Privacy policy

1. Controller

Stellar GmbH Gewerbestrasse 10, 6330 Cham, Switzerland We operate under the brand Custodos. Email: datenschutz@custodos.com

The controller decides alone on the purposes and means of processing personal data that arises in connection with the operation of this website and the services offered, except where we act as a processor for business customers (section 2).

2. Scope

This privacy policy applies to the website at custodos.com and to data processing within our AI platform. For the App at app.custodos.com, its own privacy policy (app.custodos.com/datenschutz) applies in addition and names the service providers used in detail. We distinguish two roles: for business customers, we process the content in the Workspace as a processor under the data processing agreement (DPA); the business concerned is then the controller. For private customers of Custodos Personal, we are the controller ourselves, including for the content (section 5).

We align our data processing with the EU General Data Protection Regulation (GDPR) where it applies to our offering, for example towards customers and website visitors in Germany, Austria and the rest of the European Economic Area. As a provider established in Switzerland, the Swiss Federal Act on Data Protection (revFADP, in force since 1 September 2023) applies to us in addition. In Austria, the Data Protection Act (DSG) supplements the GDPR.

3. What data we process

We process personal data only to the extent necessary to operate the website and deliver our services. In detail, this may include:

• Server log data: IP address, date and time of access, user agent, referrer URL, resource requested, HTTP status code, volume of data transferred. This is recorded technically by our hosting provider.
• Contact: if you write to us by email, you transmit your name, email address and the content of your message. We process this data in order to answer your enquiry.
• Appointment booking: when booking a demo through the Cal.com booking window, you transmit your name, email address, preferred time and any further information you choose to provide.
• Contract data: within a customer relationship we process the business contact details of the people involved as well as contract information (services, terms, fees, correspondence).
• Platform account and usage data (business customers): when the AI platform is used in a business, we process name, business email address, roles and Workspace log data. Content that business customers enter into the platform (inputs, documents, connected sources) is processed by us solely as a processor under the DPA; it is not used to train AI models.
• Custodos Personal: account, content, settings, usage and billing data of private customers; details in section 5.
• Applications: If you apply for a role via custodos.com/careers, you provide your name, email address, phone number, a LinkedIn profile or a CV (at least one of the two), a few sentences on your motivation, your level of German and your earliest start date. In addition, we receive the link through which you reached the page (campaign parameters and landing page), where available, and, briefly and to prevent abuse, the IP address of your connection. We use this data to review your application, contact you and decide on hiring.

4. Purposes and legal bases

We process personal data for the following purposes:

• Provision and security of the website (legitimate interest in a stable and secure web presence: Art. 6(1)(f) GDPR / Art. 31(1) revFADP).
• Answering enquiries and initiating contracts (pre-contractual measures: Art. 6(1)(b) GDPR / Art. 31(2)(a) revFADP).
• Performance of existing contracts with our customers, including provision of the AI platform (Art. 6(1)(b) GDPR / Art. 31(2)(a) revFADP).
• Provision of Custodos Personal to private customers, including the processing of their content (Art. 6(1)(b) GDPR / Art. 31(2)(a) revFADP); details in section 5.
• Conducting application procedures (Art. 6(1)(b) GDPR / Art. 31(2)(a) revFADP in conjunction with Art. 328b of the Swiss Code of Obligations). Inclusion in our talent pool only takes place with your consent (Art. 6(1)(a) GDPR), which you give separately in the form and can withdraw at any time with effect for the future.
• Compliance with the statutory retention obligations that apply to us, e.g. under commercial, tax or VAT law, in particular Art. 958f of the Swiss Code of Obligations (Art. 6(1)(c) GDPR where the obligation arises from EU or member state law, otherwise Art. 6(1)(f) GDPR, our legitimate interest in complying with these obligations / Art. 31(1) revFADP).
• Measuring the success of our advertising, advertising on other platforms (retargeting) and identifying visiting companies, only with your consent (Section 25(1) TDDDG, Art. 6(1)(a) GDPR / Art. 31(1) revFADP); details in section 8. We do not currently use audience measurement.

5. Custodos Personal: we as controller

If you use Custodos as a private individual in a personal Workspace of Custodos Personal, we are the controller for the processing of your data within the meaning of Art. 4(7) GDPR and Art. 5(j) revFADP, including for the content you enter or upload. No data processing agreement (DPA) applies here; it concerns business customers only.

