Privacy Policy
Last updated: 2026-10-26
This Privacy Policy explains how Agenticsis processes personal data of website visitors, prospects, clients, and end users of AI systems we build or operate on behalf of clients. It is written to satisfy the information duties of the Swiss Federal Act on Data Protection of 25 September 2020 (revised FADP, in force 1 September 2023) and the EU General Data Protection Regulation (Regulation (EU) 2016/679, GDPR), as well as the transparency obligations of the EU Artificial Intelligence Act (Regulation (EU) 2024/1689, AI Act).
1. Controller and contact
The controller responsible for the processing described below is:
Agenticsis, the trade name of Sofía Salazar Mora (sole proprietorship)
Earhart-Strasse 10, 8152 Glattpark (Opfikon), Switzerland
Email: info@agenticsis.ch
Telephone: +41 77 411 99 17
For any question about this Privacy Policy, to exercise your rights, or to report a concern, write to info@agenticsis.ch with the subject line “Privacy request”.
Agenticsis has not appointed a Data Protection Officer because we do not meet the criteria of GDPR Article 37 or the Swiss FADP equivalent. Our internal privacy function is held by the founder, reachable at the address above. Where required by GDPR Article 27, we will appoint an EU representative and publish their contact details here.
2. Scope of this Policy
This Policy applies to personal data we process about:
- Website visitors, including users who fill in our contact form, who booked a discovery call through the website booking calendar before it was removed in October 2026, or who interact with cookies and similar technologies on agenticsis.ch.
- Prospects whom we contact for sales or marketing purposes, including individuals whose business contact details we obtain from third-party prospecting tools (see section 11).
- Clients and client personnel, including representatives of organizations that engage us under a written agreement.
- Users of the AI Visibility Program at visibility.agenticsis.ch, our self-service application for businesses, and the people whose data its users enter or find with it. Section 19 describes that processing in full.
- End users of AI systems that we build, deploy, or operate on behalf of clients, to the extent we act as a data controller for the processing in question. Where we act solely as a data processor, the client’s own privacy notice governs and the relationship between us is set out in our Data Processing Agreement.
This Policy does not cover:
- Personal data processed by third-party websites we link to.
- Personal data processed inside a client’s own systems where the client determines purposes and means.
3. Categories of personal data we collect
We collect the following categories of personal data, organized by source.
| Source | Categories of personal data |
|---|---|
| Contact form on agenticsis.ch | First name, last name, email address, company name, company website, phone number, area of interest, city, country, the language of the page you used, and your free-text message. Server-side request metadata is captured separately in our hosting logs (see “Server and security logs” below). |
| Booking system (discovery calls, until October 2026) | Date, time slot, timezone, guest name, guest email, guest phone, company name, free-text notes, booking status. The website no longer shows a booking calendar (since October 2026); records of past bookings are kept as set out in section 8. |
| Discovery calls and engagements | Name, role, contact details, business and technical information you share, recordings or transcripts only where you have consented |
| Newsletter or direct marketing | Email address, opt-in timestamp, opt-out timestamp |
| Prospecting | Business contact details (name, role, employer, business email, business phone) from third-party tools or public B2B sources, and our internal notes |
| AI services we operate as controller | Prompts and outputs processed through our AI agents, model identifier, timestamp, access logs |
| Billing | Name, billing address, VAT number, payment-related metadata (we do not store full card numbers; payment processing is handled by Stripe) |
| AI Visibility Program (visibility.agenticsis.ch) | Account, company, results, content, leads, support and billing data, listed in section 19 |
| Website analytics | None. We do not run analytics on agenticsis.ch. |
| Server and security logs | IP address, request metadata, error traces |
We do not knowingly collect special categories of personal data within the meaning of GDPR Article 9 or sensitive personal data within the meaning of FADP Article 5(c). If you submit such data to us voluntarily, we process it only as needed to respond and delete it as soon as the request is resolved.
