Privacy Policy

1. Who we are

We are Grafizum, a sole proprietorship established in Switzerland (“Grafizum”, “we”, “us”), and we are the controller for the data described here. Our operator details — the business name, the country and how to reach us — are in our Legal Notice at grafizum.com/legal-notice.

For anything to do with this policy — a question, a request, a complaint — write to [email protected]. That mailbox is monitored and is the fastest route to us.

2. Scope

This policy covers this website, the dashboard at dashboard.grafizum.com, the phone app at dashboard.grafizum.com/m, and the MCP connections the dashboard manages.

It does not cover the AI client you connect, GitHub, or any other third-party service. Those have their own policies, and you decide what you hand them.

3. What we process

We process only what the service needs:

• Account: name, email address, username, and your password — stored only as a slow one-way hash, never in readable form.
• Sessions and security: session records, sign-in times, IP address, browser type, and security events such as failed sign-ins or rate-limit hits. These are what keep your account yours.
• Your project content: projects, tasks, notes, documents, activity entries and change marks — whatever you choose to put into the dashboard.
• Connected services: GitHub authorisation tokens and repository links you add, plus MCP connection settings and the access rules you set. Tokens are encrypted with AES-256-GCM before they reach the database, the key is held outside it, and a saved token is never shown again.
• Usage counters: how many requests a connection or an agent makes, so that limits and the daily budget work. These are counts, not content.
• Support: whatever you send us by email, including logs or screenshots you choose to share.
• Technical logs: our hosting provider records IP address, requested URL, response status and timestamp for a short period so the service stays secure and running.
• Billing: for paid plans, the plan, subscription status and the customer and subscription identifiers our payment provider gives us. Card details and billing address never reach us.
• Nothing else: no advertising identifiers, no cross-site tracking, no analytics profile, no social-media pixel.

4. Why we process it

We process data only for the purposes below, and only as much as each purpose needs. Under the FADP we rely on processing in good faith, purpose limitation and proportionality; for data covered by the GDPR we rely on the basis named in brackets.

• Providing the account, the dashboard and MCP access — performance of our contract with you.
• Keeping the service secure: abuse prevention, rate limits, firewall, audit trail — our legitimate interest in a safe service, and yours in a working one.
• Answering enquiries and support requests — contract or steps taken before a contract.
• Sending transactional email, such as sign-in links, password resets and security notices — contract.
• Invoicing and bookkeeping, once paid plans exist — contract and legal duty.
• Understanding how the product is used, from aggregated counters — legitimate interest. No project content is read for this.

5. Cookies and local storage

This website sets no cookies. There is no analytics, no advertising, no social-media pixel, and no font or script loaded from a third-party server.

Your browser stores two preferences on your device: the language you chose (“grafizum-lang”) and light or dark mode (“grafizum-theme”). Local storage is not a cookie; it is never sent to us and you can clear it in your browser settings at any time.

The dashboard sets one session cookie, “gcc_session”, which is strictly necessary to keep you signed in. It carries no tracking information and is cleared when you sign out.

6. Who we share it with

We share data only with the providers the service runs on, and only as far as each one needs it:

• Cloudflare — hosts this website and the dashboard, runs the database, and filters abusive traffic at the network edge.
• Resend — delivers transactional email, such as sign-in links and security notices.
• GitHub — only when you connect a repository or authorise us; it receives the requests we make on your instruction.
• Your AI client — when you set up MCP, the client you chose requests data under the scopes you approve. We do not send your project data to an AI provider on our own.
• Polar (polar.sh) — the merchant of record for paid plans. Card details and billing address go to Polar directly; we receive the subscription status and identifiers, never the card. Polar is the controller for that payment data, and its own privacy notice applies to it.
• Authorities and courts — only where the law requires it.

We do not sell personal data, we do not rent it, and we do not share it for advertising. A current list of processors is available from [email protected].

7. Transfers abroad

Cloudflare, Resend and GitHub are based in the United States and process data on a global network. Transfers from Switzerland follow FADP Arts. 16 and 17: we rely on the countries the Federal Council recognises as adequate (including the Swiss–US Data Privacy Framework, in force since 15 September 2024), and otherwise on standard contractual clauses with a transfer assessment.

Where the GDPR applies, the same transfers rest on adequacy decisions or standard contractual clauses.

8. How long we keep it

We keep data only as long as the purpose needs it:

• Account and project content: while your account exists. You can download a copy of everything and delete the account and its content yourself, at any time, under Your data on the dashboard's Settings page — that deletion is immediate and cannot be undone. If you ask us to do it instead, we complete it within 30 days, and backups roll off within 90 days either way.
• Security logs: 30 days.
• Usage counters: 12 months, then aggregated so no person can be identified.
• MCP connection records: until you revoke the connection, then 90 days so the audit trail stays coherent.
• Support email: 24 months after the last contact.
• Invoices and accounting records: 10 years, once paid plans exist, as Swiss law requires. Customer invoices are issued by Polar; we keep our own accounting records and payout statements.

9. Security

Traffic is encrypted with TLS. Passwords are hashed, never stored in readable form. Connected-service tokens are encrypted with AES-256-GCM under a key held outside the database. Access to production data is limited to the operator, and administrative actions are logged.

No system is perfectly secure. If a breach is likely to put your rights at risk, we notify you and the Federal Data Protection and Information Commissioner (FDPIC) without undue delay, as FADP Art. 24 requires. Where the GDPR applies to you, a reportable breach reaches your supervisory authority within 72 hours of us becoming aware of it.

10. Your rights

Under the FADP, and under the GDPR where it applies, you can ask us to:

• confirm whether we process data about you and give you a copy;
• correct data that is wrong;
• delete data we no longer need;
• restrict or object to processing;
• receive your data in a portable format;
• withdraw a consent you gave, with effect for the future.

Write to [email protected]. We may ask you to confirm your identity first, and we answer within the period the law sets — usually 30 days. You can also complain to the FDPIC, Feldeggweg 1, 3003 Bern, Switzerland, or, if you live in the EU or EEA, to your local data protection authority.

11. Automated decisions

We make no automated decisions that produce legal effects for you, and we do not build profiles for advertising. Rate limits and budgets are automatic, but they throttle requests rather than judge people.

12. Minors

The product is a tool for businesses and adults; accounts are for people aged 18 or over. We do not knowingly collect data from children under 16. If you believe a minor has sent us data, write to us and we delete it.

13. Changes

We update this page when the service changes, and the date at the top moves with it. If a change materially affects how we use your data, we announce it in the dashboard or by email at least 30 days before it takes effect, where that is possible.

14. Contact

Grafizum, Switzerland — [email protected]. Complaints may also go to the FDPIC, Feldeggweg 1, 3003 Bern, Switzerland.