{"success":true,"data":{"id":"01a11f24-e048-7306-a7bc-95059c576270","group":"privacy","locale":"en","slug":"privacy","version":"1.6","title":"Privacy Policy","description":"Privacy policy pursuant to FADP (CH) and GDPR (EU)","body_markdown":"# Privacy Policy\n\n\u003e Elchi Studios is a brand of Krauss Software, the sole proprietorship of **Samuel Krauss**, Oberägeri ZG, Switzerland. The counterparty is Krauss Software, owned by Samuel Krauss.\n\n\n**Elchi Studios** | Krauss Software, Samuel Krauss | legal@elchi.dev\n\n---\n\n## 1. Definitions and Scope\n\nThis Privacy Policy applies to the websites **https://elchi.dev**, **https://websites.elchi.dev**, **https://legal.elchi.dev**, **https://docs.elchi.dev**, **https://devs.elchi.dev** and **https://status.elchi.dev**, and to the enquiries and support messages you send us. What we store for your own Elchi account at EAuth and in the Console, for how long and how to delete it, is set out at https://legal.elchi.dev/en/your-data; for that we are the controller. The data of the users of our customers' applications and the mailboxes at EMX we process as a processor for our customers; the EAuth and EMX terms, with their data processing agreements, apply to that.\n\nThe terms used are based on the **Swiss Federal Act on Data Protection (FADP, revised version, in force since 1 September 2023)** and, where applicable, the **EU General Data Protection Regulation (GDPR)**. The GDPR applies when services are offered to individuals residing in the EU.\n\n**Definitions:**\n- **Personal Data:** Any information relating to an identified or identifiable natural person.\n- **Processing:** Any operation performed on personal data, regardless of the means applied.\n- **Controller:** The natural or legal person who determines the purposes and means of data processing.\n- **Hosting Provider:** External providers from which we rent servers and storage to operate the website (Section 4).\n- **Processor:** Third parties processing personal data on behalf of the controller.\n\n---\n\n## 2. Controller\n\n**Krauss Software, owned by Samuel Krauss (brand Elchi Studios)**\nIm Ländli 18\n6315 Oberägeri\nSwitzerland\n\nEmail: legal@elchi.dev\n\n---\n\n## 3. Data We Process\n\n### 3.1 Technical Access Data (Automatic)\n\nWhen you visit our websites, our servers automatically collect the following technical data:\n\n- IP address (anonymised after processing)\n- Date and time of access\n- URL / page accessed\n- HTTP status code\n- Data volume transferred\n- Referrer URL\n- Browser type and version\n- Operating system\n- Device category\n\n**Purpose:** Ensuring technical operation, error detection, abuse prevention.\n**Legal basis (FADP):** Art. 6 FADP (legitimate interest) | **GDPR:** Art. 6(1)(f) GDPR.\n**Retention:** Technical logs are deleted or anonymised after a maximum of 90 days.\n\n### 3.2 No Usage Analytics\n\nOur websites use no analytics system. There are **no** cookies for tracking purposes, **no** third-party analytics services such as Google Analytics, and **no** analysis of your usage beyond the technical access data in section 3.1.\n\nThe cookie-free visitor statistics we offer our clients are built for their website as part of the respective contract. Should we later use such statistics on elchi.dev as well, we will update this notice beforehand.\n\n### 3.3 Contact Enquiries\n\nWhen you contact us by email or via the contact form, we process:\n\n- Name and email address\n- Company, phone number and budget, if you provide them\n- Your choices in the configurator, if the enquiry comes from there\n- Content of the message\n- Language and the page from which you send the enquiry\n- The country the enquiry comes from, derived from the IP address; the IP address itself is not stored with the enquiry\n- Time of contact\n\nWe are notified of an enquiry from the contact form by email; for this and for replies to it we use Resend (section 4.2).\n\n**Purpose:** Processing your enquiry, initiating a business relationship.\n**Legal basis (FADP):** Art. 6 FADP | **GDPR:** Art. 6(1)(b) GDPR (pre-contractual measures).\n**Retention:** 12 months after it was last handled; then our servers delete the enquiry by themselves. If a contract comes of the enquiry, it becomes part of the business records and is kept for 10 years after it was last handled (Art. 958f CO), then it is deleted too.\n**Deletion:** Enter your address at https://legal.elchi.dev/en/your-data; once you confirm through the link we send you, we delete your enquiries at once, except those a contract came of.