Privacy Policy

1) Controller

Jakob Secklehner
Maroltingergasse 57, 1160 Vienna, Austria
Email: switcheu@posteo.eu

2) Principles

SwitchEU follows privacy by design and by default (Art. 25 GDPR), data minimisation and storage limitation. Website, backend, database and statistics are run by the controller on a server in Germany. Fonts and program code are served from that server. External services are used only where necessary and are listed in full in section 11.

3) Search: how personal data is kept out

When you submit a search, several stages make sure that only company or product names are processed further:

1. Check in the browser: obvious personal data (email addresses, phone numbers, links, personal names) is detected and blocked before the query leaves your device. The server then checks again for personal names.
2. Own database and classification (Mistral AI, France): if the query can be answered directly from our curated database, it does not leave the server. Otherwise it is sent to Mistral AI for classification. Zero Data Retention applies: Mistral stores neither input nor output and processes the query only as long as needed to produce the response. If Mistral detects personal data, the query is rejected immediately. If Mistral is unavailable or gives no clear answer, no web search takes place either.
3. Web search (Brave Search API, USA): only queries that Mistral has confirmed as company or product names, or that you have explicitly confirmed as such, reach Brave Search. Mistral AI then summarises the search results into an answer.

Your confirmation (“Search anyway” button): many companies are named after people (e.g. “Hugo Boss”, “Bosch”), so the filters sometimes reject legitimate searches. You can then confirm that it is a company or brand name. Only on this explicit confirmation is the search repeated without the personal-data checks and reaches Brave Search. The confirmation applies to that single query only and is not stored.

Search suggestions: while you type, your browser sends what you have typed so far to our own server to suggest matching entries from our database. These inputs are not passed to any external service.

Recent news: for European alternatives found, the server fetches recent news and sustainability information via Brave Search and summarises it with Mistral AI. Only the name of the company concerned is sent, not your input.

It cannot be ruled out entirely that someone enters personal data into the search box. If it gets past the checks in the browser and on the server, it may briefly reach Mistral AI during classification before the query is rejected. Zero Data Retention applies here too.

Legal basis: Art. 6(1)(f) GDPR: legitimate interest in providing the search service and in protecting users by filtering out personal data.

4) “Find alternatives” assistant

The assistant at /find asks what you want to replace, plus preferences on country, hosting, price, sustainability and required features. Both free-text fields are checked for personal data in the browser, just like the search. If a personal name is suspected, you can confirm that it is a company or brand name. The server then checks for personal names. As in the search, Mistral AI must then confirm that what you want to replace is a company, product or service. Only then is it looked up via Brave Search. If Mistral is unavailable, no web search takes place. Mistral AI builds a list of alternatives from the search results and your preferences.

Legal basis: Art. 6(1)(f) GDPR: legitimate interest in providing the assistant.

5) Server and application logs

Two kinds of logs are created:

• Web server access logs: IP address, time, requested URL and browser identifier (user agent). They are used for security, abuse prevention and troubleshooting, and are deleted after 14 days. The server is an IONOS VPS in Germany managed solely by the controller. No third-party CDN is involved in delivering the website.
• Backend application logs (self-hosted Supabase): search queries appear only as a truncated, salted SHA-256 hash (16 characters), together with event type and processing time. The salt lets the controller recognise individual queries when troubleshooting. For per-user rate limiting, IP addresses are held only as a hash in memory. The backend services themselves, such as the database interface, log the IP address, time and requested address of each request for technical reasons. All backend logs are deleted daily, so none is older than one day.

Legal basis: Art. 6(1)(f) GDPR: legitimate interest in secure operation and troubleshooting.

6) Caching of results

To avoid repeated requests to external services and to answer faster, results are cached in our database on the same server. Entries contain company and product data only, no user identifiers, IP addresses or other personal data.

• High-confidence results (e.g. well-known companies with stable data): 14 days (products 7 days). Translated results: 14 days
• Standard results: 7 days; product-specific results: 4 days
• Low-confidence results: 1 day
• Web search results: 7 days for results from a user search. Up to 30 days for results fetched to verify a company's headquarters and profile data
• Results drawn entirely from our curated and climate databases, without any external web search: up to 30 days
• Static company data (headquarters, country, founding year): up to 30 days
• News and sustainability data: 1 day
• Assistant results: 7 days

Keys are normalised company or product names, or the assistant input together with the selected filters. They are not linked to any user. Expired entries are deleted automatically every day.

Legal basis: Art. 6(1)(f) GDPR: legitimate interest in fewer requests to external services and shorter response times.