In doing so, we process:

• Account and login data: email address, name (if provided), sign-in method (link by email or sign-in with Google or Microsoft) and session data.
• Content: your inputs, uploaded files and their extracted text, responses from the AI models, chat histories and your stored knowledge.
• Settings: for example AI region, protection of personal data, web search and deletion period.
• Usage and billing data: consumption of your usage budget, model used, token volumes and billing data, without the content of your chats.
• Technical logs: server logs without the content of your chats.

We process this data to provide Custodos Personal, forward your requests to the AI models you choose, bill and support you (Art. 6(1)(b) GDPR / Art. 31(2)(a) revFADP), to ensure operation and security and prevent abuse using logs without chat content (Art. 6(1)(f) GDPR / Art. 31(1) revFADP), and to comply with statutory retention obligations (legal bases as in section 4). Options that you expressly switch on, such as the “Global” AI region or web search in “Extended” mode, are based on your consent (Art. 6(1)(a) GDPR / Art. 31(1) revFADP); you can withdraw it at any time in the settings with effect for the future.

We cannot provide Custodos Personal without account and content data. Your content is not used to train AI models.

Your data is stored in Switzerland. You choose where the AI models process your requests: in the EU or in Switzerland. A global region, in which models may also process outside the EU and Switzerland, only applies if you explicitly turn it on.

For Custodos Personal we use the same service providers as for business customers, here under our own responsibility: Infomaniak (hosting of the application and database, Switzerland), Amazon Web Services (encrypted backups in Zurich), the model providers Amazon Web Services (Bedrock), Google Cloud and Microsoft Azure within the AI region you choose, European Perspective SAS (Staan, web search, France; on by default and can be switched off in the settings), Linkup SAS (web search in “Extended” mode, France; only if you choose this mode; according to the provider, requests may be processed outside the EU), Cloudflare (network and security in front of the app) and Stripe for invoicing and payment processing for paid use. OpenAI (USA) receives content only if you switch on the “Global” region. The privacy policy of the app at app.custodos.com/datenschutz states the registered office, data location and data transmitted for each provider.

Data is transferred to countries outside the EU and Switzerland if you switch on the “Global” region (OpenAI, USA) or choose web search in “Extended” mode (Linkup), and to US-based providers for network and payment (Cloudflare, Stripe). This is based on the EU-U.S. Data Privacy Framework or the Swiss-U.S. Data Privacy Framework, where the provider is certified under it, or on the EU standard contractual clauses with the Swiss addendum.

Section 7 sets out how long we keep this data, and section 9 sets out your rights. If you enter data about other people, please make sure you are entitled to do so.

6. Processors and third-party providers

To operate our website and deliver our services we rely on carefully selected service providers acting as processors within the meaning of Art. 28 GDPR and Art. 9 revFADP:

• Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA: hosting and delivery of the website including server logs and global delivery via the Vercel edge network. The transfer is based on the EU standard contractual clauses agreed with Vercel; Vercel is also registered under the EU-U.S. Data Privacy Framework.
• Cloudflare, Inc., 101 Townsend St., San Francisco, CA 94107, USA: domain management, DNS and, where applicable, CDN and security functions. Cloudflare acts as a processor; the transfer is based on the EU standard contractual clauses agreed with Cloudflare.
• Cal.com, Inc.: embedded appointment booking widget at cal.com. When you make a booking, the data you enter is transmitted to Cal.com. Cal.com routes requests from the EU to EU data centres; the transfer is based on the EU standard contractual clauses agreed with Cal.com.
• Applicant management: The application form runs on this website at Vercel. From there, your details are sent encrypted to our internal applicant management system, which is also operated at Vercel; the database and file storage for CVs are provided by Supabase, and confirmation emails are sent via Resend.
• Sending and receiving email: business email communication runs through standard email providers. The exact set-up will be published here as soon as the business infrastructure is finalised (planned: Cloudflare Email Routing in combination with a mailbox provider with servers located in the EU).
• AI platform: we use infrastructure and model providers for the platform. For business customers, this processing takes place under the DPA concluded with the respective business, which lists the sub-processors used (app.custodos.com/avv); for Custodos Personal, under our own responsibility (section 5).