4. Purposes and legal bases
We process personal data for the purposes and on the legal bases set out below.
| Purpose | Legal basis (GDPR Art. 6) | FADP basis |
|---|---|---|
| Responding to inquiries via contact form, email, telephone, or messaging | Art. 6(1)(b) pre-contractual measures, or Art. 6(1)(f) legitimate interest in business correspondence | Lawful processing under FADP Art. 30 |
| Scheduling and conducting discovery calls | Art. 6(1)(b) pre-contractual measures | FADP Art. 30 |
| Performing contracted consulting, implementation, AEO/SEO, and content services | Art. 6(1)(b) contract performance | FADP Art. 30, contract |
| Operating AI systems we build for clients, where we act as controller | Art. 6(1)(b) or (f) depending on engagement; explicit consent where required | FADP Art. 30 / Art. 31 where applicable |
| Direct marketing to existing clients about similar services | Art. 6(1)(f) legitimate interest, balanced against your right to object | FADP Art. 30(2)(c) |
| Cold outreach to business prospects (B2B) | Art. 6(1)(f) legitimate interest, subject to ePrivacy soft opt-in and clear opt-out | FADP Art. 30 with overriding private interest analysis |
| Newsletter and other consent-based marketing | Art. 6(1)(a) consent | FADP Art. 31(1)(a) |
| Accounting, invoicing, and tax compliance | Art. 6(1)(c) legal obligation | Swiss CO Art. 957 and 958f, FADP Art. 31(1)(c) |
| Security and fraud prevention | Art. 6(1)(f) legitimate interest | FADP Art. 31(1)(d) |
| Establishment, exercise, or defense of legal claims | Art. 6(1)(f) legitimate interest | FADP Art. 31(1)(c) |
| Cookies and similar technologies (non-essential) | Art. 6(1)(a) consent (EU visitors) | FADP transparency plus opt-out (Swiss visitors) |
Where we rely on legitimate interests under Art. 6(1)(f), we have carried out a balancing test. You may request a summary at info@agenticsis.ch.
5. AI processing transparency
We use third-party AI services and, on some engagements, AI systems we have configured ourselves. This section describes that processing.
Models and providers we use
Anthropic Claude, OpenAI, and Perplexity. We also use HTML/CSS to Image for image rendering. Our AI Visibility Program also uses DataForSEO, which puts the buyer questions a client tracks to ChatGPT, Gemini, Perplexity and Claude and returns their answers; Firecrawl, which reads public web pages; and kie.ai, which generates images for social posts. We send these three no personal data. Each provider is listed on our Sub-processors page.
No training on your data
We configure our integrations so that personal data we send to Anthropic, OpenAI, and Perplexity is not used to train, fine-tune, or otherwise improve their underlying models. We rely on the no-training settings these providers make available under their terms. We will update this Policy promptly if a provider changes its terms in a way that affects this commitment.
Article 50 transparency
When you interact with a chatbot or AI agent operated by Agenticsis, we make clear that you are interacting with an AI system, except where this is obvious to a reasonably well-informed user. Where Agenticsis or a client operating an Agenticsis-built system publishes AI-generated text, image, audio, or video to inform the public on matters of public interest, we label that content as artificially generated or manipulated in accordance with AI Act Article 50.
Logging and accuracy
We do not keep a separate log of the prompts we send to AI providers. For each AI call we record the provider, model, time and cost, for billing and security. AI outputs that are part of a service, such as the reports and content of the AI Visibility Program, are kept while the account or engagement exists and are deleted with it. AI outputs may contain errors, omissions, or fabricated information. Outputs are not professional advice. You must independently verify any output before relying on it.
6. Recipients and sub-processors
We disclose personal data to:
- Sub-processors that host, transmit, or process data on our instructions. The current list is on our Sub-processors page, including purpose, location, and transfer safeguard for each.
- Independent controllers such as banks, tax authorities, courts, and our professional advisors, where disclosure is necessary for a lawful purpose.
- Successors in the event of a merger, acquisition, or sale of business assets, subject to the same protections.
Contact-form messages are stored in our database (Supabase) and passed to our n8n automation server (Hostinger, Frankfurt), which sends a notification to info@agenticsis.ch and a confirmation to the visitor through SendGrid (Twilio). Our email correspondence runs on Google Workspace. Supabase, Hostinger, Twilio and Google act as sub-processors for these messages.
We do not sell personal data. We do not share personal data for cross-context behavioral advertising.
7. International transfers
We transfer personal data to recipients outside Switzerland and the EEA in connection with the services described in this Policy. Our transfer safeguards are:
- EU-US and Swiss-US Data Privacy Frameworks for transfers to certified US-based recipients on our Sub-processors page.
- Standard Contractual Clauses (Decision (EU) 2021/914) for recipients not covered by the DPF, in the appropriate module, with the FDPIC-recognised version applied to transfers from Switzerland.
- Adequacy decisions where the receiving country benefits from a Commission or Swiss Federal Council adequacy decision.
A copy of the relevant transfer instrument is available on request at info@agenticsis.ch.
