1. Introduction
SchweizerIMG (“we”, “us”) operates the website and the web application at schweizerimg.ch. This policy applies to both and is based on the Swiss Federal Act on Data Protection (FADP). The controller and our contact details are set out in section 13.
2. How SchweizerIMG works with your images
The image tools are built to run in your browser. Your images — their content, file names, sizes and metadata such as location or camera data — and your results are processed on your device and are not transmitted to us. We do not store them and have no access to them.
When you run a tool, your browser tells our server only which tool it is and, at the end, whether the run completed, failed or was cancelled. We store this with the time, to count the operations included in your plan. Results remain in your browser until you download them; we keep no copies.
Our own visit statistics (section 3) record which pages are opened, but nothing from your images: file names, contents, sizes, dimensions, colours, metadata and hashes are not recorded, and running a tool sends no statistics.
3. Data we process
- Account data: e-mail address, optional name, optional password (stored only as a hash), language and settings, plan and subscription status, the date the account was created, and the method and time of your last sign-in. Whether you receive our product news by e-mail, with an unsubscribe code (a random value) and the date of an opt-out.
- Sessions: a session token, a description of your browser and device (user agent) and the time of your last activity, so that you can see and end your sessions.
- Sign-in codes and links that we send you by e-mail.
- Usage records: for each tool run, the tool, its status and the start and end time.
- Visit statistics: for our own statistics of the website and the app, our server records per visit a pseudonymous visit identifier; the country (derived from your IP address with a database on our own server, otherwise from your browser's time zone — the IP address itself is not stored), time zone, browser language, device type, browser and major version, operating system, your browser's user agent, and screen and window size; whether you were signed in and, if so, your account; the landing and exit page, the referring page and its domain, and campaign (UTM) parameters. For each page: its address, language and title, the query string with sensitive parameters such as sign-in tokens removed, the referring page, the time spent on it, how far you scrolled and the time. And interactions: which button or link you clicked, which FAQ question you opened, a change of language, the steps of sign-in and sign-up (method and outcome — never e-mail addresses, codes or passwords), the choice of a plan, the start of checkout, opening the billing portal, links to other websites (address and link text) and returning after a break. Nothing derived from your image or video files is recorded.
- Billing data: plan, billing interval, subscription status and period, and the references of our payment provider Stripe. If you pay by Swiss QR-bill, also your billing name and address, billing e-mail and the invoices issued. Card details are entered directly at Stripe; we do not receive them.
- E-mail log: recipient, subject, content and delivery status of the e-mails we send you (transactional e-mails and product news).
- Security data: records of security-relevant actions (such as sign-ins or plan changes), partly with IP address and user agent; temporary counters against misuse that may contain your IP address; and, where misuse requires it, blocked IP addresses.
- Error reports and server logs: technical information when something goes wrong (error message, page address, browser and window size) and the server's technical logs, which may contain account identifiers.
- Support requests: the content of e-mails you send us.
4. Purposes and legal basis
- Providing the service and your plan (account, sign-in, counting operations, billing): to perform our contract with you.
- Security and preventing misuse (sessions, counters, security records, error reports, logs): our legitimate interest in a secure and reliable service.
- Visit statistics (understanding how the website and the app are used — which pages are visited, where visitors come from, where sign-up or checkout stops —, improving content and the service, measuring our own campaigns): our legitimate interest. You can object at any time (section 9).
- Product news by e-mail (occasional e-mails about new features and improvements to account holders): our legitimate interest in informing our customers about the service they use. You can switch them off at any time (below).
- Accounting and legal obligations (invoices and payment records): statutory retention duties.
- Answering your requests: to perform the contract, or our legitimate interest in responding to you.
We do not use the visit statistics to assess you personally, do not use your data for advertising other than our own product news by e-mail (below), do not sell it and make no automated decisions. Only we see the visit statistics.
Product news by e-mail: as an account holder you may occasionally receive e-mails from us about new features, improvements and announcements of SchweizerIMG, on the basis of our customer relationship (our legitimate interest in informing our customers about the service they use; for users in the EU: Art. 6(1)(f) GDPR). A new account receives them from the start — the sign-up form says so; an account that existed before we introduced product news (October 2026) receives them only once you switch them on in Settings → Account. Every such e-mail contains an unsubscribe link, and you can switch them off at any time in Settings → Account; the change takes effect immediately and we record when it was made. E-mails about your account and its security — sign-in codes, account and billing notices — are necessary to provide the service and are sent as long as your account exists, whatever this setting. The same applies to notices we are legally required to give you, such as a change to our terms of use or to this privacy policy: they also reach accounts that have switched product news off.
