Privacy Policy

This Privacy Policy explains how Ampersand Labs by Davide Morotti, Flüelastrasse 10, 8048 Zürich, Switzerland — UID CHE-497.974.362 ("Ampersand Labs", "we", "us") processes personal data in connection with the Banners platform ("Service"). We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP / nFADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Controller

Ampersand Labs by Davide Morotti
Flüelastrasse 10, 8048 Zürich, Switzerland
UID: CHE-497.974.362
Contact: davide@ampersand.ch

2. Personal data we process

We process the following categories of personal data:

• Account data: name, email address, password (hashed), team and role.
• Content data: banners, assets, comments, feedback and approvals you upload or generate inside the Service.
• Communication data: messages you send to us by email or via in-app forms (e.g. quote requests).
• Usage data: technical log data such as IP address, browser type, timestamps and pages visited.
• Billing data: billing contact, invoicing address and VAT number, where applicable.

3. Purposes and legal bases

• Providing the Service (performance of a contract): operating your account, hosting Customer Content, processing approvals and exports.
• Security and abuse prevention (legitimate interest): protecting the Service against unauthorised access, fraud and malicious use.
• Customer communications (performance of a contract / legitimate interest): responding to enquiries, sending service notifications and quote replies.
• Billing and accounting (legal obligation): issuing invoices and keeping records as required under Swiss law.
• Product analytics (legitimate interest): aggregated, privacy-friendly usage analytics to improve the Service.

4. Cookies and analytics

The Service uses strictly necessary cookies to maintain your authenticated session and security tokens (e.g. CSRF protection). We use Plausible Analytics, a privacy-friendly analytics service that does not use cookies and does not collect any personal data or cross-site tracking identifiers.

5. Recipients and processors

We share personal data only with carefully selected service providers acting as processors on our behalf, including:

• Cloud hosting and infrastructure providers (for application hosting, storage and backups);
• Email delivery providers (for transactional and notification emails);
• Analytics providers (Plausible Analytics);
• Payment, accounting and tax service providers where applicable.

We do not sell personal data to third parties.

6. International transfers

Where personal data is transferred outside Switzerland or the EEA, we ensure an adequate level of protection, in particular through Swiss Federal Council adequacy decisions, EU Standard Contractual Clauses or comparable safeguards.

7. Retention

We retain personal data only as long as necessary for the purposes set out above. Account and Customer Content are kept for the duration of your subscription and deleted within a reasonable period after termination (typically 30 days), unless we are legally required to retain them longer (e.g. accounting records: 10 years under Swiss law).

8. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict or object to the processing of your personal data, as well as the right to data portability and to withdraw consent at any time where processing is based on consent. To exercise these rights, contact us at davide@ampersand.ch. You also have the right to lodge a complaint with the competent supervisory authority — in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC).

9. Security

We implement appropriate technical and organisational measures to protect personal data against unauthorised access, alteration, disclosure or destruction, including TLS encryption in transit, encrypted storage, hashed passwords, role-based access controls and regular backups.

10. Children

The Service is not directed to individuals under 18 years of age. We do not knowingly collect personal data from children.

11. Changes to this Policy

We may update this Privacy Policy from time to time. Material changes will be communicated by email or in-app notice. The "Last updated" date at the top of this page indicates the latest revision.

12. Contact

For any privacy-related question or request, contact davide@ampersand.ch.