\n\n### 3.4 Support Messages\n\nWhen you write to us through support in the Console, we process your address, your name and the course of the messages. You also receive support's replies by email.\n\n**Purpose:** Answering your question.\n**Legal basis (FADP):** Art. 6 FADP | **GDPR:** Art. 6(1)(b) GDPR for customers, to perform the contract, otherwise Art. 6(1)(f) GDPR.\n**Retention:** 24 months after the matter is resolved; then our servers delete the messages by themselves. They also go with your account, and before that you delete them as you would an enquiry (section 3.3).\n\n### 3.5 Deletion Requests\n\nWhen you ask for deletion at https://legal.elchi.dev/en/your-data and we hold something for your address, we record the request: your address, the language, a one-way checksum of the confirmation link (not the link itself), when it was made, until when the link is valid, when it was used and how many entries were deleted. The link is valid for 24 hours and once. Our servers delete the request itself 7 days after it was used or expired. The page does not reveal whether we hold anything for an address.\n\n**Purpose:** Proof that the deletion was asked for by the holder of the address.\n**Legal basis (FADP):** Art. 6 FADP | **GDPR:** Art. 6(1)(c) GDPR (Art. 17 GDPR).\n\n### 3.6 Client Data in the Context of Commissions (B2B)\n\nIn the course of service contracts (software, websites, hosting), we process data from contact persons at companies:\n\n- Contact details of the respective contact persons\n- Communication relating to contract execution\n- Technical access data (e.g. server credentials, stored exclusively in encrypted form)\n\nThis data is used exclusively for the fulfilment of the contract and is not processed for any other purpose.\n\n---\n\n## 4. Hosting, Recipients and Disclosure Abroad\n\n### 4.1 Servers and Hosting Providers\n\nSince 3 October 2026 we operate our websites and the client projects we host on our own servers, which we rent from the following hosting providers; ClouDNS answers the DNS queries for our domains:\n\n| Provider | Role | Country (location) |\n|---|---|---|\n| Infomaniak Network SA | Servers, object storage for pictures | Switzerland (Geneva) |\n| Hetzner Online GmbH | Servers, copy of the database | Germany (Falkenstein, Nuremberg) |\n| Tavuru | Server of the primary database | Germany (Frankfurt) |\n| UpCloud Oy | Servers | Netherlands (Amsterdam) |\n| Scaleway SAS | Servers, copy of the database, nightly copy of the pictures | Netherlands (Amsterdam), France (Paris) |\n| ClouDNS Ltd. | DNS queries for our domains; sees DNS queries only, no content | Bulgaria (Sofia) |\n\nThese providers process personal data only on our behalf. They are carefully selected and, where they process personal data, contractually obligated to comply with data protection law (Data Processing Agreement / DPA).\n\nWhere a client project is hosted with another provider at the client's request, the respective contract names that provider. Where that provider is outside Switzerland or the EEA, an adequate level of protection is ensured (e.g. through EU Standard Contractual Clauses).\n\n### 4.2 Sending Email\n\nNotifications of enquiries from the contact form, support's replies (section 3.4) and the links that confirm a deletion (section 3.5) are sent through **Resend, Inc.**, a company based in the USA. Resend sends these emails from its region in the EU, but stores their data (sender, recipient, subject and content, and with it the details of your enquiry or support message) in the USA.\n\n### 4.3 DNS\n\nCloudflare, Inc. (USA) holds the DNS zones of our domains and receives no content of your requests to the website. ClouDNS answers the DNS queries on our behalf (section 4.1), likewise without receiving the content of your requests. Name lookups usually reach ClouDNS from your DNS resolver, not from your device.\n\n### 4.4 Disclosure Abroad\n\nPersonal data is disclosed to the following countries:\n\n- **Germany, Netherlands, France, Bulgaria** (providers under section 4.1): Under Annex 1 of the Swiss Data Protection Ordinance (DPO), these countries ensure an adequate level of data protection (Art. 16 para. 1 FADP). For data subject to the GDPR, these countries belong to the EEA, and an adequacy decision of the European Commission exists for Switzerland (Art. 45 GDPR).\n- **USA** (Resend under section 4.2): For data from Switzerland, disclosure to Resend is based on the European Commission's Standard Contractual Clauses with the adaptations required by Swiss law, which form part of Resend's data processing agreement (Art. 16 para. 2 let. d FADP). For data subject to the GDPR, Resend is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); the same Standard Contractual Clauses apply in addition (Art. 46(2)(c) GDPR).