Privacy Policy
How Alpincode collects, uses, and protects personal data. Some entity details are still placeholders and will be finalised before launch — see the Imprint page for current status.
Last updated:
1.Controller
Alpincode, currently operating as a self-employed professional in Switzerland. Placeholder address: Winterthur, Switzerland. Contact email for privacy requests: contact@alpincode.com.
Because Alpincode offers services to users in the EU/EEA, the EU GDPR applies in addition to Swiss law (nFADP). For UK visitors, the UK GDPR applies. We may appoint an EU Article 27 representative; this page will be updated when one is in place.
2.Personal data we process
From the contact form: name, email, phone (when you choose a phone-based contact channel), company, country, preferred contact channel, service of interest, budget range, timeline, website URL, your message, and a confirmation that you have read this policy. We do not offer a newsletter today; if we add one, it will be a separate, optional sign-up with its own clear notice and a one-click unsubscribe.
Automatically by our infrastructure: a SHA-256 hash of your IP address kept for at most 10 minutes for rate limiting (the raw IP is never written to storage), the page origin, and a Cloudflare Turnstile token sent to verify you are human.
3.Purposes and legal bases
Replying to a request, preparing an offer, executing a contract — GDPR Art. 6(1)(b) pre-contractual measures and contract performance; nFADP Art. 31(1). The privacy-policy acknowledgement next to the submit button is a confirmation that you have read this notice, not the lawful basis for the processing.
Bookkeeping, invoicing and tax records — Art. 6(1)(c) legal obligation; Swiss Code of Obligations art. 957/958.
Anti-spam, rate limiting and security — Art. 6(1)(f) legitimate interest in operating a usable, abuse-free contact channel.
4.Service providers and recipients
We use the following processors, each under a written data processing agreement:
Cloudflare, Inc. (US) — hosting at the edge, Worker that receives the contact form, anti-bot (Turnstile), email routing to our inbox. Certified under the EU‑US, Swiss‑US and UK Extension Data Privacy Frameworks.
Resend, Inc. (US) — delivery of the transactional email containing your contact request. Certified under the EU‑US Data Privacy Framework and UK Extension.
Google LLC (US) — Gmail receives the final notification email. Certified under the EU‑US and Swiss‑US Data Privacy Frameworks.
Stripe, Inc. (US) — payment processing when you become a paying client. Certified under the EU‑US Data Privacy Framework. (Activated only on engagement.)
If you choose to contact us through Telegram, that conversation runs on Telegram FZ-LLC (UAE), which has no adequacy decision. Use email if you prefer not to share data with that channel.
If you choose WhatsApp, that conversation runs on WhatsApp, part of Meta. In Europe the service is provided by WhatsApp Ireland Ltd.; Meta is certified under the EU‑US and Swiss‑US Data Privacy Frameworks. Use email if you prefer not to share data with that channel.
5.International transfers
Transfers to the United States are covered by the EU‑US Data Privacy Framework for EU/EEA visitors, the UK Extension for UK visitors, and the Swiss‑US Data Privacy Framework for Swiss visitors, supplemented by Standard Contractual Clauses as a fallback. We do not currently transfer data to any country without an adequacy decision or appropriate safeguards, with the exception of Telegram described above.
6.Retention
Contact request email in our inbox: up to 24 months from the last interaction, unless a contract is signed.
Resend delivery logs: kept by Resend for up to 90 days under their default policy; we do not keep a separate copy.
Cloudflare rate-limit hashes: at most 10 minutes, after which they expire automatically.
Invoices, contracts and accounting records: 10 years (Swiss Code of Obligations art. 958f, VAT law).
Active client project files: project duration plus 5 years for warranty and reference.
7.Your rights
You can ask us to access, correct, delete, restrict or port your data, object to processing based on legitimate interest, and withdraw any consent you have given. To exercise a right, write to contact@alpincode.com. We respond within 30 days.
You can also complain to a supervisory authority: in Switzerland the FDPIC (edoeb.admin.ch), in Spain the AEPD (aepd.es), in France the CNIL (cnil.fr), in Germany your competent state DPA or the BfDI, in the UK the ICO (ico.org.uk).
8.Cookies
The site does not set any cookies today. It only stores your choice on the cookie notice in your browser's local storage. This is strictly necessary and not subject to consent under EU ePrivacy rules, § 25 TDDDG (Germany), the AEPD 2024 cookie guide (Spain), CNIL doctrine (France) or PECR (UK). No analytics, advertising or tracking cookies are loaded. If we add non-essential cookies in the future, we will update this page and the banner with a clear category breakdown and a reject option of equal prominence. Our interactive demos under /demos/ may save sample data, such as a demo cart or demo tasks, in your browser's local storage. It stays on your device, is never sent to us, and you can delete it at any time in your browser settings.
9.Security
The site is HTTPS only. The contact form is protected by Cloudflare Turnstile, server-side validation, a honeypot field, a rate limit using SHA-256 hashed IPs, and HTML escaping in outbound email. Worker secrets are stored in Cloudflare. The destination Gmail account is protected with two-factor authentication.
10.Changes to this policy
We will update this page whenever we change a processor, a retention period, or a category of data, and we will note the date of the last update at the bottom. Material changes will be flagged on the site.