Legal Documentation
Privacy Policy for Swizz.ai
Swizz.ai – AI Website & App Builder (Software-as-a-Service)
As of: February 2026 | Operated by Syntech Solutions AG
1. Data Controller
Syntech Solutions AG
Rotzbergstrasse 1
6362 Stansstad
Switzerland
UID: CHE-326.782.914 MWST
2. Legal Basis & Applicable Law
Swizz.ai processes personal data in compliance with:
- Swiss Federal Act on Data Protection (DSG/nDSG) — applicable to all users and customers in Switzerland
- EU General Data Protection Regulation (GDPR) — applicable where we process personal data of individuals in the European Economic Area (EEA)
Where both laws apply, we apply the stricter standard.
3. Categories of Personal Data Processed
We process the following categories of personal data depending on how you use the Platform:
Identification & Account Data
Name, e-mail address, password (hashed), account preferences, language settings. Collected at registration and updated by the User.
Usage Data
IP address, browser type, operating system, session timestamps, features used, error logs, API request logs. Collected automatically during platform use.
User Content
Text, images, logos, code, and other materials uploaded or created by the User within the Platform. Processed to provide the service.
AI Processing Data
Prompts, instructions, and inputs submitted to AI generation features. These are sent to OpenAI's API for processing. We do not use these inputs to train AI models.
Billing & Payment Data
Subscription plan, billing address, invoice history. Payment card data is processed exclusively by Stripe and never stored by Syntech Solutions AG.
Communication Data
E-mail correspondence with support, content of support tickets, feedback submitted through the Platform.
4. Purposes & Legal Bases for Processing
| Purpose | Legal Basis (GDPR) | Legal Basis (DSG) |
|---|---|---|
| Account creation & service provision | Art. 6(1)(b) — contract performance | Art. 31(1) — legitimate interest / contract |
| Billing & invoicing | Art. 6(1)(b) — contract performance | Art. 31(1) — contract |
| Security, fraud prevention & abuse detection | Art. 6(1)(f) — legitimate interest | Art. 31(1) — legitimate interest |
| Platform performance & error monitoring | Art. 6(1)(f) — legitimate interest | Art. 31(1) — legitimate interest |
| Compliance with legal obligations | Art. 6(1)(c) — legal obligation | Art. 31(1) — legal obligation |
| Customer support | Art. 6(1)(b) — contract performance | Art. 31(1) — contract |
| Service notifications & updates | Art. 6(1)(b) / (f) — contract / legitimate interest | Art. 31(1) — contract / legitimate interest |
5. Sub-Processors
Syntech Solutions AG uses the following sub-processors to deliver its service. All sub-processors are bound by data processing agreements and adequate safeguards:
A1 Digital International GmbH, Austria/Switzerland
Vercel Inc., USA
Cloudflare Inc., USA
OpenAI, L.L.C., USA
Stripe Payments Europe Ltd, Ireland
The full and up-to-date list of sub-processors is available at: https://swizz.ai/legal/subprocessors
6. International Data Transfers
Some sub-processors are located outside Switzerland or the EU/EEA (notably Vercel, Cloudflare, OpenAI, and Stripe in the USA). Transfers to these providers are protected by:
- EU Standard Contractual Clauses (SCCs) as approved by the European Commission
- Switzerland-specific adequacy measures or SCCs as required under the DSG
- Supplementary technical and organisational measures (encryption in transit and at rest)
7. Retention Periods
| Data Category | Retention Period |
|---|---|
| Account data (deleted account) | Deleted immediately upon confirmed account deletion |
| Projects & User Content (after deletion) | 30-day grace period, then permanently deleted |
| Backup copies | Maximum 90 days, then automatically purged |
| Server & access logs (technical) | 7 days (rolling) to 180 days depending on log type |
| Billing & accounting records | 10 years (Swiss statutory requirement, OR 641) |
| Support communications | 3 years from last contact |
8. Your Rights
Depending on your location (Switzerland or EU/EEA), you have the following rights regarding your personal data:
- Right of access (Art. 15 GDPR / Art. 25 DSG): You may request a copy of the personal data we hold about you.
- Right to rectification (Art. 16 GDPR / Art. 32 DSG): You may request correction of inaccurate data.
- Right to erasure (Art. 17 GDPR / Art. 32 DSG): You may request deletion of your personal data, subject to applicable retention obligations.
- Right to restriction of processing (Art. 18 GDPR): You may request that processing is limited in certain circumstances.
- Right to data portability (Art. 20 GDPR / Art. 28 DSG): You may receive your data in a structured, machine-readable format.
- Right to object (Art. 21 GDPR / Art. 30 DSG): You may object to processing based on legitimate interest at any time.
- Right to withdraw consent: Where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing.
To exercise any of these rights, contact us at privacy@swizz.ai. We will respond within 30 days. For complex requests, we may extend this period by a further 60 days with prior notice.
9. Security Measures
Syntech Solutions AG implements appropriate technical and organisational measures (TOMs) to protect personal data against unauthorised access, loss, or destruction, including:
- Encryption of data in transit (TLS 1.2 or higher)
- Encryption of data at rest (AES-256)
- Least-privilege access controls and role-based authorisation
- Multi-factor authentication (MFA) for administrative access
- DDoS mitigation and bot protection via Cloudflare
- Regular security reviews and vulnerability assessments
10. Data Breach Notification
In the event of a personal data breach that poses a risk to your rights and freedoms, Syntech Solutions AG will notify the relevant supervisory authority within 72 hours of becoming aware of the breach (as required by Art. 33 GDPR and Art. 24 DSG).
Where the breach is likely to result in high risk to affected individuals, we will notify the affected Users directly without undue delay.
11. Children's Privacy
The Platform is not intended for use by individuals under the age of 16. We do not knowingly collect personal data from children. If we become aware that a child under 16 has provided us with personal data, we will delete it promptly.
12. Automated Decision-Making
Swizz.ai does not use fully automated decision-making or profiling that produces legal effects or similarly significant effects on Users. AI-generated content is a tool; final decisions are always made by the User.
13. Supervisory Authorities
If you believe we are processing your personal data unlawfully, you have the right to lodge a complaint with a supervisory authority:
European Union
The competent supervisory authority in your EU member state of residence. A list is available at the European Data Protection Board website.
14. Changes to this Privacy Policy
We reserve the right to update this Privacy Policy at any time. The current version is always available at https://swizz.ai/privacy. Material changes will be communicated to registered Users by e-mail at least 30 days before they take effect.
15. Contact & Data Protection Queries
Syntech Solutions AG
Rotzbergstrasse 1, 6362 Stansstad, Switzerland
General: office@syn-tech.ch
Privacy: privacy@swizz.ai
