Privacy Policy

1. Controller

The controller is AIVISIBLE, c/o JL Consulting Group GmbH #1631, Zürcherstrasse 84, 8852 Altendorf, Switzerland, e-mail [email protected], phone +41 41 589 69 78. AIVISIBLE is a project of Harmecs Lab. For questions about data protection and to exercise your rights, an e-mail to [email protected] is sufficient.

2. Legal basis and scope

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) as in force since 1 September 2023. As we also serve customers in the EU and EEA, we additionally observe the General Data Protection Regulation (GDPR) to the extent it applies under Art. 3(2) GDPR.

Where the GDPR applies, we rely on the following legal bases: performance of a contract and pre-contractual steps (Art. 6(1)(b)), legal obligations (Art. 6(1)(c)), legitimate interests such as security, abuse prevention and operation of the website (Art. 6(1)(f)) and consent (Art. 6(1)(a)), for example for the Quick Check.

3. Visiting the website and server logs

The website is hosted by Cloudflare, Inc. (USA) via Cloudflare Pages. When you visit, technically necessary data is processed, such as IP address, date and time, page accessed, browser and operating system. This data is used for delivery, security and defence against attacks and is stored by Cloudflare only briefly.

We do not use analytics or tracking tools or advertising cookies. Fonts and libraries are loaded from our own server; the only external component is Cloudflare Turnstile (section 4).

4. Abuse protection (Cloudflare Turnstile)

The order form and the Quick Check are protected by Cloudflare Turnstile. Turnstile uses technical characteristics of the browser and the IP address to check whether a request comes from a human. Technically necessary cookies or similar storage may be set. The purpose is protection against automated abuse.

5. Free Quick Check

For the Quick Check we process the domain checked, your e-mail address, optionally your name or company, the result and the time of your consent. We do not store your IP address in plain text, only as an irreversible hash value to enforce the limit of three domains per visitor.

With your consent, we contact you about the result. You receive a confirmation by e-mail and we receive an internal notification. You can withdraw your consent at any time by e-mail to [email protected].

The Quick Check includes a short automated check that may query a single AI model via OpenRouter (section 9). Only the domain or company name is used for this, not your e-mail address.

6. Orders and contract processing

When you place an order, we process website, company, business e-mail address, package, market, query and report language and, optionally, services, competitors and city. We need this data to perform the analysis, to communicate with you and for invoicing.

7. Payment via Stripe

Payment is processed by Stripe (Stripe Payments Europe, Ltd., Ireland, with affiliates including in the USA). Stripe collects the data required for payment, such as name, e-mail, billing address, tax number if applicable and payment details. We do not receive card details. Stripe also processes data for fraud prevention and may set technically necessary cookies for this purpose. Stripe's privacy policy also applies.

8. Client portal and database (Supabase)

Customer data, orders, analysis jobs, reports and sign-in to the client portal are stored with Supabase, Inc. in a database and storage instance in the EU (Ireland). Sign-in is via a link sent to your e-mail address; an entry necessary for the session is stored in your browser's storage. Reports are provided via personal, time-limited download links.

9. AI queries (OpenRouter and model providers)

For the analysis we send questions via the intermediary service OpenRouter, Inc. (USA) to AI models of third-party providers, such as OpenAI, Anthropic, Google, xAI, Perplexity, Meta, Mistral AI, DeepSeek, Alibaba, IBM, Amazon and Cohere. These may be based in the USA, the EU, China or other countries.

Only company, website and market information and the questions generated from it are transmitted. Personal data is not intended for this purpose. Please do not enter personal data in the services and competitors fields.

10. E-mail delivery (Brevo)

We send transactional e-mails such as confirmations, report notifications and internal notices of new enquiries via Brevo (Sendinblue SAS, France). E-mail address, name and message content are processed. We do not send newsletters.

11. Contact by e-mail

If you write to us by e-mail, we process your details to respond to your enquiry.

12. Transfers abroad

Some service providers process data in countries outside Switzerland and the EEA, in particular the USA (Cloudflare, Stripe, OpenRouter and individual model providers). Where data is disclosed to a country without an adequate level of data protection, we rely, where available, on the recipient's certification under the Swiss-U.S. or EU-U.S. Data Privacy Framework, on the European Commission's standard contractual clauses as recognised by the FDPIC, or on a statutory exception such as the performance of our contract with you. Protection equivalent to that in Switzerland cannot be guaranteed in every case.

13. Retention

We keep personal data only as long as necessary for the respective purpose. Business records and accounting vouchers are kept for 10 years (Art. 958f CO). Reports are kept available for the duration of the business relationship, at least twelve months. Quick Check data is deleted when it is no longer needed for the limit and contact or when you withdraw consent, unless a retention obligation applies.

14. Data security

We take appropriate technical and organisational measures, such as encrypted transmission (HTTPS), access restrictions and time-limited download links.

15. Your rights

Within the scope of applicable law, you have the right to access, rectification, erasure, restriction of processing, objection, data portability and to withdraw consent with effect for the future. Please contact [email protected]. We may ask for proof of identity.

You may lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch). Persons in the EU or EEA may also contact the supervisory authority of their place of residence.

16. No automated individual decisions

We do not make automated individual decisions that have legal effects on you or significantly affect you.

17. Changes

We may amend this Privacy Policy. The version published on this website applies. The German version is authoritative.

As of: October 2026