7) No cookies, only necessary browser storage

SwitchEU sets no cookies, neither its own nor third-party ones. Only the following entries are kept in your browser's storage. They contain no identifier and are never sent to us:

• cookie-notice-dismissed-v1 (localStorage, 12 months): remembers that you acknowledged the privacy notice.
• umami.disabled (localStorage): only if you have opted out of the visitor statistics (section 8).
• switcheu-saved-v1 (localStorage, until you delete it): your saved list, only if you have saved alternatives. It holds the name, country, website and short description of the companies. The list never leaves your browser.
• switcheu-lang (localStorage, until you delete it): remembers your chosen language.
• tsr-scroll-restoration-v1_3 (sessionStorage, until you close the tab): remembers the scroll position so that “Back” returns you to the right place.

Legal basis: § 165(3) Austrian Telecommunications Act 2021: this storage is strictly necessary for the service you request and needs no consent. You can delete the entries in your browser at any time.

8) Visitor statistics (Umami)

For visitor figures we use Umami on our own server in Germany. Umami sets no cookies and shares nothing with third parties.

We store the page viewed (without search terms), the time, device type, browser and country, plus a pseudonymous identifier that changes every month. Your IP address is not stored. Region and city, which Umami derives from it, are deleted every hour.

The data is deleted after 12 months.

You are not counted if your browser sends Do Not Track or Global Privacy Control. You can also switch counting off here:

Legal basis: Art. 6(1)(f) GDPR (legitimate interest in visitor figures). Nothing is stored on your device.

9) Company logos (Brandfetch)

Company logos are provided by the Brandfetch service. To show them reliably and up to date, your browser loads them directly from Brandfetch (cdn.brandfetch.io). Brandfetch does not allow caching on our server and technically blocks such requests, so serving the logos from our own server is not possible.

With every logo request, Brandfetch technically receives your IP address, your browser identifier (user agent), the domain of the company whose logo is shown, and as origin only “switcheu.eu”, not the specific page. Brandfetch delivers logos through Amazon CloudFront by Amazon Web Services, usually from a server near you. We receive no data about you from Brandfetch.

If you do not want this, you can block requests to cdn.brandfetch.io with a content blocker. SwitchEU keeps working, just without logos.

Legal basis: Art. 6(1)(f) GDPR: legitimate interest in a reliable, easily recognisable presentation of companies. The European Commission has issued an adequacy decision for Switzerland. Amazon Web Services is certified under the EU-US Data Privacy Framework.

10) Suggest a company

The “Suggest a company” form lets you tell us about a company. Only the company name, website and note as you enter them are stored, plus the time and processing status. The note is checked for personal data in the browser. Neither IP address nor browser data is stored with the suggestion (for general server logs see section 5). Suggestions are deleted once handled, and automatically after 3 months at the latest.

Legal basis: Art. 6(1)(f) GDPR: legitimate interest in expanding the directory.

11) Recipients and service providers

The website is operated by the controller on a server in Germany. Apart from the following providers, nobody receives data. In normal operation Mistral AI and Brave receive only company and product names. Brandfetch receives your IP address when logos load (section 9).

• IONOS SE (Germany): provides the server (IONOS VPS, data centre in Germany) running the website, backend, database and statistics. IONOS is a processor under Art. 28 GDPR for the infrastructure and has no access to application data beyond what is technically required for operation.
• Mistral AI SAS (France): classifies search queries and summarises search results, as a processor under Art. 28 GDPR with a data processing agreement. Zero Data Retention applies. Mistral does not use the data to train its models.
• Brave Software, Inc. (USA): web search. Receives only queries classified as company or product names or confirmed as such by you, plus company names for recent news. The requests are made by our server, so Brave never sees your IP address, only our server's. Brave keeps the queries for up to 90 days for billing and troubleshooting. For transfers to the US, Brave states that it relies on the EU-US Data Privacy Framework or Standard Contractual Clauses. The Brave Search API terms apply.
• Brandfetch SA (Savigny, Switzerland), with Amazon Web Services (Amazon CloudFront) for delivery: company logos. Receives your IP address, browser identifier and the company's domain when logos load (section 9).

12) External links

We open links to other websites so that the target site does not learn which of our pages you came from. The respective operator is responsible for processing there. Please see their privacy policy.

13) Your rights

You have the right to access, rectification, erasure, restriction of processing, data portability, and to object to processing based on Art. 6(1)(f) GDPR. Since we keep no accounts and do not attribute data to individuals, we can usually only answer requests about log and statistics data if you help us find the data. You may also lodge a complaint with a supervisory authority, for example the Austrian Data Protection Authority:

Austrian Data Protection Authority (Österreichische Datenschutzbehörde): dsb.gv.at

14) Contact

For privacy questions: switcheu@posteo.eu

Last updated: September 2026