\n\nYou can request a copy of the Standard Contractual Clauses at legal@elchi.dev.\n\n---\n\n## 5. Disclosure to Third Parties\n\nPersonal data is not sold or rented to third parties. Disclosure occurs only:\n\n- to the providers named in Section 4 as processors\n- to comply with legal obligations (e.g. on official orders)\n- with the explicit consent of the data subject\n\n**Important note for clients:** Where third-party services (e.g. payment providers, external APIs, social media plugins) are used in the context of a client project, the privacy policies of those third parties apply. In such cases, Elchi Studios acts solely as a technical service provider and assumes no responsibility for the data protection practices of third-party services chosen by the client.\n\n---\n\n## 6. Your Rights\n\n### 6.1 Rights under the Swiss FADP\n\nYou have the right to:\n- **Access** (Art. 25 FADP): Information about data processed about you\n- **Rectification** (Art. 32 FADP): Have inaccurate data corrected\n- **Erasure** (Art. 32 FADP): Have data deleted under certain conditions\n- **Restriction of processing** (Art. 32 FADP)\n- **Data portability** (Art. 28 FADP)\n- **Object** to certain types of processing\n\n### 6.2 Additional Rights under the GDPR (for persons residing in the EU)\n\nIn addition to the above:\n- **Right to object** to processing based on legitimate interests (Art. 21 GDPR)\n- **Right to lodge a complaint** with a data protection supervisory authority in your EU member state\n\n### 6.3 Exercising Your Rights\n\nWhat we store about you, for how long, and how to export and delete it, is set out for every product at **https://legal.elchi.dev/en/your-data**. You delete your enquiries and support messages there yourself. With an Elchi account, you delete it on your account page, and with it, after 30 days, everything that is only the account's. What is deleted also leaves the backups, within 60 days at the latest.\n\nFor anything else, please contact: **legal@elchi.dev**\n\nWe will respond to your request within 30 days. In complex cases, this period may be extended to 90 days; we will inform you in advance if this is necessary.\n\n---\n\n## 7. Data Security\n\nElchi Studios implements appropriate technical and organisational measures to protect your data, in particular:\n\n- Encrypted data transmission via HTTPS (TLS)\n- Encrypted storage of sensitive access credentials\n- Access controls and access logs\n- Regular security updates of systems in use\n\n---\n\n## 8. Cookies\n\nElchi Studios does not use tracking cookies or third-party advertising cookies on its websites. Where technically necessary cookies are used (e.g. for session management), this is done on the basis of Art. 6(1)(f) GDPR / Art. 6 FADP (legitimate interest in operating the website).\n\nWhen you choose a language, a colour scheme or whether anything on the page may move, we store your choice in a cookie so the next page knows it, for a year at most; it contains nothing but that choice.\n\nNo cookie consent is required for strictly necessary cookies.\n\n---\n\n## 9. External Links\n\nThis website may contain links to third-party websites. This Privacy Policy does not apply to those external websites. We recommend reading the privacy policies of any external websites you visit.\n\n---\n\n## 10. Changes to this Privacy Policy\n\nElchi Studios reserves the right to update this Privacy Policy at any time, in particular in response to changes in the legal framework or technologies used. The version in effect and every earlier one are available at https://legal.elchi.dev/en/privacy, each with the day it applied from.\n\n---\n\n## 11. Supervisory Authorities\n\n**Switzerland:** Federal Data Protection and Information Commissioner (FDPIC)\nFeldeggweg 1, 3003 Bern | www.edoeb.admin.ch\n\n**EU (for complaints by EU residents):** Competent data protection authority in the respective EU member state.\n\n---\n\n*Last updated: 9 October 2026 | Version 1.6*\n\n","body_html":"\u003ch1 id=\"privacy-policy\"\u003ePrivacy Policy\u003c/h1\u003e\n\u003cblockquote\u003e\n\u003cp\u003eElchi Studios is a brand of Krauss Software, the sole proprietorship of \u003cstrong\u003eSamuel Krauss\u003c/strong\u003e, Oberägeri ZG, Switzerland. The counterparty is Krauss Software, owned by Samuel Krauss.