Privacy Policy

This notice explains what personal data AIHub Swiss ("we") collects, why we process it, and the rights you have. It applies to visitors of ai-hub.host and to members with an account.

AIHub Swiss is a non-profit, information-only platform. We do not charge for access, sell products or services, carry advertising, or take paid placement. Accounts exist to gate a few sections, not to monetise you.

Most of the site is public and needs no account. Certain sections — the Consulting Toolkit and individual Case Studies — require you to sign in. Analytics is off unless you opt in. We do not sell personal data, run advertising, or track you across other sites.

Being a non-profit does not reduce our obligations: the GDPR and the revFADP apply to how personal data is processed, regardless of whether an organisation is commercial. We hold ourselves to the same standard a company would owe you.

Applicable law: we operate from Switzerland, so the revised Federal Act on Data Protection (revFADP, in force 1 September 2023) applies. Because we serve visitors in the European Economic Area, the EU General Data Protection Regulation (GDPR) applies to that processing too. Where the two differ we apply the stricter requirement.

AIHub Swiss is the controller for the processing described here — we decide why and how your data is processed.

AIHub Swiss Wrightstrasse 35 8152 Glattpark, Switzerland

Data-protection contact: info@aihubswiss.org

• **Account**: your email address and authentication records, held by our authentication provider. Email sign-in additionally involves a password, which is stored only as a hash by the provider and is never visible to us. We do not ask for your name, organisation, or job title.

• **Google sign-in (optional)**: if you choose Google, we receive your email address and a basic profile identifier from Google. We never receive your Google password.

• **Contributions**: if you submit a tool, company, case study, or correction through the Contribute page, we collect the name and email address you enter, whether you are affiliated with what you are submitting, and the content of the submission itself.

• **Voluntary contribution offers**: if you tick the optional box on the membership form, we record that you offered a contribution, the amount, and the currency. We do not collect card, bank, or other payment details on this site, and nothing is charged here. We email you a payment link, and any payment is handled by the provider that issues it under their own terms and privacy notice.

• **Analytics (only if you opt in)**: pages and page titles viewed, time spent per page, session length, device type, browser, operating system, referring site, campaign tags (UTM), and an approximate country and city. If you are signed in, your account identifier is attached, so the record is linked to your account and is not anonymous.

• **Your IP address**: we do not read, store, or send it anywhere. Our host resolves an approximate country and city at the network edge before the request reaches our code, and we record only that result. No third-party geolocation service is involved.

• **Browser storage**: your theme preference, your consent choice, a marker for the daily updates notice, and a short-lived cache of news headlines. These sit in your own browser, not on our servers.

We do not operate a newsletter, and the Contact page is a plain email link that collects nothing.

Each purpose has a legal basis under Art. 6 GDPR, with the corresponding justification under the revFADP:

• **Providing your account and access to gated sections** — performance of a contract, Art. 6(1)(b).

• **Keeping you signed in** — authentication cookies set by our provider. Strictly necessary for a service you requested, so exempt from consent under ePrivacy Art. 5(3), with Art. 6(1)(b) as the basis.

• **Analytics** — your consent, Art. 6(1)(a). Nothing is recorded until you opt in, and you can withdraw at any time. We rely on consent rather than legitimate interest because EDPB Guidelines 2/2023 treat IP-derived collection as falling within ePrivacy Art. 5(3), even where no cookie is set.

• **Handling your contribution** — our legitimate interest, Art. 6(1)(f), in reviewing and crediting submissions, and in replying to you about them.

• **Sending you a payment link for a contribution you offered** — performance of a contract at your request, Art. 6(1)(b). You choose whether to offer, and whether to use the link once sent. Membership does not depend on either.

• **Theme preference, consent choice, and interface state** — stored in your browser and strictly necessary to honour the settings you chose.

• **Service availability and abuse resistance** — legitimate interest, Art. 6(1)(f), in server logs kept by our host.

