Privacy & image rights

1. Who is responsible

THE SAME Adventures GmbH, Hauptstrasse 28, 4102 Binningen, Switzerland. KMUwebsite is a brand of THE SAME Adventures GmbH. For privacy questions you can reach us at info@kmuwebsite.ch.

2. Which data we process

• Account data: email address and name.
• Project details: everything you enter in the questionnaire, for example company details, texts, your story and contact details for the website.
• Files: logos, images and documents you upload.
• Payment data: orders, amounts and subscription status. We don't store card details; they go directly to our payment provider.
• Checklist and newsletter: first name, email address and your consent.
• Communication: messages to our support.
• Technical data: IP address, browser, time of access and a log of important actions (for example approvals and payments) for security.

3. What we use it for

• to create your website, show you the preview, publish it and run it
• to handle orders, invoices and the Care plan
• to communicate with you and provide support
• to prevent misuse, for example multiple free drafts
• to send you the checklist and, only with your consent, tips and offers by email
• to meet legal obligations, such as keeping accounting records

For people in the EU, we rely on performance of the contract, our legitimate interest in secure operation, your consent and legal obligations.

4. Who receives your data

We don't sell data. We only pass it on to carefully selected service providers we need to operate:

• Hosting, database and file storage: Lovable (Sweden) with Supabase; database and files are stored in a data centre in Ireland (EU). Pages are delivered via the global network of Cloudflare (USA).
• Automated creation of texts and design: OpenAI (USA), connected via Lovable (Sweden). We only transfer the project details needed for your website. The provider may not use them to train its own systems.
• Payment processing: Stripe (Ireland/USA)
• Email sending and domain connection: providers will be added here once set up

These service providers only process data on our behalf and according to our instructions.

5. Processing abroad

Some service providers process data in the EU or the USA. Transfers to the EU are based on the Federal Council's recognition of adequate data protection. Transfers to the USA go to companies certified under the Swiss-U.S. Data Privacy Framework, or are based on the EU Commission's standard contractual clauses recognised by the FDPIC.

6. How long we keep data

• Project and account data: until 30 days after your contract ends, then we delete it
• Free drafts without purchase: at the latest 12 months after your last activity
• Accounting records: 10 years, as required by law
• Checklist and newsletter: until you unsubscribe or withdraw your consent
• Technical logs: no more than 12 months

You can delete drafts and uploads yourself in your customer area at any time.

7. Cookies and tracking

We only use cookies and storage that are technically necessary for signing in and operating the service (including remembering your language choice). We don't use analytics or advertising trackers.

8. Data on our customers' websites

If, for example, contact requests come in via your website, you are responsible for them. We process this data as a processor only to run your website and according to your instructions.

9. Security

We protect your data with encrypted transmission, private file storage, access for authorised persons only, daily backups and a log of important actions. Risks on the internet can never be ruled out completely.

10. Your rights

You can request information about your data at any time, have it corrected or deleted and obtain it in a common format. You can object to processing and withdraw consent at any time. Just write to us at info@kmuwebsite.ch. Legal retention obligations remain reserved. You can also lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC).

11. Image rights

• Your images: by uploading, you confirm that you may use every image and logo on your website. Either you created it yourself, or you hold a licence that permits its use.
• People in images: identifiable people must have agreed to publication. This also applies to employees and customers.
• Third-party images: you may only use images from other websites, search engines or social media with explicit permission. We also only reuse images from your current website if you confirm the rights.
• Royalty-free images: if you don't have your own images, we use images from sources that allow commercial use. You may only use them on your website.
• Automatically created images: they don't depict real people, employees or projects of your company and are not captioned as such.
• Reports of infringements: if someone believes an image infringes their rights, write to us at info@kmuwebsite.ch. We review the report promptly and remove the image if necessary.
• Storage: uploaded files are stored privately. Only you and our team can see them until they appear on your published website.

12. Changes

We update this policy when our services or the law change. The version published here applies.