Privacy Policy

The data controller is:

SmartFlow collects only data strictly necessary for the proper functioning of the website and the processing of requests.

Data that may be collected includes:

• First and last name
• Email address
• Phone number
• Content of messages sent via the contact form
• Technical data related to browsing (IP address, browser type, pages visited), anonymized or aggregated when possible
• IP address temporarily processed (max. 1 hour) for rate limiting and abuse protection on the contact form

No sensitive data is voluntarily collected.

Personal data is processed solely for the following purposes:

• Responding to requests sent via the contact form
• Managing exchanges with clients and prospects
• Improving website functionality and security
• Complying with applicable legal obligations

Data is never used for unsolicited commercial purposes.

Data processing is based on:

• User consent (contact form)
• SmartFlow's legitimate interest in managing exchanges and ensuring website security
• Compliance with legal obligations

Personal data is retained only for the duration necessary for the purpose for which it was collected.

Messages sent via the contact form are retained for a maximum of 3 years (Swiss commercial statute of limitations) for commercial or administrative follow-up, then deleted. IP addresses used for rate limiting are kept for a maximum of 1 hour. Analytics data (PostHog) is retained for 12 months. Any earlier deletion request can be sent to [email protected].

Personal data is not sold, rented or transferred to third parties for commercial purposes.

However, it may be processed by the following technical subprocessors, acting on behalf of SmartFlow and bound by a Data Processing Agreement (DPA): Vercel Inc. (website hosting, United States, certified under the EU-US and Swiss-US Data Privacy Framework), Resend Inc. (sending emails from the contact form, United States, certified under the Data Privacy Framework), Upstash Inc. (cache and rate limiting via Redis, EU region), PostHog Inc. (anonymized audience measurement, EU instance eu.i.posthog.com), and Infomaniak Network SA (domain name management, Switzerland). Transfers to the United States are governed by the European Commission's Standard Contractual Clauses and the Data Privacy Framework certification, in compliance with the FADP and GDPR.

The website is hosted by Vercel Inc. (United States, certified under the EU-US and Swiss-US Data Privacy Framework) on a global Edge network with European location preferred. The domain name is managed by Infomaniak Network SA (Switzerland). PostHog audience measurement is processed on the European instance (eu.i.posthog.com) to ensure that analytics data remains within the European Economic Area.

SmartFlow implements appropriate technical and organizational measures to protect personal data against any unauthorized access, loss, alteration or disclosure: enforced HTTPS (HSTS), strict Content Security Policy, Origin/Referer validation on API routes, rate limiting, systematic HTML escaping, and end-to-end TLS encryption.

The website may use cookies strictly necessary for its proper functioning and anonymized audience measurement.

No advertising or profiling cookies are used without the user's explicit consent.

Users can configure their browser to refuse cookies or to be informed of their use.

When you accept audience measurement, we use PostHog to analyze visited pages and interactions (clicks, scroll depth, forms) to improve the website. Without consent, this tracking is not enabled.

In accordance with applicable legislation, users have the following rights:

• Right of access to their personal data
• Right to rectification of inaccurate data
• Right to erasure of data, within legal limits
• Right to restriction of or objection to processing
• Right to data portability when applicable

Any request may be addressed to:

SmartFlow will endeavor to respond within legal timeframes.

SmartFlow reserves the right to modify this privacy policy at any time to adapt it to legal or technical developments.

The version in force is the one published on the website at the time of consultation.

This privacy policy is governed by Swiss law. Any dispute relating to data protection is subject to the jurisdiction of the courts of the Canton of Vaud, subject to mandatory legal provisions.