Privacy Policy

This notice explains what personal data AIHub Swiss ("we") collects, why we process it, and the rights you have. It applies to visitors of ai-hub.host and to members with an account.

AIHub Swiss is a non-profit, information-only platform. We do not charge for access, sell products or services, carry advertising, or take paid placement. Accounts exist to gate a few sections, not to monetise you.

Most of the site is public and needs no account. Certain sections — the Consulting Toolkit, individual Case Studies, and the Academy — require you to sign in. Analytics is off unless you opt in. We do not sell personal data, run advertising, or track you across other sites.

Being a non-profit does not reduce our obligations: the GDPR and the revFADP apply to how personal data is processed, regardless of whether an organisation is commercial. We hold ourselves to the same standard a company would owe you.

Applicable law: we operate from Switzerland, so the revised Federal Act on Data Protection (revFADP, in force 1 September 2023) applies. Because we serve visitors in the European Economic Area, the EU General Data Protection Regulation (GDPR) applies to that processing too. Where the two differ we apply the stricter requirement.

AIHub Swiss is the controller for the processing described here — we decide why and how your data is processed.

AIHub Swiss Wrightstrasse 35 8152 Glattpark, Switzerland

Data-protection contact: info@aihubswiss.org

• Account: your email address and authentication records, held by our authentication provider. Email sign-in additionally involves a password, which is stored only as a hash by the provider and is never visible to us. We do not ask for your name, organisation, or job title.
• Google sign-in (optional): if you choose Google, we receive your email address and a basic profile identifier from Google. We never receive your Google password.
• Contributions: if you submit a tool, company, case study, or correction through the Contribute page, we collect the name and email address you enter, whether you are affiliated with what you are submitting, and the content of the submission itself.
• Membership application: if you apply to join AIHub Switzerland we collect your name, email address, organisation, job title, membership category, seniority, country and city, any LinkedIn or website address you give us, the areas you are interested in, and what you write about why you want to join. We also record that you gave consent, and the outcome of the review.
• Completeness score on your application: each application is scored automatically for completeness before a person reviews it. See "How membership applications are reviewed" below.
• Voluntary contribution offers: if you tick the optional box on the membership form, we record that you offered a contribution, the amount, and the currency. We do not collect card, bank, or other payment details on this site, and nothing is charged here. We email you a payment link, and any payment is handled by the provider that issues it under their own terms and privacy notice.
• Analytics (only if you opt in): pages and page titles viewed, time spent per page, session length, device type, browser, operating system, referring site, campaign tags (UTM), and an approximate country and city. If you are signed in, your account identifier is attached, so the record is linked to your account and is not anonymous.
• Your IP address: we do not read, store, or send it anywhere. Our host resolves an approximate country and city at the network edge before the request reaches our code, and we record only that result. No third-party geolocation service is involved.
• The Academy (only if you enrol): the courses you enrol in, which lessons you have marked complete, how far you scrolled, how long you spent, and when you were last active. If you sit the final assessment we record each attempt, the questions you were served, the answers you gave, your score, and whether you passed. If you claim a certificate we record the name you chose to have printed on it, the course, a grade band, and the issue date, and we generate a PDF held in private storage. We also keep a log of significant Academy events — enrolment, attempt started, attempt submitted, certificate issued or revoked — which is append-only and cannot be edited after the fact.
• Browser storage: your theme preference, your consent choice, a marker for the daily updates notice, and a short-lived cache of news headlines. These sit in your own browser, not on our servers.

We do not operate a newsletter, and the Contact page is a plain email link that collects nothing.

Each purpose has a legal basis under Art. 6 GDPR, with the corresponding justification under the revFADP:

• Providing your account and access to gated sections — performance of a contract, Art. 6(1)(b).
• Keeping you signed in — authentication cookies set by our provider. Strictly necessary for a service you requested, so exempt from consent under ePrivacy Art. 5(3), with Art. 6(1)(b) as the basis.
• Analytics — your consent, Art. 6(1)(a). Nothing is recorded until you opt in, and you can withdraw at any time. We rely on consent rather than legitimate interest because EDPB Guidelines 2/2023 treat IP-derived collection as falling within ePrivacy Art. 5(3), even where no cookie is set.
• Running the Academy — lessons, progress, assessment and certificates — performance of a contract, Art. 6(1)(b). A course you enrolled in cannot be delivered without recording where you got to, and an assessment cannot be graded without recording what you answered.
• Publishing a certificate for verification — performance of a contract at your request, Art. 6(1)(b). Nothing is published until you claim a certificate. See "Certificates and verification" below.
• Reviewing your membership application — steps taken at your request before entering into a contract, Art. 6(1)(b). The automatic completeness score rests on our legitimate interest, Art. 6(1)(f), in reviewing applications consistently and quickly.
• The Academy event log — our legitimate interest, Art. 6(1)(f), in being able to show that a certificate was properly earned and that attempt limits were applied. It is append-only for that reason.
• Handling your contribution — our legitimate interest, Art. 6(1)(f), in reviewing and crediting submissions, and in replying to you about them.
• Sending you a payment link for a contribution you offered — performance of a contract at your request, Art. 6(1)(b). You choose whether to offer, and whether to use the link once sent. Membership does not depend on either.
• Theme preference, consent choice, and interface state — stored in your browser and strictly necessary to honour the settings you chose.
• Service availability and abuse resistance — legitimate interest, Art. 6(1)(f), in server logs kept by our host.

Assessment answers are graded automatically, by comparing what you selected against a stored answer key. It is a fixed comparison, not a judgement about you, and it decides only whether a Certificate of Completion is issued — not an accredited qualification, and nothing that affects your employment, credit, or legal standing. We therefore do not consider it a decision producing legal or similarly significant effects under Art. 22 GDPR. If you think an attempt was graded wrongly, email us and a person will look at it.

No AI system on this site interacts with you, grades you, or profiles you. The site publishes information about AI; it does not deploy an AI system towards you, so the transparency obligations of Art. 50 of the EU AI Act (Regulation 2024/1689) do not apply to it.

We use a small number of providers, which process data on our instructions and may not use it for their own purposes:

• Supabase — authentication, database, and file storage. It holds account records, your Academy progress, assessment attempts and certificates, the certificate PDF itself in a private bucket, and, where you have opted in, analytics records.
• Vercel — application hosting and content delivery. Vercel logs IP addresses, request timestamps, and user agents as part of normal server operation. See vercel.com/legal/privacy-policy.
• Resend — delivers contribution submissions to our inbox by email. Your name, email address, and submission content pass through it, and your address is set as the reply-to. Resend is based in the United States.
• Google Ireland Ltd. — only if you choose Google sign-in.

Where a provider processes data in the United States, that transfer relies on the EU-US and Swiss-US Data Privacy Frameworks where the provider is certified, and otherwise on Standard Contractual Clauses under Art. 46 GDPR.

When you apply for membership, your application is scored automatically before anyone reads it, and the score and a suggested action are shown to the reviewer.

We want to be exact about what that is, because our admin screen labels it with a robot icon and our database columns are named as though it were artificial intelligence. It is not. It is a short list of fixed rules that adds points for fields you filled in — whether you gave an organisation, a job title, a LinkedIn profile, a country, how long your motivation statement is, whether you selected any areas of interest. No model, no learning, no inference about you. The same application always produces the same number.

One rule is worth naming because you would not guess it: an address at a work domain scores a few points more than one at a free email provider such as Gmail or Outlook. It is a weak signal of a professional application and it is a crude one.

The score never decides anything on its own. It cannot reject you: the two outcomes it produces are "approve" and "review", and a person makes every final decision on every application. It exists to let a reviewer deal with obviously complete applications quickly.

Because no decision is made solely by automated means, Art. 22 GDPR is not engaged. Even so: if your application is refused, you may ask why, ask us to look again, and give us anything we did not take into account. Write to info@aihubswiss.org.

This is rule-based software, not an AI system within the meaning of Art. 3(1) of the EU AI Act, which concerns systems that infer. We describe it here because you should be told how you are being assessed, whatever the technology is called.

A certificate is only useful if somebody else can check it, and checking means showing them something about you. We want you to know exactly what that is before you claim one.

Nothing is published while you are studying, or when you pass. Publication happens only when you press Claim.

When you claim, we create a page at ai-hub.host/verify/… which shows the certificate number, the name you chose to have printed, the course title, the issuer, a grade band (pass, merit, or distinction), the issue date, and whether the certificate is still valid. Anyone holding the certificate number can open that page without an account. That is the point: an employer should not have to sign up to confirm you did the course.

What that page does not show: your email address, your account identifier, your exact score, how many attempts you took, or the location of the PDF.

The certificate number is a random identifier, not a sequence, so the pages cannot be enumerated by counting upwards. The verification pages are marked not to be indexed, so they should not appear in search results — though we cannot bind a search engine that ignores that instruction.

Your name is fixed at the moment of issue and is not changed by editing your account afterwards. Ask us if it needs to be corrected and we will reissue.