5. Cookies and browser storage
We use only cookies that are strictly necessary. There are no advertising or tracking cookies and no third-party scripts. Our own visit statistics use no cookies; they rely only on your browser's session storage (the last three rows), which is cleared when you close the tab or window. The data is sent only to our own server.
| Name | Type | Purpose | Lifetime |
|---|---|---|---|
schweizerimg_session | Cookie | Keeps you signed in | 30 days, deleted when you sign out |
schweizerimg_csrf | Cookie | Protects forms against cross-site request forgery | 1 hour |
schweizerimg_geo | Cookie | Country code for limiting sign-up to Switzerland, determined on our server from your IP address with a local database (only while the limitation is active) | 24 hours |
simg-theme | Local storage | Your choice of light or dark appearance | Until you change it |
schweizerimg_plan | Local storage | A plan you chose on the pricing page before signing up | Until sign-up is completed or dismissed |
simg_analytics_fp | Session storage | A pseudonymous identifier for the current visit, formed from general browser characteristics and the time, so that pages and reloads of the same visit belong together; we do not recognise you across separate visits | Until you close the tab or window |
simg_analytics_meta | Session storage | How the visit started: landing page, referring site, campaign parameters, screen size and browser language | Until you close the tab or window |
simg_analytics_last | Session storage | Only the time of your last activity in this tab (no identifier), to count a return after more than 30 minutes | Until you close the tab or window |
Your images are held only in the memory of the open browser tab and are not written to browser storage; when you reload or close the tab, they are gone.
The statistics entries are deleted when you close the tab or window; you can delete them earlier by clearing your browser storage.
6. Recipients and service providers
We use the following service providers:
| Provider | Purpose | Country |
|---|---|---|
| Infomaniak Network SA | Hosting of the application, the database (including the visit statistics) and backups | Switzerland |
| Bjørnerås Labs (EuSend) | Delivery of transactional e-mails | Norway; processing in Germany and Finland |
| Stripe Payments Europe, Ltd. | Card and TWINT payments | Ireland; within the Stripe group also the USA |
The country lookup for limiting sign-up and for the visit statistics uses a database on our own server; no request goes to a third party. We use no third-party analytics providers, content delivery networks or font services, and the visit statistics go to no other recipient. We disclose data to authorities where the law requires it.
7. Transfers abroad
Your account data and the visit statistics are hosted in Switzerland. E-mails are delivered from Norway, Germany and Finland, countries that the Federal Council recognises as providing adequate data protection. Stripe Payments Europe, Ltd. (Ireland) may pass payment data within its group to Stripe, LLC (USA), which is certified under the Swiss–U.S. Data Privacy Framework; certified companies in the USA are recognised as providing adequate protection. Where that framework does not apply, Stripe relies on the standard contractual clauses of the European Commission.
8. Retention
| Data | Deleted |
|---|---|
| Account data | When you delete your account |
| Sessions | After 30 days without activity, when you sign out or when you end them |
| Sign-in codes | After 10 minutes |
| Usage records | After 13 months |
| Visit statistics (visits with their page views and interactions) | 13 months after the visit's last activity |
| E-mail log | After 90 days |
| IP address and user agent in security records | After 90 days |
| Security records without IP address | Kept as a record of security-relevant actions |
| Counters against misuse | After their time window (minutes to one day) |
| Error reports | 90 days after the error last occurred |
| Server logs | After 30 days |
| Database backups | After 14 days |
| Invoices and payment records | As long as the law requires (invoices: ten years) |
| Support e-mails | As long as needed to handle the request, unless the law requires longer |
When you delete your account, your account data, sessions, usage records and subscription records are deleted, and your visits in the visit statistics are no longer linked to your account; deleted data remains in the backups until they expire.
9. Your rights
You may request information about the personal data we process about you, have incorrect data corrected, have data deleted, receive data you provided in a common electronic format and object to processing, for example to the visit statistics. You can do much of this yourself in the settings; otherwise write to support@schweizerimg.ch. We may ask you to confirm your identity, and we answer within the legal period of 30 days. We may keep data where the law requires or allows it, for example invoices.
You may lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC).
10. Security
We protect the data we hold with appropriate technical and organisational measures, such as encrypted connections, hashed passwords, short-lived sign-in codes and restricted administrative access. No system is completely secure, so we cannot guarantee absolute security. Where the law requires it, we report data security breaches to the FDPIC and inform the people affected.
11. Users in the EU (GDPR)
Where the EU General Data Protection Regulation (GDPR) applies to the processing of your data, the legal bases are those named in section 4 (Art. 6(1)(b), (c) and (f) GDPR). You then have the rights described in section 9 and may also complain to the supervisory authority of your country.
12. Changes
We update this policy when our processing changes. The current version is published on this page; the date at the top shows when it was last changed. We inform registered users of material changes by e-mail or in the app.
13. Controller and contact
The controller is the operator of SchweizerIMG named below. For all data protection questions, write to the e-mail address below. We have not appointed a data protection officer; none is required.
E-mail: support@schweizerimg.ch