Privacy Policy

Last updated: April 2026

1. Controller

The controller responsible for data processing on this platform is:

Alpintel
Zurich, Switzerland
Switzerland

Data Protection Contact: [email protected]

If you have questions about how your personal data is processed, you may contact us at the above address or by email at any time.

2. Overview

Alpintel ("we", "our", "us") operates the Alpintel platform (alpintel.ai). This Privacy Policy explains how we collect, use, store, and protect your personal data in accordance with the Swiss Federal Act on Data Protection (nDSG, in force since 1 September 2023) and the EU General Data Protection Regulation (GDPR), where applicable.

3. Data We Collect

3.1 Account Data

When you create an account, we collect:

• Name
• Email address
• Password (stored as a cryptographic hash — we never store your plain-text password)
• Language preference

If you sign in with Google, we receive your name and email address from Google. We do not receive or store your Google password.

Legal basis: Performance of a contract (GDPR Art. 6(1)(b); nDSG Art. 31(1)).

3.2 Usage Data

We collect information about how you use our platform, including:

• Search queries and filters applied
• Pages visited and features used
• Companies viewed and saved to lists
• Device type, browser, and operating system
• IP address (anonymised after 30 days)
• Timestamps of activity

Legal basis: Legitimate interest in improving our service and ensuring platform security (GDPR Art. 6(1)(f); nDSG Art. 31(1)).

3.3 Payment Data

When you subscribe to a paid plan, payment is processed by Stripe, Inc. We do not store your full credit card number. We receive and store a transaction reference, subscription status, and billing period from Stripe.

Legal basis: Performance of a contract (GDPR Art. 6(1)(b)).

3.4 Company Data (Public Registry Data)

The company data displayed on our platform — including company names, registered addresses, legal forms, capital, and corporate purposes — is sourced from publicly available Swiss official records and other public sources.

This data includes names of board members, directors, authorised signatories, and owners as published in official Swiss commercial registry records. While this information is publicly available, names of natural persons constitute personal data under the nDSG and GDPR.

Legal basis for processing personal data from public registries: Legitimate interest in providing a commercially relevant search and intelligence platform based on publicly available official records (GDPR Art. 6(1)(f); nDSG Art. 31(1)). The data is made publicly available by Swiss authorities pursuant to Swiss law (Swiss Code of Obligations Art. 928 ff.).

Individuals whose data appears in company records may exercise their rights as described in Section 9 below.

4. How We Use Your Data

5. Automated Decision-Making and Profiling

Alpintel uses statistical models and machine learning algorithms to generate estimated data about companies, including:

• Employee size estimates — derived from public registry data and proprietary classification models
• Revenue range estimates — derived from employee size, sector, and statistical models
• Sector and sub-sector classification — derived from company descriptions using proprietary models
• Subsidiary identification — derived from ownership signals and public registry data

These estimates are generated for informational and filtering purposes only. They are not used to make decisions about individuals. No automated decisions with legal or significant effects are made about natural persons based on profiling.

If you believe automated processing has produced inaccurate information about a company with which you are associated, you may contact us at [email protected] to request a review.

6. Data Sharing and Sub-Processors

We do not sell your personal data. We share data with the following categories of service providers, each acting as a data processor on our behalf:

We may also disclose data to legal authorities when required by law or court order.

7. International Data Transfers

Some of our sub-processors are located in the United States. When personal data is transferred outside Switzerland or the EEA, we ensure appropriate safeguards are in place:

• EU Standard Contractual Clauses (SCCs) as adopted by the European Commission
• Swiss-specific data transfer clauses as required under nDSG Art. 16-17
• The sub-processor's compliance with recognised data protection frameworks

The Swiss Federal Data Protection and Information Commissioner (FDPIC) maintains a list of countries with adequate data protection. Where a country is not on this list, we rely on the safeguards described above.

8. Cookies and Tracking

We use the following types of cookies and similar technologies:

Essential Cookies

Required for the platform to function. These maintain your session, authentication state, and language preference. They cannot be disabled.

• ch_token — authentication session token (localStorage)
• Locale preference

Analytics Cookies

We use first-party, privacy-friendly analytics built into Alpintel itself. We record product events (pages viewed, searches made, features used) associated with a random browser identifier, and with your account once you sign up. We use this to improve the product and understand how visitors find us. We do not use Google Analytics or any third-party analytics service, do not track users across websites, do not store IP addresses with analytics events, and delete raw events after 12 months. Legal basis: legitimate interest (Art. 6(1)(f) GDPR / revDSG).

We do not use advertising cookies or third-party tracking pixels.

9. Your Rights

Under the nDSG and GDPR, you have the following rights:

• Right of access (nDSG Art. 25; GDPR Art. 15) — obtain a copy of your personal data
• Right to rectification (nDSG Art. 32; GDPR Art. 16) — correct inaccurate data
• Right to erasure (GDPR Art. 17) — request deletion of your data
• Right to data portability (nDSG Art. 28; GDPR Art. 20) — receive your data in a structured, machine-readable format
• Right to object (GDPR Art. 21) — object to processing based on legitimate interest
• Right to restrict processing (GDPR Art. 18) — limit how we use your data
• Right to withdraw consent — where processing is based on consent, you may withdraw it at any time without affecting the lawfulness of prior processing

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

Rights of Individuals in Company Records

If you are a board member, director, or signatory whose personal data appears on our platform via public registry records, you may contact us to:

• Request information about what data we hold
• Request correction of inaccurate data
• Object to the processing of your data

Please note that we source this data from official Swiss commercial registry publications. We cannot delete data that remains publicly available in the source registry, but we can suppress its display on our platform upon legitimate request.

10. Data Retention

• Account data: Retained for the duration of your account, plus 30 days after deletion
• Usage data: Retained for up to 24 months, then anonymised or deleted
• Payment records: Retained for 10 years as required by Swiss commercial law (Swiss Code of Obligations Art. 958f)
• Search queries: Retained in anonymised form for service improvement
• Company data: Retained and updated continuously from public sources

11. Data Security

We implement appropriate technical and organisational measures to protect your data, including:

• Encryption in transit (TLS 1.2+) and at rest
• Secure password hashing (bcrypt)
• Role-based access controls
• Regular security reviews
• Database backups with encryption

12. Data Breach Notification

In the event of a personal data breach that is likely to result in a high risk to your rights and freedoms, we will:

• Notify the FDPIC as soon as possible (nDSG Art. 24)
• Notify the relevant EU supervisory authority within 72 hours where GDPR applies (GDPR Art. 33)
• Inform affected individuals without undue delay if the breach is likely to result in high risk (GDPR Art. 34; nDSG Art. 24(4))

13. Children's Data

Our service is intended for users aged 18 and older. We do not knowingly collect personal data from children. If we become aware that we have collected data from a person under 18, we will delete it promptly.

14. Right to Lodge a Complaint

If you believe your data protection rights have been violated, you have the right to lodge a complaint with:

• Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern — www.edoeb.admin.ch
• EU/EEA: The supervisory authority in your country of residence

15. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or a notice on our platform. The "last updated" date at the top indicates the most recent revision.

16. Contact

Alpintel
Email: [email protected]
Zurich, Switzerland
Switzerland