Privacy Policy

Scope and demarcation

This Privacy Policy applies to business use of the hegyon.ai platform. For private use of the "Public Chat", the separate Public Chat Privacy Notice applies instead, and hegyon.ai acts as data controller for that use.

Introduction

This Privacy Policy explains how hegyon.ai, operated by Robert Santiago as a Swiss sole proprietorship (UID CHE-288.808.611), processes personal data in connection with our website and platform. It is intended to satisfy our obligations under the revised Swiss Federal Act on Data Protection (revFADP) and, where applicable to a given processing activity, the EU General Data Protection Regulation (GDPR).

Data Controller

Controller / data exporter:
Robert Santiago, sole proprietor d/b/a hegyon.ai
Lufingerstrasse 37
CH-8185 Winkel
Switzerland
UID CHE-288.808.611
Privacy contact: privacy@hegyon.ai · Legal contact: legal@hegyon.ai

We have not appointed a statutory Data Protection Officer (DPO): our processing does not currently meet the thresholds in Art. 10 revFADP or Art. 37 GDPR. The privacy contact above acts as our single point of contact for all data protection enquiries.

Data We Collect

We collect and process the following categories of personal data:

• Account and identity data, name, business email, organisation, role, authentication credentials (passwords are stored as Argon2id hashes, never in clear).
• Customer Data, documents, prompts, outputs and configurations you upload or generate; processing is governed by the Sensitive Data Guard described below.
• Usage and audit-chain data, actions taken in the platform with timestamps and the responsible user, sealed in the GeBüV-aligned audit chain.
• Technical data, IP address, user-agent string, session identifiers, basic device characteristics, retained for security, performance and abuse prevention.
• Communication data, messages submitted via contact forms, demo requests, and support tickets, plus our responses.
• Billing data, invoicing address, VAT/UID number, payment method metadata; we do not store full card data, payment processing is handled by our payment sub-processor.

Legal basis for processing

We process personal data only where we have a lawful basis under the revFADP and, where applicable, Art. 6 GDPR:

• Performance of a contract (Art. 31(1) revFADP / Art. 6(1)(b) GDPR), to operate the platform, manage your account and provide support.
• Legal obligation (Art. 31(2)(c) revFADP / Art. 6(1)(c) GDPR), to comply with Swiss accounting, tax and record-keeping rules, notably GeBüV and OR Art. 958f.
• Legitimate interests (Art. 31(2)(d) revFADP / Art. 6(1)(f) GDPR), to secure the platform, prevent abuse, run product-improvement analytics that do not allow us to identify individuals, and pursue or defend legal claims. Where we rely on legitimate interests we balance them against your fundamental rights and freedoms; you can object at any time.
• Consent (Art. 6(6) revFADP / Art. 6(1)(a) GDPR), for any processing that requires it, for example non-essential cookies. Consent can be withdrawn at any time with effect for the future.

How We Use Your Data

We process personal data for the following purposes:

• To provide, operate, secure and continuously improve the platform and the website.
• To respond to enquiries, demo requests, support tickets and other communications.
• To invoice for and account for our services, including issuing invoices and complying with Swiss accounting and tax obligations.
• To detect, investigate and prevent abuse, fraud, security incidents and breaches of these Terms.
• To comply with applicable laws and respond to lawful requests from public authorities.

Processing by AI models (Sensitive Data Guard)

The platform relies on external Large Language Model (LLM) providers (currently OpenAI, Anthropic and Google for end-user chat, and Mistral for back-office orchestration). Before any prompt is forwarded to an external LLM, our Sensitive Data Guard classifies the content and masks or blocks personal, contract and financial data. Only the released, non-identifying content is transmitted.

External LLM providers are bound by contractual no-training agreements, your Customer Data and the masked content sent on your behalf are not used to train or improve their models. The current list of LLM providers, including hosting region and applicable transfer mechanism (EU-US Data Privacy Framework / Standard Contractual Clauses), is maintained on our Trust Center.

Where you exercise an option that bypasses the Guard (for example, an explicit opt-in to send unmasked content to a specific provider for a specific use case), the relevant terms are surfaced in the user interface and the action is recorded in the audit chain.

Sub-processors

We use a small set of carefully selected sub-processors to operate the platform, including our Swiss hosting provider (Hostpoint AG, Zürich, ISO 27001-certified data centres), the external LLM providers listed above, and our transactional email, payment and analytics providers. The current sub-processor list with name, role, location and transfer mechanism is published on our Trust Center and updated whenever it changes materially.

