Privacy Policy
Version: 2
Last Updated: 24.06.2026
1. Data Controller
The controller responsible for the processing of personal data under the revised Swiss Federal Act on Data Protection (FADP) is:
Luca Knobel
Mühlerain 14
3210 Kerzers
Switzerland
Email: knobel.luca@gmail.com
2. Scope of this Privacy Policy
This Privacy Policy provides information about the nature, scope, purposes, and duration of the processing of personal data in connection with the use of the platform for validating digital business ideas.
The platform is provided as a web-based Software-as-a-Service (SaaS) solution.
Personal data is processed in accordance with the revised Swiss Federal Act on Data Protection (FADP).
Where applicable, the principles of the European Union General Data Protection Regulation (GDPR) are also taken into consideration.
3. Hosting and Technical Infrastructure
The platform is operated on infrastructure provided by Infomaniak Network SA.
The following services are used to operate the platform:
- hosting infrastructure
- managed PostgreSQL database
- network and security services
- email delivery services
- payment processing through external payment providers
Personal data is generally stored on infrastructure located within Switzerland.
For certain technical services or system components, processing may be carried out by commissioned service providers.
Such service providers are engaged solely in accordance with applicable legal requirements.
4. Categories of Personal Data Processed
4.1 Account Data
When registering and using a user account, the following data may be processed:
- email address
- user ID
- password hash
- registration timestamp
- subscription status
Passwords are not stored in plain text.
4.2 Usage and Content Data
As part of the platform's functionality, user-provided content is stored.
This may include:
- business ideas
- descriptions
- Business Model Canvas content
- hypotheses
- experiments
- measurements
- metrics
- thresholds
- validation data
- modification timestamps
Such content is processed solely for the purpose of providing the platform's functionality.
4.3 Authentication and Session Data
Technically necessary cookies are used for authentication and session management.
These cookies are used for:
- authentication
- session management
- access protection
- security
The cookies used do not contain marketing or advertising information.
4.4 Technical Log Data
When accessing the platform, technical information is automatically processed.
This may include:
- IP address
- date and time of access
- requested resources
- status codes
- user-agent information
- technical error and system messages
This data is processed solely for:
- system security
- error analysis
- abuse detection
- platform stability and availability
4.5 Payment Data
For paid subscriptions, payment processing is handled by the external payment provider Payrexx.
The operator does not process or store complete credit card information or other payment credentials.
Payment information is processed directly by the respective payment provider.
The operator only receives information required to manage subscriptions and payment status.
5. Purposes of Data Processing
Personal data is processed for the following purposes in particular:
- providing the platform
- user account management
- authentication and access control
- storage of user content
- subscription management
- payment processing
- system security
- error analysis
- abuse prevention
- communication with users
- compliance with legal obligations
6. Legal Bases for Processing
Personal data is processed on the following legal bases in particular:
- performance of a contractual relationship
- pre-contractual measures
- legitimate interests in operating a secure platform
- compliance with legal obligations
- consent, where required
7. Cookies
The platform uses only technically necessary cookies.
These cookies are required for:
- authentication
- session management
- security
- language preferences
- technical platform functionality
At present, no cookies are used for:
- advertising
- marketing
- profiling
- user tracking
8. Data Security
The operator implements appropriate technical and organizational measures to protect personal data.
These measures may include:
- encrypted data transmission via HTTPS/TLS
- password hashing
- access controls
- authentication mechanisms
- logging of security-relevant events
- regular software updates
Despite appropriate security measures, complete protection against security incidents, cyberattacks, or data loss cannot be guaranteed.
9. Disclosure of Data
Personal data is generally not sold or disclosed to third parties.
Data may only be disclosed:
- to commissioned technical service providers
- to hosting and infrastructure providers
- to payment providers
- to authorities or courts where legally required
- where necessary to establish, exercise, or defend legal claims
10. Payment Provider
Payrexx is used as the external payment provider for paid services.
When using paid features, personal data may be processed directly by Payrexx.
The privacy policy of Payrexx applies in addition to this Privacy Policy.
The operator has no control over the data processing activities carried out by the payment provider.
11. Data Retention
Personal data is retained only for as long as necessary to fulfill the respective purposes.
Data is retained in particular:
- while a user account exists
- while an active contractual relationship exists
- while legal retention obligations apply
- while legitimate interests require retention
After a user account has been deleted, the associated data is generally permanently removed unless legal retention obligations require otherwise.
Restoration of deleted data is generally not possible.
12. Rights of Data Subjects
Subject to applicable data protection laws, individuals have the following rights in particular:
- access to personal data
- correction of inaccurate data
- deletion of data
- restriction of processing
- data portability or transfer
- withdrawal of previously granted consent
Requests may be submitted using the contact details provided above.
13. No Automated Decision-Making
The platform does not perform automated decision-making or profiling that produces legal effects or similarly significant effects within the meaning of applicable Swiss data protection law.
14. External Links and Third-Party Services
The platform may contain links to third-party websites or services.
The operator is not responsible for the privacy practices of such third parties.
The privacy policies of the respective providers apply.
15. Changes to this Privacy Policy
This Privacy Policy may be amended at any time.
The version published on the platform shall be the authoritative version.