Privacy policy

Controller

Provider

EditFlow, simple partnership (einfache Gesellschaft)
Nicolas Chapatte, Tim Schultz
Finkenweg 21, 4147 Aesch BL, Switzerland

Contact

info@editflow.ch

For persons in Switzerland, the revised Swiss Federal Act on Data Protection (revDSG) applies. Since we also address customers in the EU, we additionally apply the DSGVO.

Visiting the website

When you open a page, your browser transmits technically necessary information to our server: IP address, time, requested address, status code, amount of data transferred, referring page and browser identification. These server logs serve operation and defence against attacks. They are automatically deleted after 14 days and are not merged with other data.

We use no analytics or tracking tool, no advertising networks and no social media plugins. That's why this website shows no cookie banner: there is nothing to consent to.

Cookies

We use exclusively technically necessary cookies. They carry no identifiers for advertising purposes and do not allow recognition across other websites.

ef_session

Signed-in session. Expires after 15 minutes.

ef_refresh

Keeps you signed in so you don't have to log in again constantly. Expires after 30 days.

ef_discord_state

Only when logging in via Discord. Protects against forged logins and is deleted immediately afterwards.

ef_locale

Remembers which language you are viewing the site in. Set on your first visit, contains only de or en, and expires after 365 days.

Account

For an account we need a username, email address and a password. We never store the password in plain text, only ever as a bcrypt hash. You can optionally add a profile picture, display picture and billing details (company, street, postal code, city).

If you sign in via Discord, we receive your Discord ID, username and profile picture from there. We do not request any further permissions and do not read any messages.

If you sign in via Google, we receive the ID of your Google account, your name and your email address from there. We use them solely to create or link your account and request no further permissions.

Legal basis: performance of a contract (Art. 6 Abs. 1 lit. b DSGVO). Without this information, no account can be maintained.

Orders, invoices, tickets

When you place an order, we process your project description, the level you chose, the processing status and its history. This produces an invoice with line items, amount, payment status and the identifiers of the payment at Stripe. If you write to us through the ticket system, we process the content of your messages.

When you enter your billing address, we suggest streets, postal codes and places as you type. For that, our server sends the selected country and the characters you typed to the geocoding service Photon, operated by komoot GmbH, Potsdam, Germany (OpenStreetMap data). Your IP address is not passed on, the request is made by our server, and nothing from it is stored. Legal basis: steps prior to entering into a contract (Art. 6 Abs. 1 lit. b DSGVO).

We exchange raw material and interim results through the order's ticket system. Our server currently stores no video or image files. You provide the material via a link, to which the terms of the respective provider apply.

Legal basis: performance of a contract; for invoices, additionally the statutory retention obligation (Art. 6 Abs. 1 lit. c DSGVO, Art. 958f OR).

Agency inquiries

If you send us an inquiry through the form for agencies, we process the company name, your name, your email address, the website (optional), the expected volume and your message solely to answer the inquiry and prepare a quote. We store the IP address of the submission for twelve months to prevent abuse. Legal basis: steps prior to entering into a contract (Art. 6 para. 1 lit. b GDPR) and our legitimate interest in preventing abuse (Art. 6 para. 1 lit. f GDPR). We delete the inquiry twelve months after the last contact unless a contract follows.

Applications

If you apply for an advertised position, we process the information from the application form exclusively to assess your application. If it does not lead to a collaboration, we delete the documents at the latest six months after the process concludes, unless you expressly consent to longer retention.

Emails

We send emails that belong to operations: address confirmation, password reset, invoices including PDF, status updates on your order. In addition we send news and announcements by email, but only if you explicitly switch this on in your account settings (off by default). You can withdraw your consent at any time via the settings or the unsubscribe link in every such email.

Payments

We process payments through Stripe (Stripe Payments Europe Ltd., Ireland; parent company Stripe Inc., USA). When paying, you are directed to a page operated by Stripe. Card numbers and other payment data never reach our server at any point. We only receive confirmation from Stripe that and in what amount payment was made, together with the identifiers of the transaction.

So that payments can be matched to an account, we create a customer object at Stripe with your email address and your username. For transfers to the USA, Stripe relies on the standard contractual clauses of the EU Commission.

Who else receives the data

We do not sell data and do not pass it on for advertising purposes. Only service providers without whom operations could not be run are involved:

Tube-Hosting

Server operation, data centre in Germany. Website and database are located there.

Hostpoint AG

Switzerland. Domain and email delivery.

Stripe

Ireland and USA. Payment processing, see above.

Discord

Discord Netherlands B.V. and Discord Inc., USA. Only if you use login via Discord or join our server.

Google

Google Ireland Ltd. and Google LLC, USA. Only if you use login via Google. For transfers to the USA, Google relies on the EU standard contractual clauses.

Google, Microsoft

Search Console and Bing Webmaster Tools show us which search terms the site is found through. We do not transmit any visitor data to them.

Google, Groq

AI support chat: Google (Gemini API) answers the questions, Groq steps in on outage. Only the chat input is transmitted, no account or order data.

komoot

komoot GmbH, Germany. Address suggestions in the billing form (Photon, OpenStreetMap data); receives only the country and the typed characters, sent by our server.

How long we store data

Account

Until the account is deleted.

Invoices

Ten years, statutory retention obligation (Art. 958f OR). They remain even after an account is deleted.

Orders and tickets

Until the account is deleted, at most until any possible claims expire.

Applications

Six months after the process concludes.

Agency inquiries

Twelve months after the last contact, unless a contract follows.

Server logs

14 days.

Backups

Created daily and kept on the server for 14 days. A second copy is additionally held on the devices of the partners in Switzerland so that an outage at the host does not take everything with it; it is deleted after 30 days at the latest.

Security log

Who makes which change to orders, invoices and accounts is recorded; for security-relevant events the IP address as well (Art. 6 para. 1 lit. f GDPR). Deleted after 12 months.

Data security

The website is only accessible via an encrypted connection (TLS, enforced with HSTS). Passwords exist only as a bcrypt hash, session cookies are httpOnly and are only transmitted via HTTPS. Access credentials for third-party services are stored on the server encrypted and not in plain text. The database is backed up daily.

AI support chat

The website offers a support chat at the bottom right that answers general questions about EditFlow (prices, turnaround times, how ordering works) automatically. Using it is voluntary and does not require an account.

Your questions and the chat history of the current session are sent to Google (Gemini API, Google LLC, USA) to generate the answer. If Google is unavailable, Groq, Inc. (USA) is used as a fallback. Both providers may process the content on servers outside Switzerland and the EU; under their free usage terms they may also use it to improve their services. Therefore do not enter personal data, order numbers or payment details. For anything about a specific order, use a ticket instead.

We store questions and answers anonymously (language, time, text) without IP address, account or session to improve our FAQ. The history in your browser stays in the current tab only and is deleted when you close it. Legal basis: our legitimate interest in efficient support (Art. 31 revDSG, Art. 6 para. 1 lit. f GDPR).

No automated decision-making

We do not make any decisions about you based solely on automated processing and do not create profiles.

Your rights

You can request information about which data we process about you, and demand its correction, deletion or restriction. You can receive the data you have given us in a common format and object to processing. You can revoke consent you have given at any time with effect for the future.

Contact us informally at info@editflow.ch. If you are not satisfied with our response, you can complain to the Federal Data Protection and Information Commissioner (EDÖB); within the EU, to the data protection supervisory authority of your country of residence.

Changes

If how we process data changes, we adapt this statement. The version published here with the date given below always applies.