We do not carry out automated decision-making or profiling producing legal or similarly significant effects (Art. 22 GDPR). No AI system on this site interacts with you or evaluates you, so the transparency obligations of Art. 50 of the EU AI Act (Regulation 2024/1689) do not apply to it. The site publishes information about AI; it does not deploy an AI system towards you.

We use a small number of providers, which process data on our instructions and may not use it for their own purposes:

• **Supabase** — authentication and database, holding account records and, where you have opted in, analytics records.

• **Vercel** — application hosting and content delivery. Vercel logs IP addresses, request timestamps, and user agents as part of normal server operation. See vercel.com/legal/privacy-policy.

• **Resend** — delivers contribution submissions to our inbox by email. Your name, email address, and submission content pass through it, and your address is set as the reply-to. Resend is based in the United States.

• **Google Ireland Ltd.** — only if you choose Google sign-in.

Where a provider processes data in the United States, that transfer relies on the EU-US and Swiss-US Data Privacy Frameworks where the provider is certified, and otherwise on Standard Contractual Clauses under Art. 46 GDPR.

• **Account data**: kept while your account exists and deleted when you ask us to close it.

• **Contribution emails**: kept in our inbox while we review and act on the submission.

• **Contribution records**: an offer and its amount are kept while we arrange and reconcile the payment, and afterwards for as long as Swiss accounting rules require records of donations received.

• **Analytics records**: deleted 24 months after collection. We chose 24 months because the CNIL sets 25 months as the outer limit for audience-measurement data, and our records carry an account identifier when you are signed in. If you want records linked to your account erased sooner, ask us and we will delete them.

• **Consent choice**: an acceptance is stored in your browser for up to 12 months, after which we ask again. A decline is kept only for the current browsing session, so you are asked again next visit.

• **Server logs**: retained by our hosting provider under its own schedule.

• **Authentication cookies** (Supabase Auth) — keep you signed in. Strictly necessary, so they do not require consent and cannot be switched off while you are logged in.

• **Theme preference** — remembers light or dark mode.

• **Consent choice** — records whether you accepted or declined analytics.

• **Daily updates marker** — stops the what's-new notice reappearing during a visit.

• **News cache** — briefly stores fetched headlines so the News page loads quickly.

Analytics itself sets no cookie. We use no advertising cookies, marketing tags, or third-party pixels.

Under the GDPR and the revFADP you have the right to:

• **Access** (Art. 15) — a copy of the data we hold about you. • **Rectification** (Art. 16) — correction of inaccurate data. • **Erasure** (Art. 17) — deletion of your account and associated data. • **Restriction** (Art. 18) and **objection** (Art. 21) to processing. • **Data portability** (Art. 20). • **Withdraw consent** (Art. 7(3)) at any time with effect for the future — use **Privacy settings** in the site footer to turn analytics off again. Withdrawal stops further collection; ask us if you also want existing records erased.

To exercise any of these, email info@aihubswiss.org. We do not charge for this and will respond within one month.

You may also lodge a complaint with a supervisory authority — in Switzerland the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch), or in the EEA the authority in your country of residence. We would rather you raised it with us first so we can put it right.

AIHub is intended for professional and educational use by adults. We do not knowingly collect personal data from children under 16. If you believe a child has provided us with personal data, contact info@aihubswiss.org and we will delete it.

AIHub links extensively to third-party sites — vendor pages, company sites, research papers, regulatory texts, and learning resources. Once you follow such a link you are subject to that site's privacy practices, over which we have no control and accept no responsibility.

The News page fetches headlines from public RSS feeds through our own server, so your IP address is not exposed to those feed providers.

We update this notice when what we collect or how we use it changes. Material changes are reflected in the date below, and where a change affects processing that relies on your consent we will ask again rather than assume the earlier answer still applies.

Questions, requests, or complaints about this notice: info@aihubswiss.org