Winloom Privacy Policy
DRAFT v0.7. Not final, not yet in force, may change without notice. Shown for discussion only.
Privacy Policy
Version: [date]. Controller: Winloom is currently provided by Bäck Consultancy, Sebastiaan Bäck, sole proprietor (Einzelunternehmen), Sonnefeld 12, 6017 Ruswil (LU), UID CHE-461.633.337 (VAT: CHE-461.633.337 MWST) ("Winloom", "we"); the business is planned to move to a GmbH, and this policy will then name it. Contact for privacy: [privacy@... ].
1. What this policy covers
This policy explains how we process personal data when you visit winloom.ai, use app.winloom.ai or the trust center, or when your business details appear in research a customer runs with Winloom. If you are a customer, the Data Processing Agreement governs data we process for you.
2. Data we process, why, and on what basis
| Who | Data | Purpose | Basis |
|---|---|---|---|
| Website visitors | Technical data in web server logs (IP address, time, requested page, browser data) | Operating and securing the site | Legitimate interest (security, stability) |
| Account holders and users | Name, business email, role, tenant, credentials (passkey or password hash), audit entries of admin actions, content you enter | Providing and securing the service, support | Contract; legitimate interest (security) |
| Trust-center access requesters | Name, work email, company, an optional note, time and status of the request; IP address and browser data (user agent) until the request is decided | Deciding who may see the trust center, keeping out bots and abuse, so that confidential documents reach only approved people | Legitimate interest (access control, security); steps before a contract |
| Trust-center registrants | Name, email, company, time of acceptance, IP address, version of the MNDA | Giving access, proving the MNDA | Contract; legitimate interest (evidence) |
| People named at target companies | Name, role and business contact details found in "People / Leadership / Contact" sections of public company websites and in web-search results | Letting our customers research companies for business purposes | Legitimate interest of Winloom and its customers, after a documented balancing test |
| Users of partners | Name, business email, partner, role, which workspaces they are linked to, link, acceptance and renewal entries in the audit log | Letting a partner work in the customer workspaces it is linked to, and securing the service | Contract; legitimate interest (security) |
| Contact enquiries | The content of your message and your contact details | Answering you | Legitimate interest; contract steps |
We do not use analytics tools, advertising trackers or a CDN. [Cookies: only strictly necessary ones; to be confirmed.]
3. People named in research (Art. 14 information)
Our platform lets customers research companies. To do this it reads public web pages of the target company, including sections that name leadership and contacts, and runs web searches. If you work for such a company, your name, role and business contact details may be stored in the customer's workspace and in Winloom's systems.
- Source: the public website of your employer and web-search results.
- Purpose: business research, such as understanding who leads a company.
- Retention: [kept for the contract term of the customer; there is no automatic expiry yet; policy to be set].
- You can ask for access, correction or removal of your data, or object. Write to [privacy@...]; we will pass the request to the customer concerned where needed. We do not use this data for anything but the customer's research and do not sell it.
4. Who receives data (recipients)
- Infomaniak Network SA, Switzerland: hosting of the application, databases, files and backups; AI inference with Swiss-hosted open models. [A second AI provider only if confirmed.]
- Search engines (Microsoft Bing, Startpage in the Netherlands, Mojeek in the UK): receive search terms such as company names, through our own self-hosted search service. No customer documents are sent to them.
- Our customer, for research results about people at companies it researches.
- Partners of our customer (resellers, implementers, referral partners): a partner that Winloom proposes to a customer can see data in that customer's workspace only after the customer's administrator has accepted the link. Resellers and implementers can read the customer's target accounts, which can include research results about people at those companies, and can create target accounts. A referral partner sees only that the workspace exists. The customer can see and revoke the link at any time, and partner access expires after 90 days unless renewed. If you are a partner user, your account data is visible to the customers you are linked to.
- Authorities, where law requires it. We do not sell personal data. Email: [no provider today; to be added].
5. Where data is processed
Storage and processing are in Switzerland. Search terms sent to search engines may leave Switzerland and the EEA [Bing region to be confirmed]. If we transfer personal data to a country without adequate protection we use a lawful mechanism such as the EU standard contractual clauses with the Swiss addendum.
6. How long we keep data
- Account and tenant data: for the contract term; on tenant deletion the tenant database is removed, a final dump is kept 60 days and then deleted; backups on the server are deleted after 14 days; we also keep encrypted backup copies in Switzerland (Infomaniak Swiss Backup and our own NAS) for up to [12 months].
- Audit and authentication logs (they contain IP addresses): 400 days, then deleted automatically by a daily job.
- Web server access logs: 30 days. Since 12 October 2026 they are archived apart from the security logs so they can be deleted separately; older archives have been split and their access part older than 30 days deleted; archives from 27 September to 12 October 2026 still mix both and are kept up to 400 days until they are split (planned for 13 October 2026).
- Trust-center access requests: a request that is rejected, never e-mail verified or never decided is deleted automatically 90 days after it was last updated or decided. The audit log entry of a decision holds the request number, the decision, the reason and the administrator, not your IP address. Once a request is decided, we clear your IP address and browser data from it; we keep your name, email, company, the decision and its date as the record of why an account exists. If a request is approved, you get an account and the account rules above apply, and the request record is deleted when the account is deleted. A trust-center account that has not signed in for 12 months is disabled, and deleted 30 days later.
- MNDA acceptance records: kept for 10 years after the agreement ends, then deleted (the general limitation period for contract claims is ten years, Art. 127 CO).
- Working records of automated research (transcripts of the research worker, which can contain search result lists and research text): older records are deleted automatically after 7 days; the session in progress is shortened while it runs and then follows the same rule.
- Research results: [see section 3].
7. Security
Data is stored on servers in Switzerland, one database per customer, access limited by roles and database credentials, encrypted connections (TLS), passkey sign-in, malware scanning of uploads and an audit log for administrator actions. Backups are encrypted before they leave our server and are stored in Switzerland, at Infomaniak Swiss Backup and on our own NAS. We hold no security certification. See the trust center for current details.
8. Your rights
Under the Swiss FADP and, where it applies, the GDPR you can ask for access, correction, deletion, restriction, data portability, and object to processing based on legitimate interest. Send requests to [privacy@...]. We answer within [30] days. You may complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, if you are in the EU, to your local authority.
9. Automated processing
Our platform uses AI models to read and summarise public sources. We do not take decisions with legal or similarly significant effect on individuals based on this. Customers must review the output and sources.
10. Changes
We may update this policy. The version date at the top shows the current version; material changes are announced [on the site / by email].