\u003c/p\u003e\n\u003c/blockquote\u003e\n\u003cp\u003e\u003cstrong\u003eElchi Studios\u003c/strong\u003e | Krauss Software, Samuel Krauss | \u003ca href=\"mailto:legal@elchi.dev\"\u003elegal@elchi.dev\u003c/a\u003e\u003c/p\u003e\n\u003chr /\u003e\n\u003ch2 id=\"1-definitions-and-scope\"\u003e1. Definitions and Scope\u003c/h2\u003e\n\u003cp\u003eThis Privacy Policy applies to the websites \u003cstrong\u003e\u003ca href=\"https://elchi.dev\"\u003ehttps://elchi.dev\u003c/a\u003e\u003c/strong\u003e, \u003cstrong\u003e\u003ca href=\"https://websites.elchi.dev\"\u003ehttps://websites.elchi.dev\u003c/a\u003e\u003c/strong\u003e, \u003cstrong\u003e\u003ca href=\"https://legal.elchi.dev\"\u003ehttps://legal.elchi.dev\u003c/a\u003e\u003c/strong\u003e, \u003cstrong\u003e\u003ca href=\"https://docs.elchi.dev\"\u003ehttps://docs.elchi.dev\u003c/a\u003e\u003c/strong\u003e, \u003cstrong\u003e\u003ca href=\"https://devs.elchi.dev\"\u003ehttps://devs.elchi.dev\u003c/a\u003e\u003c/strong\u003e and \u003cstrong\u003e\u003ca href=\"https://status.elchi.dev\"\u003ehttps://status.elchi.dev\u003c/a\u003e\u003c/strong\u003e, and to the enquiries and support messages you send us. What we store for your own Elchi account at EAuth and in the Console, for how long and how to delete it, is set out at \u003ca href=\"https://legal.elchi.dev/en/your-data;\"\u003ehttps://legal.elchi.dev/en/your-data;\u003c/a\u003e for that we are the controller. The data of the users of our customers' applications and the mailboxes at EMX we process as a processor for our customers; the EAuth and EMX terms, with their data processing agreements, apply to that.\u003c/p\u003e\n\u003cp\u003eThe terms used are based on the \u003cstrong\u003eSwiss Federal Act on Data Protection (FADP, revised version, in force since 1 September 2023)\u003c/strong\u003e and, where applicable, the \u003cstrong\u003eEU General Data Protection Regulation (GDPR)\u003c/strong\u003e. The GDPR applies when services are offered to individuals residing in the EU.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eDefinitions:\u003c/strong\u003e\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003ePersonal Data:\u003c/strong\u003e Any information relating to an identified or identifiable natural person.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eProcessing:\u003c/strong\u003e Any operation performed on personal data, regardless of the means applied.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eController:\u003c/strong\u003e The natural or legal person who determines the purposes and means of data processing.\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eHosting Provider:\u003c/strong\u003e External providers from which we rent servers and storage to operate the website (Section 4).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eProcessor:\u003c/strong\u003e Third parties processing personal data on behalf of the controller.\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr /\u003e\n\u003ch2 id=\"2-controller\"\u003e2. Controller\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eKrauss Software, owned by Samuel Krauss (brand Elchi Studios)\u003c/strong\u003e\u003cbr /\u003e\nIm Ländli 18\u003cbr /\u003e\n6315 Oberägeri\u003cbr /\u003e\nSwitzerland\u003c/p\u003e\n\u003cp\u003eEmail: \u003ca href=\"mailto:legal@elchi.dev\"\u003elegal@elchi.dev\u003c/a\u003e\u003c/p\u003e\n\u003chr /\u003e\n\u003ch2 id=\"3-data-we-process\"\u003e3. Data We Process\u003c/h2\u003e\n\u003ch3 id=\"31-technical-access-data-automatic\"\u003e3.1 Technical Access Data (Automatic)\u003c/h3\u003e\n\u003cp\u003eWhen you visit our websites, our servers automatically collect the following technical data:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eIP address (anonymised after processing)\u003c/li\u003e\n\u003cli\u003eDate and time of access\u003c/li\u003e\n\u003cli\u003eURL / page accessed\u003c/li\u003e\n\u003cli\u003eHTTP status code\u003c/li\u003e\n\u003cli\u003eData volume transferred\u003c/li\u003e\n\u003cli\u003eReferrer URL\u003c/li\u003e\n\u003cli\u003eBrowser type and version\u003c/li\u003e\n\u003cli\u003eOperating system\u003c/li\u003e\n\u003cli\u003eDevice category\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003ePurpose:\u003c/strong\u003e Ensuring technical operation, error detection, abuse prevention.\u003cbr /\u003e\n\u003cstrong\u003eLegal basis (FADP):\u003c/strong\u003e Art. 6 FADP (legitimate interest) | \u003cstrong\u003eGDPR:\u003c/strong\u003e Art. 6(1)(f) GDPR.\u003cbr /\u003e\n\u003cstrong\u003eRetention:\u003c/strong\u003e Technical logs are deleted or anonymised after a maximum of 90 days.