Privacy
Privacy policy.
This page says what SME24 collects, why we collect it, who processes it on our behalf and how long we keep it. It is written from the system itself, so it describes what the code actually does.
Last updated 12 September 2026
Who is responsible
IC Hotz GmbH, Obermühle 5, 6340 Baar, is the controller for the processing described here. Write to service@sme24.ch with any question about your data, including a request to access, correct or delete it.
SME24 is a Swiss company, so the revised Federal Act on Data Protection (revDSG, in force since 1 September 2023) governs this processing. Where a client or a visitor is in the EU, we apply the GDPR standard as well.
What we collect
Three kinds of data, and nothing else.
- What you give us
- Your name, email address, language and the company you work for, from signing up and from your profile. Experts also give a biography, qualifications and a photograph.
- What the service produces
- The company facts and safety figures you enter or confirm, the research we run about your company from public sources, the benchmark we compute from them, and the orders, invoices and appointments that follow. This is the service; without it there is nothing to deliver.
- What the system records
- Server logs, error reports and, only with your consent, product analytics. Enquiry forms store a one way hash of your IP address as a flood guard, never the address itself.
Why we process it
Each purpose, and the legal basis it rests on.
- To deliver the service
- Performance of the contract you entered when you ordered, or steps taken at your request before it.
- To meet legal duties
- Swiss commercial and tax law requires that accounting records be kept for ten years (Art. 958f CO). This is a legal obligation, not a choice.
- To keep the service working and honest
- Error reports, security logs and, with consent, analytics. Our legitimate interest in a service that works, balanced against processing that is minimal and never used to profile you.
- Where you said yes
- Product analytics loads only after you accept it, and you can withdraw at any time on the cookie page without losing anything else.
Contact directory
One part of the service processes data about people who never signed up to SME24, and it deserves its own section.
We licence a list of safety and operations contacts at companies worldwide (batch 20260902 Global Account Lists) from a data supplier. It holds names, job titles, business email addresses, business phone numbers and business postal addresses.
Independent EHS experts with an SME24 expert account search the list by company, job title and country. Email addresses and phone numbers are shown masked; an expert reveals one contact for one credit (CHF 1.99), and only the contacts they revealed are shown to them in full.
The basis is our legitimate interest, and that of the experts, in reaching the people responsible for safety at a company with a business offer, under the supplier's licence. Experts agree in the terms to use a contact for their own business development only, never to resell or share it, and to respect the marketing law of the contact's country.
If you are on the list and do not want to be, write to service@sme24.ch. We remove you within 30 days and keep only a hash of your address, so you never return with a later update of the list.
Contacts are kept while the licence lasts; a removed contact is gone for good. Which expert revealed which contact is kept as the record of what was sold.
Who processes it for us
Every third party that touches personal data on our behalf, what it does and where it stores it. A change to this list is a change to the code.
| Processor | What it does | Where it stores |
|---|---|---|
| Supabase, Inc. | The database, sign in and file storage. Our instance runs in Zurich. | Switzerland |
| Vercel, Inc. | Hosting and delivery of the application. Our functions run in Frankfurt. | European Union |
| Trigger.dev Ltd. | Runs the background work: research, benchmarks, invoices and email. | European Union |
| Resend, Inc. | Delivers the product email we send you. | European Union |
| Stripe Payments Europe, Ltd. | Takes card payment at checkout. We never see your card number. | European Union |
| Anthropic PBC, through the Vercel AI Gateway | Turns public research findings into structured facts. It receives the research text, never your account data, and does not train on it. | United States |
| Parallel Web Systems, Inc. | Searches public sources for facts about your company. | United States |
| PostHog, Inc. | Product analytics. We record our own work on your account (a lookup started, a report finished) whether or not you accept, using ids rather than your name, email or any text you wrote. Only the part that needs a cookie in your browser waits for your acceptance. Our instance runs in Frankfurt. | European Union |
| Functional Software, Inc. (Sentry) | Collects error reports so faults are found. Our instance runs in Frankfurt. | European Union |
The two United States processors receive company research inputs and prompts, not your account data, and are covered by the standard contractual clauses. No processor sells or reuses your data.
How long we keep it
Every table holding personal data, and its period. Three honest answers: a scheduled task deletes it, it lives as long as your account, or it is kept without an end date for a reason we name.
| What | How long |
|---|---|
| Your name, language and role | As long as your account exists |
| Who belongs to which company | As long as your account exists |
| An expert's biography, qualifications and photograph | As long as your account exists |
| The company facts a benchmark is built from | As long as your account exists |
| The safety figures you entered or we found | As long as your account exists |
| Which expert assessed your company against which checklist, when and where | As long as your account exists |
| The ratings and notes your expert recorded per checklist item | As long as your account exists |
| What we showed you in the app | As long as your account exists |
| The record that an email was sent to you | 90 days, then deleted automatically |
| A closed enquiry from the contact form, after it was answered | 365 days, then deleted automatically |
| The hashed address behind an enquiry, a flood guard only | 30 days, then deleted automatically |
| What you ordered and what it cost | Kept indefinitely |
| The invoice itself | Kept indefinitely |
| What happened to an order and when | Kept indefinitely |
| A research run and its result | Kept indefinitely |
| A benchmark exactly as it was computed | Kept indefinitely |
| Who changed what, the record that makes the rest verifiable | Kept indefinitely |
| Companies on the purchased contact list | Kept indefinitely |
| Name, title, email, phones and address of a person on the purchased contact list | Kept indefinitely |
| A hash of the email address of a person who asked to be removed from the directory, so they never return | Kept indefinitely |
| Which contacts an expert has revealed | Kept indefinitely |
| An expert’s credit purchases and unlocks | Kept indefinitely |
| The counts of each directory import, no person | Kept indefinitely |
Orders, invoices and order events are kept for ten years because Art. 958f CO requires it. Research runs and benchmark snapshots are kept without an end date: a snapshot is immutable by design, so that a figure you were shown can always be explained, and comparing runs over time is how the service stays accurate. If you would rather they were not, ask us to delete them and we will.
Your rights
You can ask for a copy of your data, ask us to correct it, or ask us to delete it. Signed in, the request is a button in your account; otherwise write to service@sme24.ch. We answer within thirty days.
- A copy of the data we hold about you.
- Correction of anything wrong. Most of it you can edit yourself.
- Deletion, with the one exception below.
- Objection to processing that rests on our legitimate interest, and withdrawal of analytics consent at any time.
- A complaint to the Federal Data Protection and Information Commissioner (FDPIC) in Bern, or to your local supervisory authority in the EU.
What deletion actually does
When we fulfil a deletion request we remove your name from your profile, scrub your email address and sign in details so the account can no longer be used, and for an expert also remove the biography, photograph and contact address.
Orders, invoices and their event history are deliberately not touched. They belong to the company rather than to you personally, and Swiss commercial law requires them to be kept for ten years. After deletion those records no longer name you.
This is a fixed list executed in one step, not a case by case judgement, and it is recorded in our audit log.
How it is protected
Every table enforces row level security in the database, so access is checked on each read rather than trusted from the application. Traffic is encrypted in transit, secrets are held by the hosting platform, and changes to sensitive rows are written to an audit log.
Changes to this policy
If we change how we process your data we update this page and, where the change is substantive, tell you in the app. The date at the top is always the date of the last change.