8. Retention
We retain personal data only as long as needed for the purposes set out in section 4, then delete or anonymize it. Default retention periods are:
| Category | Retention |
|---|---|
| Contact form submissions where no engagement follows | 12 months from last contact |
| Booking records where no engagement follows (past bookings; the calendar was removed in October 2026) | 12 months |
| Active client records | Duration of engagement plus 10 years (Swiss CO Art. 958f) |
| Contracts and signed agreements | 10 years from end of contract |
| Invoices, accounting, and tax records | 10 years (Swiss CO Art. 958f) |
| Direct marketing records | Until opt-out, then a short suppression record |
| AI usage records (provider, model, time, cost; no prompt or output text) | 12 months |
| Server and security logs | Up to 12 months |
| AI Visibility Program data | See the table in section 19 |
9. Your rights
You have the following rights under GDPR Articles 15 to 22 and the corresponding provisions of the revised FADP:
- Right of access. Confirmation of whether we process personal data about you, a copy of that data, and supplementary information.
- Right to rectification. Have inaccurate or incomplete data corrected.
- Right to erasure. Have data deleted where GDPR Art. 17 applies.
- Right to restriction of processing in the cases of GDPR Art. 18.
- Right to data portability. Receive your data in a structured, machine-readable format.
- Right to object to processing based on legitimate interests, including direct marketing.
- Right not to be subject to a solely automated decision with legal or similarly significant effects (see section 10).
- Right to withdraw consent at any time.
- Right to lodge a complaint with a supervisory authority (see section 17).
Write to info@agenticsis.ch. Users of the AI Visibility Program can also download all their data and delete their account themselves on the Account page of the application (section 19). We respond within one month of receipt, extendable by two further months for complex requests, with notice. We may ask for reasonable proof of identity. There is no fee unless the request is manifestly unfounded or excessive.
10. Automated decisions and profiling
We do not currently make decisions based solely on automated processing, including profiling, that produce legal or similarly significant effects on you within the meaning of GDPR Art. 22 or FADP Art. 21.
We use AI tools to assist human decision-making (for example, to draft correspondence, to prioritize outreach, or to summarize documents). The final decision is taken by a human reviewer. If this changes, we will update this Policy, inform affected individuals, and provide the right to obtain human intervention.
11. Source of indirectly collected data
Where we have not obtained your personal data directly from you, the source is one of the following, as required by GDPR Art. 14:
- B2B prospecting tools such as Apollo and Hunter. These tools aggregate business contact details from public corporate sources, professional networks, and publicly available web pages.
- Public B2B sources such as company websites, business registers, conference attendee lists, and professional social networks.
- Referrals from existing clients or business contacts, where the referrer represents that they have a lawful basis to share your details.
The categories we obtain are limited to business contact information: name, professional title, employer, business email, business phone, and publicly stated areas of professional responsibility. To opt out, reply “unsubscribe” to any email or write to info@agenticsis.ch. We suppress your details within 14 days and keep a minimal suppression record.
12. Cookies and similar technologies
agenticsis.ch does not currently set any cookies. We do not use third-party analytics, advertising, or tracking. Your language preference is encoded in the URL path (for example, /de/ or /es/; English has no prefix) and is not stored on your device.
If we add cookies in the future, this section will be updated and, for any non-essential cookies, a consent banner will be added in line with EU ePrivacy and FDPIC guidance: EU visitors will be asked to opt in, and Swiss visitors will be given transparent information and an easy opt-out.
13. Direct marketing
Service-related messages (for example, the confirmation that we received your contact-form message) are sent without prior consent because they are necessary to perform the service you requested.
For marketing emails:
- For existing clients, we may rely on the ePrivacy soft opt-in for similar services. You can opt out in every message.
- For prospects, we rely on consent where required, or on legitimate interest for B2B outreach in line with section 11. You can opt out at any time.
14. Security
We apply technical and organizational measures appropriate to the risk, including:
- TLS encryption for all data in transit.
- Encryption at rest for data stored in our database and object storage.
- Role-based access control: each client account can read only its own data, enforced by row-level security in the database.
- Multi-factor authentication on the administrator accounts of our database, application hosting, code, payment and email providers.
- Two-step login required for every Agenticsis staff account that can open customer accounts in the AI Visibility Program; available to every customer user.
- Automated daily backups of the production database.
- Automated alerts about known vulnerabilities in the software libraries we use.
- Annual review of sub-processor list and contracts.