\u003c/p\u003e\n\u003ch3 id=\"32-no-usage-analytics\"\u003e3.2 No Usage Analytics\u003c/h3\u003e\n\u003cp\u003eOur websites use no analytics system. There are \u003cstrong\u003eno\u003c/strong\u003e cookies for tracking purposes, \u003cstrong\u003eno\u003c/strong\u003e third-party analytics services such as Google Analytics, and \u003cstrong\u003eno\u003c/strong\u003e analysis of your usage beyond the technical access data in section 3.1.\u003c/p\u003e\n\u003cp\u003eThe cookie-free visitor statistics we offer our clients are built for their website as part of the respective contract. Should we later use such statistics on elchi.dev as well, we will update this notice beforehand.\u003c/p\u003e\n\u003ch3 id=\"33-contact-enquiries\"\u003e3.3 Contact Enquiries\u003c/h3\u003e\n\u003cp\u003eWhen you contact us by email or via the contact form, we process:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eName and email address\u003c/li\u003e\n\u003cli\u003eCompany, phone number and budget, if you provide them\u003c/li\u003e\n\u003cli\u003eYour choices in the configurator, if the enquiry comes from there\u003c/li\u003e\n\u003cli\u003eContent of the message\u003c/li\u003e\n\u003cli\u003eLanguage and the page from which you send the enquiry\u003c/li\u003e\n\u003cli\u003eThe country the enquiry comes from, derived from the IP address; the IP address itself is not stored with the enquiry\u003c/li\u003e\n\u003cli\u003eTime of contact\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eWe are notified of an enquiry from the contact form by email; for this and for replies to it we use Resend (section 4.2).\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003ePurpose:\u003c/strong\u003e Processing your enquiry, initiating a business relationship.\u003cbr /\u003e\n\u003cstrong\u003eLegal basis (FADP):\u003c/strong\u003e Art. 6 FADP | \u003cstrong\u003eGDPR:\u003c/strong\u003e Art. 6(1)(b) GDPR (pre-contractual measures).\u003cbr /\u003e\n\u003cstrong\u003eRetention:\u003c/strong\u003e 12 months after it was last handled; then our servers delete the enquiry by themselves. If a contract comes of the enquiry, it becomes part of the business records and is kept for 10 years after it was last handled (Art. 958f CO), then it is deleted too.\u003cbr /\u003e\n\u003cstrong\u003eDeletion:\u003c/strong\u003e Enter your address at \u003ca href=\"https://legal.elchi.dev/en/your-data;\"\u003ehttps://legal.elchi.dev/en/your-data;\u003c/a\u003e once you confirm through the link we send you, we delete your enquiries at once, except those a contract came of.\u003c/p\u003e\n\u003ch3 id=\"34-support-messages\"\u003e3.4 Support Messages\u003c/h3\u003e\n\u003cp\u003eWhen you write to us through support in the Console, we process your address, your name and the course of the messages. You also receive support's replies by email.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003ePurpose:\u003c/strong\u003e Answering your question.\u003cbr /\u003e\n\u003cstrong\u003eLegal basis (FADP):\u003c/strong\u003e Art. 6 FADP | \u003cstrong\u003eGDPR:\u003c/strong\u003e Art. 6(1)(b) GDPR for customers, to perform the contract, otherwise Art. 6(1)(f) GDPR.\u003cbr /\u003e\n\u003cstrong\u003eRetention:\u003c/strong\u003e 24 months after the matter is resolved; then our servers delete the messages by themselves. They also go with your account, and before that you delete them as you would an enquiry (section 3.3).\u003c/p\u003e\n\u003ch3 id=\"35-deletion-requests\"\u003e3.5 Deletion Requests\u003c/h3\u003e\n\u003cp\u003eWhen you ask for deletion at \u003ca href=\"https://legal.elchi.dev/en/your-data\"\u003ehttps://legal.elchi.dev/en/your-data\u003c/a\u003e and we hold something for your address, we record the request: your address, the language, a one-way checksum of the confirmation link (not the link itself), when it was made, until when the link is valid, when it was used and how many entries were deleted. The link is valid for 24 hours and once. Our servers delete the request itself 7 days after it was used or expired. The page does not reveal whether we hold anything for an address.\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003ePurpose:\u003c/strong\u003e Proof that the deletion was asked for by the holder of the address.\u003cbr /\u003e\n\u003cstrong\u003eLegal basis (FADP):\u003c/strong\u003e Art. 6 FADP | \u003cstrong\u003eGDPR:\u003c/strong\u003e Art. 6(1)(c) GDPR (Art. 17 GDPR).