Privacy notice for the dashboard

Controller

The controller is Loaded AG, Klostergutstrasse 4, 8252 Schlatt TG, Switzerland, UID CHE-413.943.367, VAT no. CHE-413.943.367 MWST. anewera is a brand of Loaded AG. We answer questions about data protection at bw@anewera.ch.

We are responsible ourselves for the account, sign-in, billing, protection against abuse and operations. We process your project’s content on your behalf; the data processing agreement applies to it.

Account and sign-in

What we process: your email address, your password (managed by Supabase Auth; we never see it), your company’s name if you give it, and which version of the terms you accepted and when. If you come from the free AI check on anewera.ch, we keep its number so that the setup can take over your details.

We send sign-in links, confirmations and notices about your account by email. If you sign in with Google or Microsoft where that is offered, we receive your email address from them and the profile details the provider passes on, such as your name; their own terms apply to signing in there.

Protection against abuse: at sign-up, Cloudflare Turnstile checks that a human is signing up; for this Cloudflare receives your IP address and browser details. So that nobody uses sign-up and sign-in in bulk, we keep your IP address and email address only as an encrypted value (HMAC) and delete it after one day.

One trial per person and company: so that each person and each company uses the trial once, we store your email address in a normalised form and your company’s domain (not those of email providers). We keep this entry even when you delete the organisation or your account.

The basis is the contract with you and our legitimate interest in a secure service without abuse (art. 6(1)(b) and (f) GDPR).

Organisation and team

We store which organisations you belong to and with which role. If you invite someone, we store their email address, the role, who invited them, and of the invitation link only a hash. We send the invitation by email; its link is valid for 14 days.

Your project’s content and the measurement

Setup: we read your website’s home page and up to 1,500 characters of your imprint or contact page. A language model from Anthropic (Claude Haiku 5.5) describes your company from them, another (Claude Sonnet 5.5) suggests questions and competitors. An imprint can contain names of people.

Measurement: your questions go with country and language through DataForSEO and Bright Data to ChatGPT, Gemini, Google AI Overview, AI Mode and Perplexity, and to Claude through Anthropic’s interface with your project’s approximate location (country, city, region, time zone). No details about you or your team go with them.

Analysis: we store the answers with their sources and searches, and the raw provider responses in private file storage. A language model from Anthropic classifies how the answers name the brands (it sees short excerpts around each mention), checks weekly what the engines say about your company, and describes public websites for actions.

What for: to show you the measurement and its analysis. We process this data on your behalf (data processing agreement).

Connections and API

For personal API keys we store the name you give, the first twelve characters, a hash of the key, its access and when it was last used, never the key itself. If you connect a tool such as Claude or ChatGPT, we store which tool, where it returns to and which access you allowed; codes and tokens only as a hash. A code is valid for five minutes, an access token for an hour, a refresh token for 30 days; we delete them one day after they expire. Per day we count the calls of each key and connection, not what was asked.

Subscription and payment

Payment runs through Stripe (Stripe Payments Europe, Ltd., Ireland). Stripe receives from us your organisation’s name and the email address of the person paying, and collects the card, billing address and, if you give it, the VAT number itself. We store the customer number at Stripe, that email address, the state of the subscription and the chosen services, no card details. Stripe’s privacy notice also applies to the payment itself.

If a payment cannot be collected, we email owners and admins. The basis is the contract; we keep accounting records for 10 years as the law requires (art. 958f Swiss Code of Obligations).

Emails

We only send emails that belong to the service, all through Resend:

• about the account: confirming your email address, sign-in link, notice of an existing account, confirming and reporting a new email address, confirming deletion;
• about the team: invitations;
• about the trial: at the start, on day five and on day seven, to the owner. We record that an email was sent with the address’s domain, not the address;
• about the subscription: when a payment cannot be collected. Stripe sends the invoices;
• the summary: every Monday a summary of the projects to owners and admins, once we switch it on for customers;
• alerts: when a figure changes beyond the margin of error, to the people of the organisation, at once, once a day or not at all as each person chooses, once we switch them on.

We send you no advertising through the dashboard.

Operations and security

When you open the dashboard, Vercel receives technically necessary details such as your IP address, the address requested, the time and details of your browser; Vercel keeps technical logs of this.

To see loading times and errors, we store each page view with the page (without identifiers in the address), status code and loading time, and instead of your identifier only a short hash of it, without the IP address. We delete these entries after 30 days. We store errors without email addresses, keys and tokens; if the error service Sentry is switched on, it receives the same cleaned details.

The basis is our legitimate interest in a secure and working service (art. 6(1)(f) GDPR).

Cookies and browser storage

The dashboard sets only cookies it needs to work. Only the server can read them. It loads no advertising or analytics scripts; only sign-up loads Cloudflare Turnstile.

Providers and transfers abroad

Which providers receive which data and where they process it is in the list of subprocessors. Some are based in the USA or process data there. We transfer data to the USA on the basis of the Swiss-U.S. or EU-U.S. Data Privacy Framework where the provider is certified, otherwise with standard contractual clauses.

How long we keep data

Your rights

Under the Swiss Federal Act on Data Protection (FADP) you have the right to information about your data, to correction, to deletion, to object and to receive your data in a common format. If you are in the EU or EEA, you have the corresponding rights under the General Data Protection Regulation (GDPR). Much of it you can do yourself in the dashboard: change your email address, revoke keys and connections, download data, delete your account.

Write to us at bw@anewera.ch. If your request concerns data we process on behalf of a customer, we pass it on to them. You can also complain to the Federal Data Protection and Information Commissioner (FDPIC) or a supervisory authority in the EU.

Changes

If what the dashboard processes changes, we update this notice and give the date at the top. We tell owners about significant changes by email beforehand.