- Internal procedure for handling personal data breaches, including notification under GDPR Art. 33 (72 hours) and Art. 34 (data subjects) and FADP Art. 24 to the FDPIC as soon as possible.
No system is fully immune from compromise. Where a breach affects you, we will inform you in line with our legal duties.
15. Children
Our services are directed at businesses and their personnel. We do not knowingly collect personal data of children under 16. If you believe a child has provided us with personal data, write to info@agenticsis.ch and we will delete it.
16. Changes
We may update this Policy from time to time. The version published on this page is always the current version, marked with an effective date. Material changes are communicated by email to active clients and to every AI Visibility Program account that has paid us, at least 30 days before they take effect, unless a shorter period is required by law.
17. Complaints
If you believe we have not handled your personal data lawfully, please first contact us at info@agenticsis.ch so we can investigate.
You also have the right to lodge a complaint with a supervisory authority:
- In Switzerland: Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, edoeb.admin.ch.
- In the European Union: Your local data protection authority. The European Data Protection Board publishes a list at edpb.europa.eu.
18. Governing law
This Privacy Policy is governed by Swiss law. The application of the GDPR to processing of personal data of individuals in the European Economic Area is not affected.
19. AI Visibility Program (visibility.agenticsis.ch)
The AI Visibility Program is a self-service application for businesses. It measures how a company appears in search engines and AI answer engines, drafts content and outreach for it, and reports every month. This section describes the personal data it processes.
Our role
- Agenticsis is the controller for your account and login, the company profile you create, billing, support, usage and security records, the free “Can AI read your site?” check, and our own customer records about you.
- Agenticsis is a processor for you, the customer, for the people you handle with the application: leads and contacts, the outreach emails you send them, founders and team members you enter, and press contacts. You decide about these people, and our Data Processing Agreement applies. You inform them as GDPR Article 14 requires.
Data we process
| Area | Personal data |
|---|---|
| Account | Email address, name, password (stored only as a one-way hash by our database provider), sign-in times, whether two-step login is on, the version of the Terms and Privacy Policy you accepted and when. |
| Company profile | Company name, website, industry, keywords and market; public social and directory links; the contact person and sender address you enter. |
| Results and content | Rankings, AI answers about your company, audits, articles, posts, images and reports. Mostly company data; it can contain the names of founders you enter. |
| Leads and outreach (you are the controller) | Name, business email, company, role and the public page where a person was found; the outreach emails you send and whether they were opened, clicked or answered (recorded by our email provider). |
| Support | Your messages, our answers, and the page you wrote from. |
| Billing | Payment and customer identifiers from Stripe, amounts, credits and plan status. Card details stay with Stripe. |
| Usage records | For each paid call to an outside service: the service, the cost and the company. No prompt or answer text. |
| Free “Can AI read your site?” check | The website checked, and a one-way keyed hash of the visitor’s IP address used only to limit abuse. |
| AI assistant connector | Hashed sign-in codes and tokens (see below). |
Purposes and legal bases
- Providing the application, your account, support and billing: contract (GDPR Art. 6(1)(b); FADP Art. 31(2)(a)).
- Keeping payment records for 10 years: legal obligation (GDPR Art. 6(1)(c); Swiss CO Art. 958f).
- Security, abuse limits, cost control and our customer records: legitimate interest (GDPR Art. 6(1)(f)), balanced in our internal assessment, which you can request.
- Leads and outreach: your legal basis as controller; we process on your instructions.
How the application uses AI
The application uses Anthropic Claude to analyse and draft, Perplexity for market research, DataForSEO to put the questions you track to ChatGPT, Gemini, Perplexity and Claude, kie.ai to make images, and Firecrawl to read public web pages. We do not send personal data in these requests: a person’s name goes to the model only as a placeholder, which our code replaces with the real name after the answer comes back. Two exceptions: text you type yourself (for example extra instructions) is sent as you wrote it, and public web pages the services read can contain names. The lead search sends company criteria and finds people on public business pages; Apollo and Hunter then add business contact details. Our providers do not train their models on this data under their commercial terms; Anthropic deletes API inputs and outputs within 30 days. Everything the application writes is a draft that you review before you publish or send it.
Recipients
- Infrastructure: Supabase (database, Stockholm), Vercel (application functions, Frankfurt), Hostinger (background worker, Frankfurt).
- Services named in the AI paragraph above, Apollo and Hunter (lead contact details), SendGrid (email), Stripe (payments), and Google (Search Console, PageSpeed and Indexing; web addresses only).
