Privacy policy
This privacy policy describes how webaddict.ch collects, uses and protects your personal data, in accordance with the Swiss Federal Act on Data Protection (FADP / nFADP).
1. Controller
webaddict.ch, 12 Impasse du cerisier, 1728 Rossens, Suisse. Contact: contact@dahuai.ch.
2. Data collected
We collect in particular:
- Registration data (name, email, hashed password)
- Payment data (processed by Stripe; we do not store card numbers)
- Conversation history and content entered in chat
- Technical data (IP address, user-agent, session cookies)
- Language preferences and account settings
- Optional connector metadata (e.g. Intervals.icu: connection status, athlete name) — not OAuth tokens
3. Purposes and legal basis
Data is processed to provide the service (performance of the contract), billing, legal compliance and, where applicable, our legitimate interests (security, service improvement). Consent is requested when required by law.
4. Retention
Data is kept for the duration of the contract and, depending on the category, in line with legal obligations (e.g. accounting) or our legitimate interests (backups, disputes). You may request deletion of your account, subject to retention duties.
5. Processors and transfers
We work with providers in Switzerland and the EEA, including:
- Hosting : infomaniak (Suisse)
- Payments : Stripe (EU/United States, appropriate safeguards)
- AI models : Infomaniak (Switzerland) (provider aligned with data-protection requirements)
- Optional connectors : Intervals.icu (outside Switzerland, read-only) — OAuth tokens and activity metadata; explicit consent; inference via Infomaniak
Transfers outside Switzerland or the EEA are subject to appropriate safeguards (standard clauses, adequacy decisions).
6. Cookies and tracking
We use essential cookies (session, authentication) and, where applicable, preference cookies. No third-party advertising or profiling cookies are used by default. You may configure your browser to limit cookies.
7. Your rights
Under the FADP you have rights of access, rectification, erasure and portability, as well as the right to object to processing or to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC).
To exercise your rights: contact@dahuai.ch.
8. Transfers to third countries
Some processing involves transfers of personal data to countries not considered to offer an equivalent level of protection to Switzerland or the EEA, notably the United States in the context of payments (Stripe) and, if you enable the connector, Intervals.icu for sports activity metadata.
For transfers from Switzerland to the United States where the recipient participates in the Swiss–U.S. Data Privacy Framework (Swiss-U.S. DPF), we rely on that mechanism when applicable. The historical Privacy Shield is not a current basis for these transfers.
For EU residents whose data is processed under the GDPR, and where transfers to the United States are not covered solely by an adequacy decision or another recognised mechanism, EU Standard Contractual Clauses (SCCs) may supplement appropriate safeguards.
Data relating to infomaniak services in Suisse and AI models offered via that provider is processed in Switzerland; Switzerland benefits from an EU adequacy decision recognising an adequate level of protection.
9. Data-breach notification
In the event of a personal-data breach likely to result in a risk to your rights and freedoms, we will inform you as soon as possible when applicable law so requires.
Where the breach presents a high risk or the law requires it, we may notify the competent data-protection authority, in particular the FDPIC, in accordance with the revised Swiss FADP (including Art. 24 nFADP).
10. Governing law and supervisory authority
This policy is governed by Swiss law, including the revised Federal Act on Data Protection (nFADP).
The main supervisory authority for processing under Swiss law is the Federal Data Protection and Information Commissioner (FDPIC).
Persons residing in the European Union may also exercise GDPR rights and, where applicable, lodge a complaint with a data-protection authority in their Member State (Article 77 GDPR).
Last updated: 24.10.2026