7. Retention periods

We store personal data only for as long as is necessary for the respective purpose:

• Server logs: a maximum of 30 days, then deleted or anonymised.
• Email enquiries: until your enquiry has been dealt with conclusively and, where applicable, until the end of any resulting business relationship, but at most for as long as statutory retention periods require (generally six to ten years).
• Contract data: for the duration of the contract and thereafter until statutory retention periods expire.
• Platform data of business customers: for the duration of the contract; after the contract ends, customer data is deleted unless statutory retention obligations prevent this.
• Custodos Personal: content according to the deletion period you set; you can delete individual chats or all chats yourself at any time. Account data until your account is closed; the account is then de-identified, and chats and sessions are deleted. We keep usage and billing data for ten years (Art. 958f of the Swiss Code of Obligations).
• Application data: If you are not hired, we delete your application including your CV six months after the rejection or your withdrawal. If you have agreed to be included in the talent pool, we keep the application for twelve months instead and delete it afterwards.
• Bookings and resulting enquiries in our CRM: until they have been dealt with conclusively and, where applicable, until the end of any resulting business relationship, but at most for as long as statutory retention periods require. If no business relationship results, we delete the data as soon as it is no longer needed for initiating one.
• Cookies: “consent” twelve months, “attr” 90 days; the advertising services’ cookies according to the providers’ periods (section 8). If you withdraw consent, we delete “attr” and the advertising cookies on our domain immediately.

8. Cookies, consent and advertising measurement

On your first visit, a consent banner asks whether we may use cookies and similar technologies beyond those that are technically necessary. We built the banner ourselves; it loads no third-party services. Until you make a choice, we load no advertising or measurement services and store no source data on your device. “Reject” is as easy as “Accept all”.

You can change or withdraw your choice at any time via the “Cookie settings” link in the footer of every page. Withdrawal takes effect immediately for the future; we then delete the “attr” cookie and the advertising services’ cookies on our domain. The lawfulness of processing carried out until then is not affected.

The legal basis for storing and reading information on your device is your consent under Section 25(1) of the German TDDDG; for the subsequent processing of personal data it is Art. 6(1)(a) GDPR (in Switzerland Art. 31(1) revFADP). The “consent” cookie is technically necessary (Section 25(2) no. 2 TDDDG, Art. 6(1)(f) GDPR).

The following cookies and services are only used if you consent to the Marketing category. The advertising services are also only active where we have set them up for our campaigns; the banner shows which ones are currently included under “Settings”:

• Cookie “consent” (necessary): stores your choice (version, statistics yes or no, marketing yes or no, time), twelve months. It applies to custodos.com and app.custodos.com so that the app also respects your choice. “NEXT_LOCALE” is also necessary: it remembers the language of the page and is deleted when you close the browser.
• Cookie “attr” (Custodos itself): stores which campaign brought you to us: campaign parameters (utm_…), the ad networks’ click identifiers (gclid, gbraid, wbraid, fbclid, li_fat_id, msclkid), the referring website, the landing page without parameters, the time and a random identifier. Retention 90 days, also valid for app.custodos.com. If you create an account there, we link this information to your workspace to see which campaign led to a trial or purchase.
• Google Ads (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): conversion measurement and remarketing. We use Google Consent Mode in its basic form: the Google tag is not loaded before you consent. With consent, Google sets cookies (such as “_gcl_au”) and learns that you took an action after clicking an ad, such as booking a demo. With enhanced conversions, hashed contact data (irreversibly encrypted) may be transmitted so that Google can attribute the action to the ad. Google processes this data as an independent controller; the Google Ads Controller-Controller Data Protection Terms apply (business.safety.google/adscontrollerterms).
• Meta Pixel and Meta Conversions API (Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland): measuring success and building audiences for advertising on Facebook and Instagram. With consent, Meta sets cookies (“_fbp”, “_fbc”) and receives page views, bookings and clicks on “Start free trial” and the purchase link. We may also report the same event to Meta from our server, with a hashed email address, click identifier, IP address and browser identifier; a shared event ID prevents double counting. We are jointly responsible with Meta for the collection and transmission to Meta (Art. 26 GDPR; CJEU, judgment of 29 July 2019, C-40/17, “Fashion ID”). The arrangement is the Meta Controller Addendum (facebook.com/legal/controller_addendum); Meta alone is responsible for any further processing. Under it, Meta handles requests for access, erasure and other rights regarding the data Meta processes; requests we receive are forwarded to Meta.
• LinkedIn Insight Tag and LinkedIn Conversions API (LinkedIn Ireland Unlimited Company, Wilton Plaza, Wilton Place, Dublin 2, Ireland): measuring success, retargeting and aggregated reports about visitors. With consent, LinkedIn sets cookies (such as “li_fat_id”) and receives events such as a booking; from our server we may also transmit the hashed email address and the click identifier. We are jointly responsible with LinkedIn for the collection via the Insight Tag and the transmission to LinkedIn (Art. 26 GDPR). The arrangement is LinkedIn’s Joint Controller Addendum (linkedin.com/legal/l/jca); LinkedIn alone is responsible for any further processing.
• SalesViewer (SalesViewer® GmbH, Universitätsstraße 60, 44789 Bochum, Germany): recognises by IP address which company is visiting our website. It recognises companies, not individual people. Besides withdrawing consent via “Cookie settings”, you can also object directly with SalesViewer: at salesviewer.com/en/opt-out, SalesViewer sets an opt-out cookie in the browser concerned.