You can ask us to revoke a certificate at any time. Revocation leaves the page reachable but marks it as no longer valid, because a verification link that simply disappears is indistinguishable from one that never existed and would undermine every other certificate.

• Account data: kept while your account exists and deleted when you ask us to close it.
• Membership applications: kept while your membership lasts. A refused or withdrawn application, and its score, are deleted 12 months after the decision.
• Academy progress and assessment records: kept while your account exists, and deleted with it. We keep attempt records rather than discarding them after grading because the attempt limit and the waiting period between attempts cannot be applied without them.
• Certificates: kept while your account exists. Because a certificate is meant to be verifiable after you stop using the site, ask us if you want yours to outlive your account and we will tell you what we can keep and on what basis. Closing your account otherwise withdraws the certificate and its verification page.
• Academy event log: kept for 24 months, then deleted. It exists to evidence that certificates were properly earned, and stops being useful long before it stops being personal data.
• Contribution emails: kept in our inbox while we review and act on the submission.
• Contribution records: an offer and its amount are kept while we arrange and reconcile the payment, and afterwards for as long as Swiss accounting rules require records of donations received.
• Analytics records: deleted 24 months after collection. We chose 24 months because the CNIL sets 25 months as the outer limit for audience-measurement data, and our records carry an account identifier when you are signed in. If you want records linked to your account erased sooner, ask us and we will delete them.
• Consent choice: an acceptance is stored in your browser for up to 12 months, after which we ask again. A decline is kept only for the current browsing session, so you are asked again next visit.
• Server logs: retained by our hosting provider under its own schedule.

• Authentication cookies (Supabase Auth) — keep you signed in. Strictly necessary, so they do not require consent and cannot be switched off while you are logged in.
• Theme preference — remembers light or dark mode.
• Consent choice — records whether you accepted or declined analytics.
• Daily updates marker — stops the what's-new notice reappearing during a visit.
• News cache — briefly stores fetched headlines so the News page loads quickly.

Analytics itself sets no cookie. We use no advertising cookies, marketing tags, or third-party pixels.

Under the GDPR and the revFADP you have the right to:

• Access (Art. 15) — a copy of the data we hold about you. • Rectification (Art. 16) — correction of inaccurate data. • Erasure (Art. 17) — deletion of your account and associated data. • Restriction (Art. 18) and objection (Art. 21) to processing. • Data portability (Art. 20). • Withdraw consent (Art. 7(3)) at any time with effect for the future — use Privacy settings in the site footer to turn analytics off again. Withdrawal stops further collection; ask us if you also want existing records erased.

Two of these you can exercise yourself, immediately, without asking us. Sign in and open Your account:

• Download my data gives you a JSON file of everything in our database that relates to you — your account, Academy progress, assessment attempts and answers, certificates, membership application, and analytics records if you opted in. Free, and as often as you like.
• Delete my account erases it and everything attached to it, including any certificate and its verification page. It is irreversible, so export first if you want a copy.

For anything else — rectification, restriction, objection, or a question about an export — email info@aihubswiss.org. We do not charge for this and will respond within one month.

You may also lodge a complaint with a supervisory authority — in Switzerland the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch), or in the EEA the authority in your country of residence. We would rather you raised it with us first so we can put it right.

Accounts on AIHub are for adults. We do not knowingly collect personal data from children under 16, and we do not ask anyone under 16 to sign in. If you believe a child has provided us with personal data, contact info@aihubswiss.org and we will delete it.

AI Basics is different, deliberately. That part of the site is open to anyone of any age because it collects nothing at all. There is no account, no sign-in, and no record of who visited or how they did. The quiz is marked inside the browser and the result never reaches us — we could not tell you a single thing about anyone who has used it. It is built that way precisely so that a younger learner, or a teacher with a class, can use it without a consent question arising, because there is no personal data to consent to.

The rest of the site works as described elsewhere in this notice, and still expects an adult account holder.

AIHub links extensively to third-party sites — vendor pages, company sites, research papers, regulatory texts, and learning resources. Once you follow such a link you are subject to that site's privacy practices, over which we have no control and accept no responsibility.

The News page fetches headlines from public RSS feeds through our own server, so your IP address is not exposed to those feed providers.

We update this notice when what we collect or how we use it changes. Material changes are reflected in the date below, and where a change affects processing that relies on your consent we will ask again rather than assume the earlier answer still applies.

Questions, requests, or complaints about this notice: info@aihubswiss.org

Our registered address and the terms on which this site is offered are set out in the Terms of Use and Imprint, linked in the footer.