\u003c/p\u003e\n\u003ch3 id=\"36-client-data-in-the-context-of-commissions-b2b\"\u003e3.6 Client Data in the Context of Commissions (B2B)\u003c/h3\u003e\n\u003cp\u003eIn the course of service contracts (software, websites, hosting), we process data from contact persons at companies:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eContact details of the respective contact persons\u003c/li\u003e\n\u003cli\u003eCommunication relating to contract execution\u003c/li\u003e\n\u003cli\u003eTechnical access data (e.g. server credentials, stored exclusively in encrypted form)\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eThis data is used exclusively for the fulfilment of the contract and is not processed for any other purpose.\u003c/p\u003e\n\u003chr /\u003e\n\u003ch2 id=\"4-hosting-recipients-and-disclosure-abroad\"\u003e4. Hosting, Recipients and Disclosure Abroad\u003c/h2\u003e\n\u003ch3 id=\"41-servers-and-hosting-providers\"\u003e4.1 Servers and Hosting Providers\u003c/h3\u003e\n\u003cp\u003eSince 3 October 2026 we operate our websites and the client projects we host on our own servers, which we rent from the following hosting providers; ClouDNS answers the DNS queries for our domains:\u003c/p\u003e\n\u003ctable\u003e\n\u003cthead\u003e\n\u003ctr\u003e\n\u003cth\u003eProvider\u003c/th\u003e\n\u003cth\u003eRole\u003c/th\u003e\n\u003cth\u003eCountry (location)\u003c/th\u003e\n\u003c/tr\u003e\n\u003c/thead\u003e\n\u003ctbody\u003e\n\u003ctr\u003e\n\u003ctd\u003eInfomaniak Network SA\u003c/td\u003e\n\u003ctd\u003eServers, object storage for pictures\u003c/td\u003e\n\u003ctd\u003eSwitzerland (Geneva)\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eHetzner Online GmbH\u003c/td\u003e\n\u003ctd\u003eServers, copy of the database\u003c/td\u003e\n\u003ctd\u003eGermany (Falkenstein, Nuremberg)\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eTavuru\u003c/td\u003e\n\u003ctd\u003eServer of the primary database\u003c/td\u003e\n\u003ctd\u003eGermany (Frankfurt)\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eUpCloud Oy\u003c/td\u003e\n\u003ctd\u003eServers\u003c/td\u003e\n\u003ctd\u003eNetherlands (Amsterdam)\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eScaleway SAS\u003c/td\u003e\n\u003ctd\u003eServers, copy of the database, nightly copy of the pictures\u003c/td\u003e\n\u003ctd\u003eNetherlands (Amsterdam), France (Paris)\u003c/td\u003e\n\u003c/tr\u003e\n\u003ctr\u003e\n\u003ctd\u003eClouDNS Ltd.\u003c/td\u003e\n\u003ctd\u003eDNS queries for our domains; sees DNS queries only, no content\u003c/td\u003e\n\u003ctd\u003eBulgaria (Sofia)\u003c/td\u003e\n\u003c/tr\u003e\n\u003c/tbody\u003e\n\u003c/table\u003e\n\u003cp\u003eThese providers process personal data only on our behalf. They are carefully selected and, where they process personal data, contractually obligated to comply with data protection law (Data Processing Agreement / DPA).\u003c/p\u003e\n\u003cp\u003eWhere a client project is hosted with another provider at the client's request, the respective contract names that provider. Where that provider is outside Switzerland or the EEA, an adequate level of protection is ensured (e.g. through EU Standard Contractual Clauses).\u003c/p\u003e\n\u003ch3 id=\"42-sending-email\"\u003e4.2 Sending Email\u003c/h3\u003e\n\u003cp\u003eNotifications of enquiries from the contact form, support's replies (section 3.4) and the links that confirm a deletion (section 3.5) are sent through \u003cstrong\u003eResend, Inc.\u003c/strong\u003e, a company based in the USA. Resend sends these emails from its region in the EU, but stores their data (sender, recipient, subject and content, and with it the details of your enquiry or support message) in the USA.\u003c/p\u003e\n\u003ch3 id=\"43-dns\"\u003e4.3 DNS\u003c/h3\u003e\n\u003cp\u003eCloudflare, Inc. (USA) holds the DNS zones of our domains and receives no content of your requests to the website. ClouDNS answers the DNS queries on our behalf (section 4.1), likewise without receiving the content of your requests. Name lookups usually reach ClouDNS from your DNS resolver, not from your device.\u003c/p\u003e\n\u003ch3 id=\"44-disclosure-abroad\"\u003e4.4 Disclosure Abroad\u003c/h3\u003e\n\u003cp\u003ePersonal data is disclosed to the following countries:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eGermany, Netherlands, France, Bulgaria\u003c/strong\u003e (providers under section 4.1): Under Annex 1 of the Swiss Data Protection Ordinance (DPO), these countries ensure an adequate level of data protection (Art. 16 para. 1 FADP). For data subject to the GDPR, these countries belong to the EEA, and an adequacy decision of the European Commission exists for Switzerland (Art. 45 GDPR).