Last updated: 31 May 2026
Controller: Robert Santiago / hegyon.ai, Lufingerstrasse 37, CH-8185 Winkel, Switzerland.
Privacy contact: privacy@hegyon.ai.
This Privacy Notice applies to private use of the "Public Chat". For business use of the platform, the separate B2B Privacy Policy and the Data Processing Agreement apply instead.
For personal data processed in connection with the Public Chat, hegyon.ai is controller within the meaning of Art. 5 lit. j of the revised Swiss Federal Act on Data Protection (revFADP). To the extent the GDPR applies (for example for users in the EEA), the corresponding GDPR requirements also apply.
| Category | Examples | Purpose |
|---|---|---|
| Account data | Email, login credentials | Operate the account, authentication |
| Chat content | Your prompts, uploaded content, AI outputs | Provide the service |
| Usage data | Timestamps, model selection, technical logs | Operation, security, abuse detection |
| Billing data | Tier, payment status | Contract fulfilment |
We process data for the performance of the contract (providing the Public Chat), to safeguard legitimate interests (security, abuse prevention, operation) and to fulfil legal obligations. We obtain consent only where required.
To generate AI outputs, we transmit your inputs to external LLM providers. Depending on the model you select, the following providers are used:
| Provider | Location / processing | Transfer mechanism (third country) |
|---|---|---|
| Mistral AI | France (EU/EEA) | No third-country transfer; processing within EU/EEA |
| OpenAI | USA | Standard Contractual Clauses (SCC) with Swiss addendum; where applicable, EU-US Data Privacy Framework (Swiss-US extension) of the contractually named OpenAI legal entity |
| Anthropic | USA | Standard Contractual Clauses (SCC) with Swiss addendum; DPF status disclosed on the Trust Center |
| Google (Gemini) | USA / global infrastructure | Standard Contractual Clauses (SCC) with Swiss addendum; where applicable, Data Privacy Framework |
The authoritative list is the current version on the Trust Center, which sets out the mechanism applicable per provider and the contractually named legal entity. This notice is updated accordingly when those change.
Before transmission to providers outside Switzerland or the EU, we apply technical safeguards intended, on a best-effort basis, to reduce or pseudonymise directly identifying information ("guardrail").
Important and transparent: These measures do not constitute full anonymisation. Re-identification cannot be excluded, in particular if you yourself write identifying information into the prompt. Transmitted data remains, as a matter of law, personal data and is subject to the transfer mechanisms set out above. We recommend that you do not enter particularly sensitive personal data or third-party secrets into prompts.
For transfers to the USA, a residual risk of governmental access under US law (in particular CLOUD Act, FISA) remains despite the mechanisms listed. The guardrail under section 4.1 serves as a supplementary measure. If you wish to avoid this residual risk, you may select the EU-processing provider (Mistral), to the extent it is available for your use case.
We do not use your chat content to train our own models. The external LLM providers used are contractually bound by no-training agreements, i.e. they do not use content transmitted via the platform for their model training. The relevant agreements are referenced on the Trust Center.
| Data | Retention |
|---|---|
| Chat history | Until you delete it; automatically deleted on account closure |
| Account data | For the duration of the account |
| Security logs | 90 days |
| Billing data | Statutory retention periods (typically 10 years) |
You can delete chat history at any time; after account closure, data is deleted or anonymised, unless a legal retention obligation prevents this.
AI outputs are an informational service. We do not make automated individual decisions with legal or similarly significant effect about you within the meaning of Art. 21 revFADP.
You have the right of access, rectification, erasure, restriction, data portability, and the right to object to processing. Requests can be sent to privacy@hegyon.ai. You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, where the GDPR applies, with your competent supervisory authority.
We take appropriate technical and organisational measures to protect your data. Details and certifications are listed in the Trust Center.
We may update this Privacy Notice. The current version is available on our website.