For Enterprise customers, sub-processor changes are notified in advance via the procedure set out in the Data Processing Agreement (DPA).

International data transfers

Application data (accounts, Customer Data, audit chain) is hosted in Switzerland at Hostpoint AG, Zürich. Personal data does not leave Switzerland through the application layer.

To the extent that masked, released content is processed by LLM providers located in the European Economic Area or in countries with a Swiss-recognised adequacy decision, no additional transfer instrument is required. Where masked content is processed by US-based providers, the transfer is governed by the EU-US Data Privacy Framework and its Swiss equivalent where the provider is certified, and otherwise by the Standard Contractual Clauses (SCC) 2021/914 together with the supplementary measures described in our Trust Center.

Cookies

We use cookies to ensure the website functions correctly and, with your consent, to understand how you use our site. You can manage your preferences at any time via the cookie settings.

Data Sharing

We do not sell personal data. We share personal data only with the categories of recipients necessary to operate the platform and meet our legal obligations:

• Our Swiss hosting provider (Hostpoint AG, Zürich), under a written data processing agreement.
• External LLM providers, under no-training agreements, after the Sensitive Data Guard has masked personal, contract and financial content (see below).
• Transactional email, payment and analytics providers used to operate the website and the platform.
• Professional advisers (legal, tax, audit) where strictly necessary.
• Public authorities, where required by binding Swiss law or by a court order.

The current list of sub-processors is maintained on our Trust Center.

Data Retention

We retain personal data only as long as necessary for the purposes for which it was collected, then delete or anonymise it. Indicative retention periods:

• Account data: for the duration of the contractual relationship plus up to 10 years after the end of the contract, to satisfy Swiss accounting and audit obligations (GeBüV / OR Art. 958f).
• Customer Data (documents, prompts, outputs): for the duration of the contractual relationship; deleted at the end of the agreed grace period after termination, unless legally required to be retained for longer.
• Audit-chain entries: for the statutory retention period applicable to the underlying business document (typically 10 years).
• Contact form submissions: 12 months.
• Server logs: typically 90 days.
• Cookie consent records: 12 months.

Your Rights

Under the revFADP and, where applicable, the GDPR, you have the following rights with respect to your personal data:

• Right of access, obtain confirmation that we process your personal data and a copy of that data.
• Right to rectification, have inaccurate personal data corrected.
• Right to erasure and objection, have your personal data erased, or object to processing based on legitimate interests.
• Right to restriction, have processing of your data restricted in certain situations.
• Right to data portability, receive personal data you provided in a structured, machine-readable format and transmit it to another controller, where technically feasible.
• Right to withdraw consent, withdraw any consent you have given, with effect for the future.
• Right to lodge a complaint, with the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch) or, where the GDPR applies to the processing, with the supervisory authority of your EU/EEA habitual residence.

To exercise any of these rights, contact privacy@hegyon.ai. We respond within 30 days of receipt; complex requests may be extended once for up to a further two months, with notice. We may need to verify your identity before acting on a request.

Google Ads and conversion tracking

We run search ads on Google. To measure whether those ads are relevant, we use Google Ads conversion tracking. It records whether someone books a demo or submits the contact form after clicking an ad.

Only with your consent. Without your consent to the “Marketing” category, no Google script is loaded and no connection to Google is made. The Google tag is only loaded after consent, and Google may then set cookies.

Data: ad click, conversion event (e.g. “demo booked”), timestamp, and technical details such as browser and device type. Your IP address is processed by Google. We do not transmit names or email addresses from the form.

Recipients: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland; where applicable Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

Legal basis: your consent. For visitors from Switzerland under the revised FADP, and for visitors from the EU additionally Art. 6(1)(a) GDPR.

Transfer to the USA: where data reaches the USA, the transfer relies on the EU-US Data Privacy Framework and its Swiss extension (Swiss-US Data Privacy Framework), under which Google is certified.

Retention: Google conversion cookies expire after 90 days at the latest. Aggregated reporting in our Google Ads account is kept longer but does not allow conclusions about individual people.

Withdrawal: you can withdraw your consent at any time via Cookie settings in the footer. Withdrawal takes effect immediately; you can also delete any Google cookies already set in your browser.

Contact Us

For any data protection enquiry, please contact privacy@hegyon.ai. The postal address for written communications is the controller address listed above.