\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eUSA\u003c/strong\u003e (Resend under section 4.2): For data from Switzerland, disclosure to Resend is based on the European Commission's Standard Contractual Clauses with the adaptations required by Swiss law, which form part of Resend's data processing agreement (Art. 16 para. 2 let. d FADP). For data subject to the GDPR, Resend is certified under the EU-U.S. Data Privacy Framework (Art. 45 GDPR); the same Standard Contractual Clauses apply in addition (Art. 46(2)(c) GDPR).\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003eYou can request a copy of the Standard Contractual Clauses at \u003ca href=\"mailto:legal@elchi.dev\"\u003elegal@elchi.dev\u003c/a\u003e.\u003c/p\u003e\n\u003chr /\u003e\n\u003ch2 id=\"5-disclosure-to-third-parties\"\u003e5. Disclosure to Third Parties\u003c/h2\u003e\n\u003cp\u003ePersonal data is not sold or rented to third parties. Disclosure occurs only:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eto the providers named in Section 4 as processors\u003c/li\u003e\n\u003cli\u003eto comply with legal obligations (e.g. on official orders)\u003c/li\u003e\n\u003cli\u003ewith the explicit consent of the data subject\u003c/li\u003e\n\u003c/ul\u003e\n\u003cp\u003e\u003cstrong\u003eImportant note for clients:\u003c/strong\u003e Where third-party services (e.g. payment providers, external APIs, social media plugins) are used in the context of a client project, the privacy policies of those third parties apply. In such cases, Elchi Studios acts solely as a technical service provider and assumes no responsibility for the data protection practices of third-party services chosen by the client.\u003c/p\u003e\n\u003chr /\u003e\n\u003ch2 id=\"6-your-rights\"\u003e6. Your Rights\u003c/h2\u003e\n\u003ch3 id=\"61-rights-under-the-swiss-fadp\"\u003e6.1 Rights under the Swiss FADP\u003c/h3\u003e\n\u003cp\u003eYou have the right to:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eAccess\u003c/strong\u003e (Art. 25 FADP): Information about data processed about you\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRectification\u003c/strong\u003e (Art. 32 FADP): Have inaccurate data corrected\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eErasure\u003c/strong\u003e (Art. 32 FADP): Have data deleted under certain conditions\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRestriction of processing\u003c/strong\u003e (Art. 32 FADP)\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eData portability\u003c/strong\u003e (Art. 28 FADP)\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eObject\u003c/strong\u003e to certain types of processing\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3 id=\"62-additional-rights-under-the-gdpr-for-persons-residing-in-the-eu\"\u003e6.2 Additional Rights under the GDPR (for persons residing in the EU)\u003c/h3\u003e\n\u003cp\u003eIn addition to the above:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003e\u003cstrong\u003eRight to object\u003c/strong\u003e to processing based on legitimate interests (Art. 21 GDPR)\u003c/li\u003e\n\u003cli\u003e\u003cstrong\u003eRight to lodge a complaint\u003c/strong\u003e with a data protection supervisory authority in your EU member state\u003c/li\u003e\n\u003c/ul\u003e\n\u003ch3 id=\"63-exercising-your-rights\"\u003e6.3 Exercising Your Rights\u003c/h3\u003e\n\u003cp\u003eWhat we store about you, for how long, and how to export and delete it, is set out for every product at \u003cstrong\u003e\u003ca href=\"https://legal.elchi.dev/en/your-data\"\u003ehttps://legal.elchi.dev/en/your-data\u003c/a\u003e\u003c/strong\u003e. You delete your enquiries and support messages there yourself. With an Elchi account, you delete it on your account page, and with it, after 30 days, everything that is only the account's. What is deleted also leaves the backups, within 60 days at the latest.\u003c/p\u003e\n\u003cp\u003eFor anything else, please contact: \u003cstrong\u003e\u003ca href=\"mailto:legal@elchi.dev\"\u003elegal@elchi.dev\u003c/a\u003e\u003c/strong\u003e\u003c/p\u003e\n\u003cp\u003eWe will respond to your request within 30 days. In complex cases, this period may be extended to 90 days; we will inform you in advance if this is necessary.\u003c/p\u003e\n\u003chr /\u003e\n\u003ch2 id=\"7-data-security\"\u003e7. Data Security\u003c/h2\u003e\n\u003cp\u003eElchi Studios implements appropriate technical and organisational measures to protect your data, in particular:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003eEncrypted data transmission via HTTPS (TLS)\u003c/li\u003e\n\u003cli\u003eEncrypted storage of sensitive access credentials\u003c/li\u003e\n\u003cli\u003eAccess controls and access logs\u003c/li\u003e\n\u003cli\u003eRegular security updates of systems in use\u003c/li\u003e\n\u003c/ul\u003e\n\u003chr /\u003e\n\u003ch2 id=\"8-cookies\"\u003e8. Cookies\u003c/h2\u003e\n\u003cp\u003eElchi Studios does not use tracking cookies or third-party advertising cookies on its websites. Where technically necessary cookies are used (e.g. for session management), this is done on the basis of Art. 6(1)(f) GDPR / Art. 6 FADP (legitimate interest in operating the website).