Privacy policy

The controller is Michael Scheiwiller, ByteBricks (sole proprietorship), Landoltstrasse 9, 3007 Bern, Switzerland.

Email: michael@bytebricks.ch. UID: CHE-243.859.730.

We have no data protection officer. The law does not require one.

We host bytebricks.ch with Vercel Inc. (USA). For every page request, the server stores this data in log files: IP address, date and time, requested URL, referrer, and browser and operating system (user agent).

Purpose: delivery of the website and security.

Vercel delivers the pages through a global network. The primary processing facilities of Vercel are in the USA. A Vercel data processing agreement with EU standard contractual clauses applies. Vercel states compliance with the Swiss-U.S. Data Privacy Framework.

The website does not process your data with AI. It has no newsletter and no payment function. We use no Google Analytics, no Meta pixel and no ad tracking.

Links to LinkedIn, leadershipbuddy.ch and michaelscheiwiller.com are normal links. Data goes there only after you click.

The Excel analysis page (/excel-exit-sprint) has no form and no upload. The ROI calculator runs in your browser. Only rounded numbers go to Umami as an event. You book appointments through Cal.com (see below).

We measure usage with Umami Cloud (Umami Software, Inc., USA). Our account stores the data in the EU region.

Umami sets no cookies. Umami does not store visitor IP addresses in the analytics records.

Umami records:

• page URL including campaign parameters
• referrer
• browser, operating system, device type and screen size
• language
• country and region, derived from the IP address

We also record our own events: clicks on buttons, scroll depth, form steps and numbers from the ROI calculator. The events contain no names, no email addresses and no free text.

In the contact form on the home page, we ask for your name, email address, project description and, optionally, a budget range.

Purpose: we answer your inquiry.

A server function on Vercel (USA) processes the form. Delivery to us runs by email through Resend (Plus Five Five, Inc., USA). A data processing agreement with standard contractual clauses, including Swiss modifications, applies.

The email arrives in the mailbox michael@bytebricks.ch at Hostinger (Hostinger International Ltd, Cyprus). We keep no database of inquiries.

We keep the inquiry as long as we need it for the answer and a possible contract. Then we delete it. Legal retention duties remain reserved (10 years for business records, Art. 958f Swiss Code of Obligations).

The booking window of Cal.com (Cal.com, Inc., USA) loads only when you click a booking button. Cal.com processes the data in the USA.

Then Cal.com receives your IP address, browser data and your entries (name, email, note). Cal.com is a separate service with its own privacy policy: cal.com/privacy.

We receive the booking with name, email, time and note.

The website loads icons from the Iconify API (Iconify OÜ, Estonia). The servers are in several countries, also outside the EU and Switzerland. Your browser sends your IP address and browser data to these servers. We have no contract with Iconify.

The fonts are hosted on our own server. There is no request to Google.

On bytebricks.ch we set one cookie only: "NEXT_LOCALE". It stores your language (de or en).

The cookie is a session cookie with SameSite=Lax. It is technically necessary. We set no tracking cookies. For this reason we show no cookie banner. Cookies of the demo applications: see the section Demo applications.

We write individual emails to named contacts at firms. Without a reply, at most one reminder follows.

Data: business contact data (name, salutation, role, business email address, phone, firm, firm website, link to the professional profile), public information on the work of the firm, our notes on the fit of the offer, and the course of the correspondence (sent emails, replies).

Source: public firm websites, association and trade directories, public job ads and public registers. The email itself says where we got the address.

Purpose: we make one offer that fits the work of the firm. Legal basis: legitimate interest (Art. 31 para. 1 FADP, Art. 6 para. 1 lit. f GDPR).

Storage: in a local database on the computer of Michael Scheiwiller in Switzerland and in the mailbox at Hostinger. Backup copies of the database are stored in iCloud Drive (Apple Inc., USA). We keep the 14 newest copies. Deleted data therefore leaves the backups 14 days later at the latest.

We research and draft the emails with the help of Claude (Anthropic PBC, USA). Public firm data and business contact data go to Anthropic in the process.

Objection: reply "Nein danke" ("No thanks") or object in any other way. Then we write to you no more. Your email address stays on a block list. Only this way can we make sure that we do not write to you again.