Appointment booking: “Book a demo” opens the Cal.com booking as a window on our page; the Cal.com script only loads on that click. If you have consented to Marketing, we pass the random identifier from “attr”, campaign parameters and click identifiers to the booking so that we can attribute it to a campaign.

Transfer to our CRM: we transfer bookings with the information you provided yourself (name, email address, company where given) to our own customer management system (CRM) to prepare the appointment and look after you (Art. 6(1)(b) GDPR / Art. 31(2)(a) revFADP). We only include source data if you have consented to Marketing.

Retention: how long Google, Meta and LinkedIn keep their own cookies and the data transmitted is determined by the providers; details are in their privacy notices.

Local storage: with your consent, Google and LinkedIn may also store identifiers in your browser’s local storage (“_gcl_ls”, “li_adsId”). If you withdraw consent, we delete these entries as well.

Transfers to third countries: Google, Meta and LinkedIn may transfer data to the USA. This is based on the EU-U.S. Data Privacy Framework or the Swiss-U.S. Data Privacy Framework, where the respective US parent company is certified, and additionally on the EU standard contractual clauses.

Statistics: we do not currently use an audience measurement tool. If we add one, we will name it here and ask you in the banner beforehand.

9. Your rights as a data subject

Under the applicable data protection legislation you have the following rights:

• the right of access to the data we process about you;
• the right to rectification of inaccurate data and completion of incomplete data;
• the right to erasure;
• the right to restriction of processing;
• the right to receive your data or have it transferred;
• the right to withdraw consent once given, with effect for the future;
• the right to object to the processing (see below).

An informal message to datenschutz@custodos.com is enough to exercise your rights. We may request suitable evidence to verify your identity.

If you use Custodos through a business's Workspace, that business is the controller for the content there; please contact the business with requests about that content. We support it in this.

Right to object: where we process data on the basis of legitimate interests (Art. 6(1)(f) GDPR), you can object at any time on grounds relating to your particular situation.

We do not take automated individual decisions within the meaning of Art. 22 GDPR and Art. 21 revFADP.

Irrespective of this, you have the right to lodge a complaint with the competent supervisory authority: in Germany the data protection authority of your federal state or the Federal Commissioner for Data Protection and Freedom of Information (BfDI), in Austria the Data Protection Authority (dsb.gv.at), elsewhere in the EEA the respective national authority, and in Switzerland the Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch).

10. Data security

We take appropriate technical and organisational measures to protect your data against accidental or deliberate manipulation, loss, destruction or unauthorised access. These measures are continuously adapted to the state of the art. Data transmitted over the internet is encrypted in transit (TLS).

11. Changes to this policy

We update this privacy policy when our data processing, our services or the legal requirements change. The version published at the time of your visit applies.

12. Authoritative version

This English text is a translation provided for convenience. The German version of this privacy policy is authoritative; in the event of any discrepancy, the German text prevails.