\u003c/p\u003e\n\u003cp\u003eWhen you choose a language, a colour scheme or whether anything on the page may move, we store your choice in a cookie so the next page knows it, for a year at most; it contains nothing but that choice.\u003c/p\u003e\n\u003cp\u003eNo cookie consent is required for strictly necessary cookies.\u003c/p\u003e\n\u003chr /\u003e\n\u003ch2 id=\"9-external-links\"\u003e9. External Links\u003c/h2\u003e\n\u003cp\u003eThis website may contain links to third-party websites. This Privacy Policy does not apply to those external websites. We recommend reading the privacy policies of any external websites you visit.\u003c/p\u003e\n\u003chr /\u003e\n\u003ch2 id=\"10-changes-to-this-privacy-policy\"\u003e10. Changes to this Privacy Policy\u003c/h2\u003e\n\u003cp\u003eElchi Studios reserves the right to update this Privacy Policy at any time, in particular in response to changes in the legal framework or technologies used. The version in effect and every earlier one are available at \u003ca href=\"https://legal.elchi.dev/en/privacy\"\u003ehttps://legal.elchi.dev/en/privacy\u003c/a\u003e, each with the day it applied from.\u003c/p\u003e\n\u003chr /\u003e\n\u003ch2 id=\"11-supervisory-authorities\"\u003e11. Supervisory Authorities\u003c/h2\u003e\n\u003cp\u003e\u003cstrong\u003eSwitzerland:\u003c/strong\u003e Federal Data Protection and Information Commissioner (FDPIC)\u003cbr /\u003e\nFeldeggweg 1, 3003 Bern | \u003ca href=\"http://www.edoeb.admin.ch\"\u003ewww.edoeb.admin.ch\u003c/a\u003e\u003c/p\u003e\n\u003cp\u003e\u003cstrong\u003eEU (for complaints by EU residents):\u003c/strong\u003e Competent data protection authority in the respective EU member state.\u003c/p\u003e\n\u003chr /\u003e\n\u003cp\u003e\u003cem\u003eLast updated: 9 October 2026 | Version 1.6\u003c/em\u003e\u003c/p\u003e\n","effective_from":"2026-10-09T00:00:00Z","published":true,"source_sha256":"cf0a065c315718710f031b0270b6643598f4718cb7f6dc893d469dc94317a582","created_at":"2026-10-09T05:31:13.264341Z","updated_at":"2026-10-09T05:31:13.264341Z","alternates":[{"locale":"de","slug":"datenschutz","title":"Datenschutzerklärung"}],"toc":[{"level":1,"title":"Privacy Policy","anchor":"privacy-policy"},{"level":2,"title":"1. Definitions and Scope","anchor":"1-definitions-and-scope"},{"level":2,"title":"2. Controller","anchor":"2-controller"},{"level":2,"title":"3. Data We Process","anchor":"3-data-we-process"},{"level":3,"title":"3.1 Technical Access Data (Automatic)","anchor":"31-technical-access-data-automatic"},{"level":3,"title":"3.2 No Usage Analytics","anchor":"32-no-usage-analytics"},{"level":3,"title":"3.3 Contact Enquiries","anchor":"33-contact-enquiries"},{"level":3,"title":"3.4 Support Messages","anchor":"34-support-messages"},{"level":3,"title":"3.5 Deletion Requests","anchor":"35-deletion-requests"},{"level":3,"title":"3.6 Client Data in the Context of Commissions (B2B)","anchor":"36-client-data-in-the-context-of-commissions-b2b"},{"level":2,"title":"4. Hosting, Recipients and Disclosure Abroad","anchor":"4-hosting-recipients-and-disclosure-abroad"},{"level":3,"title":"4.1 Servers and Hosting Providers","anchor":"41-servers-and-hosting-providers"},{"level":3,"title":"4.2 Sending Email","anchor":"42-sending-email"},{"level":3,"title":"4.3 DNS","anchor":"43-dns"},{"level":3,"title":"4.4 Disclosure Abroad","anchor":"44-disclosure-abroad"},{"level":2,"title":"5. Disclosure to Third Parties","anchor":"5-disclosure-to-third-parties"},{"level":2,"title":"6. Your Rights","anchor":"6-your-rights"},{"level":3,"title":"6.1 Rights under the Swiss FADP","anchor":"61-rights-under-the-swiss-fadp"},{"level":3,"title":"6.2 Additional Rights under the GDPR (for persons residing in the EU)","anchor":"62-additional-rights-under-the-gdpr-for-persons-residing-in-the-eu"},{"level":3,"title":"6.3 Exercising Your Rights","anchor":"63-exercising-your-rights"},{"level":2,"title":"7. Data Security","anchor":"7-data-security"},{"level":2,"title":"8. Cookies","anchor":"8-cookies"},{"level":2,"title":"9. External Links","anchor":"9-external-links"},{"level":2,"title":"10. Changes to this Privacy Policy","anchor":"10-changes-to-this-privacy-policy"},{"level":2,"title":"11. Supervisory Authorities","anchor":"11-supervisory-authorities"}]}}