated visualisations to our own storage (hosted in Switzerland, section 12). We delete the project created at the AI service for the generation after this transfer; we have no influence over any retention on the provider's side. Processing by the AI service may take place in the USA (section 13).

The visualisation process does not carry out any automated decision-making with legal or similarly significant effects on a person. The actual website or online shop is designed and built manually by our team after an order has been placed.

For the purpose of project handling, we store project requirements, queries, approvals, comments, revisions, design preferences, project files and related communication.

Contract and accounting records are stored in accordance with statutory retention obligations. Business books and accounting vouchers may in particular be subject to a ten-year retention obligation.

Webfactory OS runs on infrastructure provided by Infomaniak Network SA, Geneva, Switzerland. Data is hosted in Switzerland.

Transactional emails (e.g. order confirmation, invoice, order documents) as well as internal notifications to our team about new consultation and project enquiries are sent via:

• Resend / Plus Five Five, Inc., USA.

In doing so, the following data may in particular be processed:

• recipient email address
• sender data
• subject line
• message body
• invoices or order documents as attachments
• technical delivery/transmission data

This may involve data processing in the USA as well as by international sub-processors. We apply the contractual and data-protection safeguards provided for this purpose (including a data processing agreement with the provider).

The application itself does not currently implement email open or click tracking. We make no representation regarding technical metadata that the delivery provider itself may process internally.

Webfactory OS currently does not use marketing or visitor analytics tracking through an external analytics provider. Internal, provider-neutral events (e.g. for error analysis during development) are not currently sent to such a provider.

Should tools such as Google Analytics or Meta Pixel be activated in future, this privacy policy and, where required, a consent solution will be updated accordingly beforehand.

Data is only disclosed to the extent required for contract performance, hosting, email delivery, the creation of the visualisations, technical services, statutory obligations, or the legitimate pursuit of legal claims.

Specific categories and recipients:

• Hosting infrastructure and storage (including drafts, uploads and visualisations): Infomaniak Network SA, Switzerland.
• Email delivery: Resend / Plus Five Five, Inc., USA.
• AI visualisation (exclusively project-related details as per section 6): Google Stitch / Google LLC, USA.

Not all data remains in Switzerland: email delivery via Resend and the creation of the visualisations via Google Stitch (project-related details only, section 6) may involve processing in the USA and by international sub-processors.

For any such transfer, we apply the safeguards provided for under Swiss data protection law.

We process personal data only for as long as necessary for the respective purpose, contract performance, statutory retention obligations, or the defence of legal claims.

Accounting records are retained in accordance with statutory deadlines.

Drafts and other temporary data are deleted or anonymised after a reasonable period, provided no order results and no other retention reason applies.

Under the Swiss Federal Act on Data Protection (FADP), data subjects have, in particular, a right to access and, where applicable, to rectification, erasure and other statutory data subject rights.

Please direct any such requests to: hello@webfactory-os.ch

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss and misuse. Like any provider, we cannot guarantee absolute security.