On request, we delete all other data. Without a reply, we delete the data 12 months after the last email at the latest.

We build personal demos on subdomains such as demo-kosten.bytebricks.ch (demo-*.bytebricks.ch). Each firm receives a personal secret link. There is no login.

Hosting: server (VPS) at Infomaniak Network SA, Switzerland. Traffic runs through Cloudflare, Inc. (USA, global network). The encrypted connection ends at Cloudflare.

Data: sample data is preloaded. Values you change in the samples stay in your browser or on our server. If you upload your own file, its content goes to the Anthropic API (Anthropic PBC, USA) for analysis. Single AI functions also send sums from the report to Anthropic. A consent step comes before the first upload.

Upload only documents that you may share. Avoid personal data of third parties in the files.

Under its Commercial Terms, Anthropic may not train models on customer content from the services (anthropic.com/legal/commercial-terms, effective 17.06.2025).

Anthropic deletes API inputs and outputs within 30 days of receipt or generation. Anthropic keeps them longer only where a Usage Policy violation is flagged (up to 2 years) or where the law requires it. Source: privacy.claude.com, article "How long do you store my organization's data?", read on 09.11.2026.

Transfer basis: Anthropic Data Processing Addendum with EU standard contractual clauses and a Swiss addendum. The general privacy policy of Anthropic does not apply here, because it excludes customer content.

Retention on our side: we delete uploads and inputs automatically after 14 days. We remove all demos when the test ends, on 31.03.2027 at the latest.

Analytics: Umami Cloud, no cookies and no stored IP address. Umami does not record the secret link. Cloudflare, as the network in front, sees the requested address.

Logs: technical server logs without file contents, 14 days. We use your IP address only in memory to limit the number of requests.

Legal basis: for uploads, your consent. We base the transfer to the USA on the standard contractual clauses of Anthropic (Art. 16 para. 2 FADP) and, in addition, on your express consent (Art. 17 para. 1 lit. a FADP). For the demo itself, our legitimate interest applies.

Cookies: the Preisspiegel demo sets one technically necessary cookie "ps_demo" (14 days). It links your browser to your own copy of the sample data. The Bausitzung demo sets one technically necessary cookie "pw_demo" (random id, 30 days). The other demos set no cookies.

Under Swiss law, the USA generally has no adequate level of data protection.

The Swiss-U.S. Data Privacy Framework applies to certified firms. The Federal Council recognised it from 15.09.2024. Vercel states that it is certified.

For Resend, Cal.com and Anthropic (demo applications), standard contractual clauses with a Swiss addendum apply. For uploads in the demos, we also ask for your consent.

For Umami, Cloudflare, Iconify, Apple (iCloud) and Anthropic (research for emails to firms), we are still checking the safeguards. These services receive only technical data or business contact data from public sources.

• Contact inquiries: as long as needed for the answer and a possible contract, then deletion. Legal periods remain reserved (up to 10 years).
• Emails to firms: 12 months after the last email at the latest.
• Demo applications: uploads, inputs and logs for 14 days. All demos by 31.03.2027 at the latest.

You have these rights: access (Art. 25 FADP), correction, deletion, objection, data release and portability (Art. 28 FADP), and withdrawal of consent.

Write to michael@bytebricks.ch for this.

Complaint: Federal Data Protection and Information Commissioner (FDPIC, German abbreviation EDÖB), www.edoeb.admin.ch.

Visitors from the EU/EEA have the rights under Art. 15 to 21 GDPR. You can complain to the supervisory authority in your country.

For visitors from the EU/EEA, the GDPR applies where Art. 3 para. 2 GDPR applies.

Legal bases:

• Art. 6 para. 1 lit. a GDPR (consent): uploads in the demo applications
• Art. 6 para. 1 lit. b GDPR (contract): inquiries and contracts
• Art. 6 para. 1 lit. f GDPR (legitimate interest): hosting, analytics, emails to firms, security

All pages run over TLS. At ByteBricks, only Michael Scheiwiller has access to the data. The named providers have access within the scope of their engagement.

As of: 09.11.2026.

We update this page when the processing changes. The current version applies.