Your data, in plain words.

Who is responsible

The data controller is Cédric Rosat, founder of Finavim, in Switzerland. For any question or request about your data: info@finavim.ch.

What we collect

• the email address entered in the waitlist form;
• the date and time of sign-up;
• the source of the sign-up, to know which form on the site was used;
• the language of the page at the time of sign-up (French or English);
• two random technical identifiers, unrelated to your identity: one is used for the confirmation link, the other for the unsubscribe link present in every email;
• the date the confirmation email was sent and, where applicable, the date you confirmed — which constitutes proof of your consent;
• the technical data needed to serve and secure the site, in particular the IP address, the URL requested, the date and time, and the browser type.

Your IP address is not recorded with your sign-up: the time-stamped confirmation is enough to establish your consent, and we prefer not to collect more.

The site uses no advertising cookies and no third-party audience measurement. Infomaniak (Switzerland) nevertheless processes the technical data needed to provide and secure the hosting.

The site exists in French and in English. The language displayed is chosen from your browser's language, within your browser itself: nothing is transmitted for this. If you pick a language with the site's selector, that choice is remembered locally in your browser (local storage, not a cookie) and is never sent to our servers. Your choice of light or dark mode is also stored locally and is not sent to our servers.

Why we use it

Your email address is used to let you know about the launch of the closed beta and the important steps of the launch. The source of the sign-up lets us understand which of the site's forms was used and improve the page. The recorded language is used to write to you in the language of the page where you signed up, for the confirmation email as well as for launch communications. These operations rest on your consent, given when you sign up voluntarily.

Sign-up happens in two steps. As soon as you leave your address, a confirmation email is sent to you: it checks that this inbox is really yours. It also already contains the link to remove yourself. Your address is kept temporarily for 14 days. If you don't confirm your sign-up within that time, it is deleted automatically.

If you enter an address that is already on the list, the site shows the same message as for a new sign-up: it never reveals whether an address is on the list. The email is what informs you: the confirmation request is sent again if it is still pending, or a short reminder that you are already signed up, with the removal link, if it has already been confirmed — at most once a day.

Addresses on domains known to provide temporary mailboxes (“disposable” addresses) are refused at sign-up: the invitation has to be able to reach you. This check only compares the address's domain with a list kept in our own database; no data is sent to a third-party service for it.

Technical data is used to deliver, secure and maintain the site. This processing rests on our legitimate interest in running a reliable and secure site. Finavim doesn't use it to profile visitors. Your email address is neither sold nor used for third-party advertising.

Providers and transfers

Sign-ups are stored in a PostgreSQL database managed by Supabase. The region chosen for this project is Zurich (eu-central-2): the main waitlist data is therefore stored in Switzerland, with restricted access. Supabase remains an international provider and may use the sub-processors listed in its data processing terms.

The site is hosted by Infomaniak Network SA, a Swiss company. Infomaniak states that it operates its data centres in Switzerland and keeps the data entrusted to it there as part of its hosting services.

Our emails go out directly from our mailboxes hosted at Infomaniak, without passing through a third-party emailing service. No additional provider therefore stands between your address and us.

We do not measure email opens or clicks. Our emails contain no tracking pixel or redirect link. The logo is an image hosted on finavim.ch, identical for every recipient and without a personal identifier. Displaying it may make a request to our hosting provider, depending on your email settings. Links point directly to finavim.ch.

Fonts are hosted together with the site: no request is sent to Google Fonts during your visit.

For how long

An unconfirmed sign-up is deleted automatically after 14 days. After that, nothing remains: no address, no date, no technical identifier.

Once confirmed, your email address, the sign-up date, the form source and the language are kept until Finavim's public launch, long enough to send the launch-related communications, then deleted from the waitlist. They may be kept in another context only if you then create an account or give new consent.

Finavim keeps no separate audience statistics. Any technical logs are kept by Infomaniak for as long as needed to provide and secure the service, in accordance with the terms applicable to the hosting used.

Your rights

Under the Swiss Federal Act on Data Protection (FADP) and, where the GDPR applies, under the GDPR, you may request access to your data, its rectification, its deletion or its portability where that right applies. You may also withdraw your consent or object to certain processing. Finavim carries out no profiling and no automated decision-making based on the data described here.

Every waitlist email carries an individual unsubscribe link, including the one asking you to confirm your sign-up. That link deletes your address from the list: the row is erased, not merely marked as unsubscribed — we keep no suppression list. You may also ask for your address to be removed at any time by writing to info@finavim.ch, without having to justify yourself. The request will be handled within the legal time limits.

If you believe your rights are not being respected, you may contact the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, where the GDPR applies, the competent supervisory authority.