Privacy policy

This translation is provided for information purposes. The German version is authoritative.

1. Controller

The controller within the meaning of the Swiss Federal Act on Data Protection (FADP) and — where applicable — the EU GDPR is:

Fluxaro Software GmbH
Neudorfstrasse 35
8820 Wädenswil, Switzerland
Email: datenschutz@fluxaro.ch

2. Scope

This policy applies to the LeadRadar Pro platform (available at leadradar.fluxaro.ch and customer-specific subdomains). It supplements the general privacy policy of Fluxaro Software GmbH at fluxaro.ch/datenschutz.

3. Personal data processed

We process the following categories of personal data:

User accounts — name, email, role, language, sign-in times, optional 2FA configuration. Required to provide access to the platform.
Tenant data — configuration and content that customers create in the platform (templates, campaigns, notes, tasks).
Lead data — business information from public Swiss official registers (SHAB, SOGC, ZEFIX), enriched with publicly available company data. This primarily concerns legal entities; natural persons occasionally included (e.g. managing directors) come exclusively from public registers.
Activity and audit data — logs of sign-ins, admin actions, errors and pipeline runs, for security and operational monitoring.
Contact requests — data you submit via the contact form or during onboarding.

4. Purposes and legal bases

Performance of contract — providing the platform under the customer contract.
Legitimate interest — B2B lead research from public registers, security logging, abuse prevention (rate limits, audit logs, backups).
Legal obligations — retention obligations (accounting, audit).
Consent — where required, e.g. for communications that are not strictly necessary.

5. Processors and external services

We use carefully selected service providers who help us provide LeadRadar Pro:

Hetzner Online GmbH (Germany) — hosting, database, object storage. Data location: Germany.
OpenAI / Anthropic — AI-assisted lead qualification and text generation. Only lead and context data is transferred, no account information.
Google Ireland Limited (Ireland, transfer to the USA possible) — Google Analytics 4 on the public product pages, see section 9. Not in the platform.
Microsoft (OneDrive) — optional letter-sending workflow at the customer’s request.
SMTP provider — sending transactional emails (reports, notifications).
n8n / convert.fluxaro.ch — our own infrastructure for workflow automation and document conversion, hosted on the same Hetzner infrastructure.

Appropriate agreements (data processing agreements/DPA) are in place with all processors where required by law.

6. Data location and transfers

All platform data is processed in the EU, exclusively by Hetzner in Germany. Swiss servers are available on request in the Enterprise plan. Transfers to third countries (e.g. the USA for AI services) only take place where necessary and on the basis of recognised safeguards (standard contractual clauses, adequacy decisions).

7. Retention and deletion

Lead and customer data — for as long as the contractual relationship exists. On request, we delete all tenant data when the contract ends.
Audit logs — 365 days.
Bearer auth and error logs — 90 days.
Database backups — daily (7 days), weekly (5 weeks), monthly (13 months).
Contact requests — until they have been fully dealt with, at most 12 months.

8. Security measures

We use industry-standard technical and organisational measures, including:

HTTPS/TLS encryption for all connections
Tenant separation at database level (multi-tenant with strict customer_id isolation)
Optional two-factor authentication (TOTP) for user accounts
Role-based access controls, brute-force protection, session limits
Encrypted, geo-redundant backups
Audit logging of security-relevant events

9. Cookies, audience measurement and tracking

Platform (after signing in): LeadRadar Pro uses only technically necessary cookies (in particular the session cookie for signing in). There is no measurement in the platform; there is no marketing tracking of users and no transfer to advertising networks.

Public product pages (Product, Monitoring, Pricing, Features, Contact, in all languages): there we use Google Analytics 4 to measure how the pages are used — which pages are viewed, where visitors come from and whether a demo or contact request is submitted. The provider is Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland. We use the same measurement as fluxaro.ch; the cookies (_ga, _ga_*) therefore apply to fluxaro.ch and all its subpages. Advertising features are switched off, and Google Analytics 4 does not store IP addresses. The data is kept for 14 months. Google may transfer data to the USA; Google is certified under the Swiss-U.S. Data Privacy Framework.

Visitors from Switzerland (identified by the browser’s time zone) are measured anonymously as long as no decision has been stored; a notice informs them of this and offers “Decline”. Everyone else is only measured with their consent. If the browser sends a privacy signal (Global Privacy Control or Do Not Track), no measurement ever takes place. You can change your decision here at any time; it is stored only in your browser:

10. Your rights

You have the right of access, rectification, erasure, restriction of processing and data portability (FADP / GDPR Art. 15–22). Please send requests to datenschutz@fluxaro.ch. You may also lodge a complaint with the competent supervisory authority (in Switzerland: the FDPIC).

11. Changes

We may amend this privacy policy to reflect changes in the law or in platform features. The current version is always available at this URL.