Privacy Policy

1. Controller

The controller responsible for the processing described in this Privacy Policy is:

[Full legal name] HelloGentian [Street and building number] [Postal code] Zurich Switzerland Email: info@hellogentian.com

2. Personal data

Personal data is information relating to an identified or identifiable natural person.

Depending on how you interact with the website, we may process:

• technical and usage information;
• IP address and approximate location derived from it;
• browser, device, language, and operating-system information;
• date and time of access;
• pages, files, and subdomains accessed;
• referring website or link;
• server and security logs;
• cookie or similar technology identifiers;
• your name, email address, company, and role;
• the contents of messages and project enquiries;
• information you voluntarily provide; and
• data generated through your interaction with a prototype or demonstration.

Please do not submit sensitive personal data or confidential information unless we have agreed that it is necessary and have provided an appropriate method for doing so.

3. Purposes of processing

We may process personal data to:

• operate, secure, maintain, and improve the website;
• provide website content and functionality;
• detect errors, misuse, attacks, and security incidents;
• understand general website performance and usage;
• respond to enquiries and communicate with you;
• evaluate potential projects and business relationships;
• prepare, enter into, and perform agreements;
• operate and evaluate prototypes or demonstrations;
• protect our rights, systems, users, and third parties;
• comply with legal and regulatory obligations; and
• establish, exercise, or defend legal claims.

4. Basis for processing

Where Swiss data-protection law applies, we process personal data in accordance with its applicable processing principles and requirements.

Where another law requires a specific legal basis, we may rely on your consent; steps requested before entering into a contract; performance of a contract; compliance with a legal obligation; protection of vital interests; or our legitimate interests or those of a third party.

Our legitimate interests may include operating and securing the website, communicating with prospective clients, developing our services, evaluating website performance, preventing misuse, and protecting legal rights.

5. Website hosting and server logs

The website is hosted by:

HOSTINGER operations, UAB Švitrigailos str. 34 03230 Vilnius Lithuania

When you access the website, Hostinger’s infrastructure may automatically process technical information and record it in server logs. This may include your IP address; the date and time of access; the requested page or file; the referring website; browser, device, and operating-system information; access status and error information; and information used to detect attacks, misuse, or technical faults.

This processing is necessary to deliver the website, maintain its security and stability, diagnose technical issues, and prevent misuse.

User-accessible web server access logs are retained by Hostinger for 30 days, unless a longer retention period is necessary to investigate a security incident, comply with a legal obligation, or establish, exercise, or defend legal claims.

Hostinger may process personal data through infrastructure or service providers located outside Switzerland. Where required, international transfers are protected through appropriate contractual or legal safeguards.

6. Email and project enquiries

When you contact us at info@hellogentian.com, we process the information contained in your message, including your name, email address, correspondence, project information, and any attachments you choose to provide.

We use this information to respond to your enquiry; understand and evaluate a potential project; prepare an offer or proposal; communicate before entering into a contract; manage an existing business relationship; and comply with legal, accounting, or documentation requirements.

Our business email service is provided through Titan Email, made available through Hostinger.

Titan Email may process email addresses, message content, attachments, metadata, login information, IP addresses, device information, and other technical data required to provide and secure the email service. Depending on the service infrastructure involved, personal data may be processed outside Switzerland.

Email is not necessarily a secure or confidential communication channel. Please do not send sensitive personal data, passwords, credentials, trade secrets, protected health information, or other highly confidential information by ordinary email unless an appropriate secure method has been agreed in advance.

Email correspondence is retained for as long as reasonably necessary to manage the enquiry or resulting business relationship. Messages may be retained for longer where required for contractual, accounting, legal, documentation, security, or claims-management purposes.

7. Cookies and analytics

The main website does not currently use Google Analytics or other analytics, advertising, or marketing technologies. HelloGentian does not currently set cookies to measure visitor behaviour or build user profiles.

The hosting and delivery infrastructure may still process technical request and security information required to serve and protect the website. This processing is described in section 5.

If analytics or other non-essential technologies are introduced in the future, this Privacy Policy and the website interface will be updated before they are activated. Where required, those technologies will only be used after the relevant consent has been obtained.

8. Prototypes, demonstrations, and AI-enabled features

Some HelloGentian subdomains may contain prototypes, test environments, generative features, AI agents, or other AI-enabled demonstrations.

The information processed by a particular prototype depends on its purpose and functionality. Where a prototype processes information beyond ordinary website usage, an additional notice may be displayed before or at the point of use.

Unless a feature clearly states otherwise:

• do not enter sensitive personal data;
• do not enter confidential business information, credentials, trade secrets, or protected third-party content;
• inputs may be transmitted to third-party AI, infrastructure, or API providers used to operate the feature;
• outputs may be inaccurate, incomplete, biased, unsuitable, or unexpected;
• interaction data may be reviewed to assess performance, safety, usability, and functionality; and
• prototypes must not be relied upon for medical, legal, financial, employment, insurance, credit, safety-critical, or other high-impact decisions.

Evaluation and improvement

Where this is disclosed at the point of collection, HelloGentian may use selected prompts, inputs, outputs, feedback, interaction records, and related technical information to evaluate the performance of a prototype; identify errors, unsafe behaviour, or poor-quality outputs; test prompts, workflows, interfaces, and safeguards; improve the functionality and user experience of a specific prototype; develop internal evaluation datasets; and understand how a demonstration is used.

Where reasonably possible, information used for evaluation or improvement will be minimised, filtered, pseudonymised, aggregated, or anonymised.

