Privacy Policy

1. Scope and Controller

The data controller responsible for processing personal data on this website under the Swiss Federal Act on Data Protection (FADP) is Albika Khasbulatov, Bim Hasel 22, 3052 Zollikofen, Switzerland.

2. Swiss Data Location and Security

We store and process system data, chatbot knowledge and conversation transcripts in data centres in Switzerland. Infomaniak Network SA (Geneva) provides hosting and the language models; the database holding user accounts and conversation transcripts runs at Supabase in Zurich (provider: Supabase Inc., USA; see section 4).

3. Data Collection Scope

We collect aggregate website statistics without cookie identifiers using Plausible Analytics (self-hosted in Switzerland, cookie-free). When you launch our interactive demo or create a workspace account, we collect your email address and profile context strictly to execute the platform terms.

4. Subprocessors

We only share data with subprocessors contractually bound to process data solely to execute platform services:

  • Infomaniak Network SA (Switzerland) — Hosting & LLM inference processing
  • Supabase Inc. / Pte. Ltd. (data in Zurich; vendor USA/Singapore) — Database (user accounts, conversation transcripts), authentication & storage
  • Stripe Payments (Ireland) — Payment processing and invoice management
  • Cloudflare, Inc. (USA) — Bot and abuse protection (Turnstile) across our services; certified under the Swiss-U.S. Data Privacy Framework

5. Chatbots on Our Customers' Websites

When you use a Connota chatbot on a customer's website (for example a municipality's), that customer is responsible for processing your data and Connota processes it on the customer's behalf. The customer decides whether conversations are stored and for how long (30, 90 or 365 days) and informs you in its own privacy policy. If storage is switched off, your questions are only processed to answer them.

6. Bot and Abuse Protection

To protect our services from automated abuse, we use Cloudflare Turnstile. During the challenge, Cloudflare, Inc. receives your IP address and ephemeral browser signals; it sets no cookies and performs no cross-site tracking. As Cloudflare is a US provider, these transfers rely on its certification under the Swiss-U.S. Data Privacy Framework.

7. User Rights

You have the right to request free information about your stored personal data, its origin, recipient, and the purpose of the processing, as well as the right to access, rectify, block, or delete this data. Contact us at hello@connota.ch.