- Our own customer relationship system (hosted in Zurich), which holds your name, email, company and payments.
- Agenticsis staff who support customers can open any account in the application. Their accounts require two-step login.
- People you share a client portal link with: anyone holding the link can read that month’s report. Share it only with people you trust; we disable a link on request.
All recipients are on our Sub-processors page, with their location and transfer safeguard.
Retention
| Data | Kept |
|---|---|
| Account, company profile, results, content, leads | While the account or company exists. Deleted when you delete it in the application. |
| Support conversations | 24 months after the conversation is closed; deleted with your account |
| Payment and credit records | 10 years (Swiss CO Art. 958f), without your name after you delete your account |
| Usage records | 12 months |
| Free check results and visitor hashes | 90 days |
| Our record of a privacy request and how we answered it | 5 years |
| Our customer records about you | While we have a customer relationship; anonymised when you delete your account |
| Database backups | 7 days, then overwritten |
Your controls
On the Account page of the application you can change your name, email and password, turn on two-step login, sign out on all devices, download all data we hold about you and your companies as one file, and delete your account. A company owner can delete the company in its profile. Deleting removes the data listed above, its images, your access tokens and our customer record about you, and you receive a confirmation email. If you are a lead or contact of one of our customers, please write to that customer first; we help them answer.
AI assistant connector
An optional connector lets you read your own report data inside an AI assistant such as Claude. It is read-only: it returns the already-computed results for the company linked to your account and cannot create, change, delete, publish or start paid work. Sign-in uses OAuth 2.1 with PKCE against your Agenticsis account and asks for your two-step code when you have turned it on. We store only hashed authorization codes and refresh tokens; access tokens are short-lived (one hour) and are not stored. Each token is limited to one company. The data you request is sent to the AI assistant provider you chose (for example Anthropic), which processes it under its own terms. You can disconnect at any time from your AI assistant.
Change log
| Version | Date | Change |
|---|---|---|
| 1.6 | 2026-10-29 | Swiss counsel review completed; the draft notice is removed. The text of version 1.6 is unchanged. |
| 1.6 DRAFT | 2026-10-26 | Section 19 now covers the whole AI Visibility Program (roles, data, purposes, AI use, recipients, retention, self-service rights, the connector with two-step sign-in), not only the connector. Sections 2, 3, 8 and 9 point to it. Section 1: Agenticsis is the trade name of Sofía Salazar Mora (sole proprietorship). Section 14: two-step login for staff who can open customer accounts. Section 16: paying users of the AI Visibility Program are also told of changes by email. |
| 1.5 DRAFT | 2026-10-18 | Section 5: added the AI services the AI Visibility Program uses (DataForSEO, Firecrawl, kie.ai) and replaced the 30-day prompt retention line with what we actually keep. Section 8: AI usage records kept 12 months (we keep no prompt log). Section 14: the security list now names the measures in place today, including daily backups and alerts on vulnerable libraries. Section 4: the security purpose reworded. |
| 1.4 DRAFT | 2026-10-17 | Section 3: the contact form now also stores area of interest, city, country and page language; the booking calendar was removed from the website in October 2026 (past bookings keep their retention). Section 5: the statement on zero retention settings was removed; the no-training settings remain. Section 6: contact-form messages are stored in Supabase and handled by our n8n server (Hostinger, Frankfurt), which sends notifications and confirmations through SendGrid (Twilio); email correspondence runs on Google Workspace. This replaces the Gmail OAuth2 description. Sections 3 and 11: the website analytics rows now state that no analytics run on agenticsis.ch. Section 12 URL example corrected. Section 19 renamed to the AI Visibility Program. |
| 1.3 DRAFT | 2026-06-24 | Added Section 19 describing the read-only AI Search Optimization connector: OAuth 2.1 authentication, hashed token storage, per-company scoping, and the no-training commitment. |
| 1.2 DRAFT | 2026-05-19 | Section 12 corrected: the site sets no cookies. The inaccurate two-cookie table was replaced with a truthful statement, with a note describing the consent approach if cookies are added later. |
| 1.1 DRAFT | 2026-05-19 | Section 3 updated to enumerate the exact contact form and booking fields actually stored. Section 6 now identifies Gmail OAuth2 as the transactional email sub-processor. |
| 1.0 DRAFT | 2026-05-18 | Initial draft replacing the combined Terms and Privacy Policy at /policy. Pending Swiss counsel review. |