Privacy Policy

This Privacy Policy explains how Square8 (“Square8”, “we”, “us”) collects, uses, and protects personal data when you visit square8.ai (the “Website”) or join our waitlist. Square8 currently accepts customers based in Switzerland, the European Union, and the United Kingdom, and this Policy is drafted to meet the requirements of the EU General Data Protection Regulation (GDPR), the UK GDPR (as supplemented by the UK Data Protection Act 2018), and the Swiss Federal Act on Data Protection (FADP). Where our Services are made available to residents of the United States, the section on US state privacy rights below also applies.

1. Data controller

Our Data Protection Officer / privacy contact can be reached at dpo@square8.ai. If we appoint a separate EU representative (GDPR Art. 27) or UK representative (UK GDPR Art. 27), their contact details will be added here.

2. What personal data we collect

We do not knowingly collect special categories of data (e.g., health, religion, biometric data) through the Website.

3. Purposes and legal basis for processing

4. Cookies and similar technologies

The Website currently sets only strictly necessary cookies required for basic functionality and security. We do not use analytics, advertising, or other non-essential cookies, and we do not run third-party tracking on the Website today. Because no non-essential cookies are in use, no cookie consent banner is shown.

If we introduce analytics or other non-essential cookies in the future, we will show a consent banner first and set such cookies only where you have given consent (or where another legal basis applies), and you will be able to withdraw that consent at any time. Our current cookie usage is set out in our Cookie Notice.

5. Recipients of personal data

We share personal data only with:

1. Service providers / processors acting on our behalf (e.g., hosting, email delivery, CRM, analytics providers), bound by data processing agreements.
2. Professional advisers (legal, accounting) where necessary.
3. Authorities, where required by law.

We do not sell personal data.

6. International data transfers

Square8’s infrastructure is hosted within Switzerland and the EU. We also process personal data of customers based in the United Kingdom. Transfers of personal data between the UK, the EEA, and Switzerland benefit from applicable adequacy decisions. Where personal data is transferred to any other country without an adequacy decision, we rely on appropriate safeguards such as the EU Standard Contractual Clauses and the UK International Data Transfer Addendum, as applicable.

7. Data retention

We retain personal data only as long as necessary for the purposes described above, or as required by applicable law (e.g., accounting retention periods). Waitlist data is retained until you withdraw consent or until 3 years after the last interaction, whichever comes first.

8. Your rights (Switzerland, EEA, and UK)

Subject to applicable law (GDPR / Swiss FADP), you have the right to:

1. Request access to your personal data
2. Request correction of inaccurate data
3. Request erasure of your data
4. Request restriction of processing
5. Object to processing based on legitimate interest
6. Request data portability
7. Withdraw consent at any time, without affecting prior processing
8. Lodge a complaint with a supervisory authority (e.g., the Swiss Federal Data Protection and Information Commissioner (FDPIC), the UK Information Commissioner’s Office (ICO), or your local EU data protection authority)

To exercise these rights, contact us at hello@square8.ai.

9. US state privacy rights (CCPA/CPRA and other state laws)

This section applies to residents of California and other US states with comprehensive privacy laws, to the extent those laws apply to us. Square8 is established in Switzerland and has no office or other establishment in the United States; where our Services are made available to US residents, we honor the rights described below.

Categories of personal information. Using the categories set out in the California Consumer Privacy Act, as amended by the CPRA (the “CCPA”), we collect: identifiers (such as name and email address); commercial and professional or employment-related information (such as company name and role); internet or other electronic network activity (such as IP address, device and browser type, and pages visited); and the content of communications you send us. These correspond to the details in section 2 above. We do not collect “sensitive personal information” to infer characteristics about you.

Purposes and retention. We use these categories for the purposes set out in section 3, retain them as described in section 7, and disclose personal information only to the categories of recipients listed in section 5 (for example, our service providers), for the business purposes described in this Policy.

No sale or sharing. We do not sell your personal information, and we do not share it for cross-context behavioral advertising, as those terms are defined under the CCPA. We have not done so in the preceding 12 months.

Subject to applicable law, US residents have the right to:

1. Know and access the personal information we have collected about them;
2. Delete their personal information;
3. Correct inaccurate personal information;
4. Opt out of the sale or sharing of personal information (we do not sell or share, so there is nothing to opt out of, but such requests are honored);
5. Limit the use of sensitive personal information (we do not use it for purposes that would trigger this right);
6. Not receive discriminatory or retaliatory treatment for exercising these rights.

To exercise these rights, email us at hello@square8.ai describing your request. We will verify your identity against the information we hold before responding, and you may use an authorized agent where the law permits. If we decline a request, you may appeal by replying to our response; we will inform you of the outcome and, where applicable, of your right to contact your state attorney general.

Other US state laws. Residents of Virginia, Colorado, Connecticut, Utah, Texas, Oregon, and other states with comprehensive privacy laws have comparable rights — including to access, correct, delete, and obtain a copy of their personal data, and to opt out of targeted advertising, sale, or certain profiling. We extend the same rights and the same request method described above to all such residents, to the extent the relevant law applies to us.

10. Data security

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, or misuse, including access controls, encryption in transit, and audit logging.

11. Data breach notification

If a personal data breach occurs, we assess it without undue delay. Where a breach is likely to result in a high risk to the personality or fundamental rights of the affected individuals, we notify the Swiss Federal Data Protection and Information Commissioner (FDPIC) as soon as possible, in accordance with Art. 24 of the revised Swiss Federal Act on Data Protection (revFADP). Where the GDPR or UK GDPR applies, we notify the competent supervisory authority within 72 hours of becoming aware of a notifiable breach (Art. 33 GDPR), and affected individuals without undue delay where the breach is likely to result in a high risk to their rights and freedoms (Art. 34 GDPR). Where Square8 processes personal data on behalf of a customer, we notify that customer without undue delay so they can meet their own notification obligations.

12. Children’s privacy

The Website is intended for business use and is not directed at individuals under the age of 16. We do not knowingly collect personal data from children.

13. Changes to this policy

We may update this Privacy Policy from time to time. The “Last updated” date at the top reflects the most recent revision. Material changes will be communicated where required by law.

14. Contact

Questions about this Privacy Policy or our data practices can be directed to:

Square8 Technologies AG · hello@square8.ai · Beethovenstrasse 48, 8002 Zürich, Switzerland