Personal data will not be used for evaluation or improvement where doing so would be incompatible with the purpose for which it was collected, disproportionate, or otherwise unlawful.

HelloGentian does not use submitted inputs to train a general-purpose foundation model unless this is expressly disclosed before submission and any legally required consent has been obtained.

Third-party AI providers may process submitted information according to their contractual terms, data-processing agreements, and privacy documentation. The relevant providers should be identified in the notice accompanying each public prototype.

AI and API providers

HelloGentian may use AI models, APIs, and related infrastructure provided by:

• Google
• Anthropic
• OpenAI

Depending on the prototype or service, information submitted by users may be transmitted to one or more of these providers. This may include prompts, uploaded or entered content, generated outputs, feedback, interaction data, technical metadata, and information required to operate, secure, and evaluate the relevant feature.

The provider used for a particular public prototype may be identified within that prototype or in an accompanying privacy notice.

These providers may process data outside Switzerland, including in the European Economic Area, the United States, or other countries. Where required, such transfers are protected through appropriate contractual, organisational, and legal safeguards.

HelloGentian configures and uses these services in accordance with the applicable account settings and contractual terms. However, the providers may process certain information for their own purposes as described in their respective privacy policies and service terms.

Users should not submit sensitive personal data, confidential business information, passwords, credentials, trade secrets, protected health information, or third-party content unless the relevant prototype expressly permits it and appropriate safeguards have been agreed.

9. Service providers

We use external service providers to operate the website and conduct our activities. These may include providers of website hosting and cloud infrastructure; domain-name and content-delivery services; email and business communications; cybersecurity and technical monitoring; AI models, APIs, and development infrastructure; project and customer-relationship management; and professional, accounting, and legal services.

Depending on the service, these providers may process personal data on our behalf or as independent controllers.

Current key providers

• Website hosting: HOSTINGER operations, UAB, Švitrigailos str. 34, 03230 Vilnius, Lithuania
• Business email: Titan Email, provided through Hostinger
• AI models and APIs: Google, Anthropic, and OpenAI

The specific AI provider used may vary between prototypes and may be identified within the relevant experience.

We select providers based on their functionality, security, contractual terms, and data-protection arrangements. Providers acting on our behalf may process personal data only as required to provide the relevant service and in accordance with applicable contractual and legal obligations.

10. Disclosure and international transfers

We may disclose personal data to service providers, contractual partners, professional advisers, authorities, courts, or other recipients where necessary for the purposes described in this Privacy Policy.

Because Hostinger, Google, Anthropic, OpenAI, and other infrastructure providers may operate internationally, personal data may be processed outside Switzerland, including in the European Economic Area, the United States, or other countries.

Where a recipient is located in a country that is not recognised as providing adequate data protection, we use appropriate safeguards where required. These may include recognised standard contractual clauses; contractual data-protection obligations; applicable data-transfer frameworks; binding corporate rules; or another lawful transfer mechanism or statutory exception.

Where necessary, we may also assess whether additional technical or organisational safeguards are appropriate.

11. Data retention

We retain personal data only for as long as reasonably necessary for the purpose for which it was collected and to satisfy legal, contractual, documentation, security, and claims-management requirements.

Retention periods depend on the type of data and may include:

• user-accessible web server access logs: 30 days;
• general enquiries: for the duration of the communication and a reasonable follow-up period;
• contractual and business records: for the applicable statutory retention period; and
• security or legal records: for as long as reasonably required to investigate an incident or protect legal rights.

Data may be anonymised instead of deleted where it is no longer possible to identify an individual.

12. Data security

We use appropriate technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, or disclosure.

These measures may include access controls, encryption in transit, secure hosting configurations, backups, logging, software updates, and restrictions on access to personal data.

No system or method of transmission is completely secure. We therefore cannot guarantee absolute security.

13. Your rights

Subject to applicable law and its conditions, you may have the right to:

• request information about whether we process your personal data;
• receive access to your personal data;
• request correction of inaccurate or incomplete data;
• request deletion or destruction of personal data;
• object to or restrict certain processing;
• withdraw consent with effect for the future;
• request the release or transfer of certain personal data in a commonly used electronic format; and
• request review of certain automated individual decisions, where applicable.

These rights are not absolute. We may restrict or decline a request where permitted or required by law, including to protect third parties, confidential information, legal obligations, or overriding interests.

To exercise a right, contact info@hellogentian.com. We may request information reasonably necessary to verify your identity.

You may also contact the competent data-protection supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner.

14. Automated decisions

The main website does not currently make decisions based solely on automated processing that produce legal effects or similarly significant effects for visitors.

If this changes, we will provide the information and safeguards required by applicable law.

AI-generated responses, demonstrations, or recommendations available through a prototype are experimental outputs and are not intended to constitute legally binding or high-impact automated decisions.

15. Children

The website is intended for professional and general audiences and is not directed specifically at children.

We do not knowingly seek to collect personal data from children through the main website. A parent or guardian who believes that a child has provided us with personal data may contact us to request its review or deletion.

16. External websites

The website may link to third-party services. Those third parties process personal data under their own privacy policies and practices. We encourage you to review their information before using their services.

17. Changes to this Privacy Policy

We may update this Privacy Policy when our website, services, technologies, providers, or legal obligations change.

The current version will be made available on this page. The date shown at the top indicates when it was last updated.

18. Contact

Questions or requests relating to privacy may be sent to:

[Full legal name] HelloGentian [Street and building number] [Postal code] Zurich Switzerland Email: info@hellogentian.com