Privacy policy

1. Who is responsible

This policy explains how Oikos AI, Jason Brownbridge (“Oikos”, “we”, “us”) processes personal data on this website.

EU representative under Art. 27 GDPR, if required.

2. What this policy covers

This policy covers the website oikos-ai.ch: visits, demo requests and contact, personal and campaign links, website events, cookies and the emails we send.

The Oikos product is not covered here. When an organisation uses Oikos, we process the documents and other data it puts in on its behalf. How we do that is set out in the data processing agreement that is part of the order form and every contract. Our security overview describes the measures. If your data is in documents an organisation processes with Oikos, please contact that organisation. We pass on any request that reaches us.

3. Website

Visiting the website. Our hosting provider Cloudflare processes technical data needed to deliver and protect the website: IP address, date and time, page requested, browser and device information, and referring site. We do not load fonts, scripts or images from other providers.

Analytics. We count visits with Cloudflare Web Analytics, which uses no cookies and does not track you across sites. To see how our site performs, we also record events such as which section was viewed, which step of the demo form was reached, and how long the page took to load (with the type of connection, such as 4G). They carry a random session id that is deleted when you close the tab, your language, the solution shown, the campaign, the referring site, your country, the type of device, the names of the browser and operating system (such as Safari and iOS, not the full browser identification), and a one-way code of your IP address, made with a secret key, so that visits from the same network can be grouped. We do not store your IP address itself, and the events contain nothing else that could identify you. Requests from automated programs, such as search engines’ crawlers, are recorded with the program’s name and full identification, the page requested, the country and the same code of the IP address.

Personal and campaign links. A link we send you contains a random id. Opening it shows the page in your language, with a greeting if we prepared one for you. The cookie oikos_c keeps that id for 90 days, or until the link expires, so the page stays the same when you come back. If the link was made for you personally, we can see that it was opened and the events above, counted under that link.

Cookies and local storage. See our cookie policy.

We do not process website or demo request data with AI models.

4. Demo requests and contact

When you request a demo or contact us, we process what you enter: your email address and, if you add them, your name, organisation, role, organisation size, timing, phone number and message. We also store your language, the solution and campaign you came from, the referring site, your country (derived from your IP address) and a one-way code of your IP address, made with a secret key, which we use to prevent abuse and to link your request to visits from the same network. We do not store your IP address itself.

We use this data to answer you, arrange and hold the demo, and follow up about Oikos. We keep it for 24 months after our last contact, unless you become a customer or ask us to delete it sooner.

We do not ask for sensitive personal data, such as health data, on our website or in demo requests. Please do not send us any. Our demos run on example documents.

5. Emails we send

We email you to answer your request and arrange the demo. We send marketing emails only if you agreed or the law allows it for existing business contacts. You can object or unsubscribe at any time by replying or using the link in each email. We then stop and keep only what we need to respect your choice.

6. Legal basis

Where the GDPR applies, we rely on: steps before a contract (Art. 6(1)(b)) for demo requests; our legitimate interests (Art. 6(1)(f)) in operating and securing the website, preventing abuse, understanding how the website is used and contacting business contacts; and consent (Art. 6(1)(a)) where we ask for it. Under the FADP, processing in line with this policy needs no justification; where one is needed, we rely on the same grounds.

7. Who receives data

We share personal data only as needed with:

We also disclose data to authorities where the law requires it, and to advisers bound by confidentiality.

8. Data abroad

Cloudflare serves the website from a global network, and Cloudflare and Google are US companies, so data may be processed outside Switzerland, in particular in the USA. Switzerland recognises the EU and EEA as providing adequate protection. Where a country does not have adequate protection, we use the standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC), or rely on the recipient's certification under the Swiss-US Data Privacy Framework. You can ask us for a copy of the safeguards we use.

9. How long we keep data

We keep personal data only as long as needed for the purposes in this policy or as the law requires:

10. Security

The website is served over an encrypted connection only. We store your IP address only as a one-way code made with a secret key. Only the people who run Oikos can see demo requests.

11. Your rights

Subject to the law, you have the right to:

• ask whether we process your data and receive information about it, including a copy (Art. 25 FADP, Art. 15 GDPR);
• have incorrect data corrected;
• have your data deleted or its processing restricted;
• object to processing, in particular for direct marketing;
• receive data you gave us in a common electronic format (Art. 28 FADP, Art. 20 GDPR);
• withdraw consent with effect for the future.

To exercise these rights, write to privacy@oikos-ai.ch. We may ask you to confirm your identity. For data in documents an organisation processes with Oikos, please contact that organisation (see section 2).

You can complain to the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch, or, where the GDPR applies, to the data protection authority in your country.

12. Changes

We may update this policy. The version on our website is the current one.