Privacy Policy
Last updated: July 18, 2026
This Privacy Policy explains how Predivo GmbH collects, processes, and protects personal data in connection with the SignalScore web application. It is drafted in compliance with the Swiss Federal Act on Data Protection (nDSG) and, to the extent applicable, the EU General Data Protection Regulation (GDPR).
1. Controller Identity
| Company | Predivo GmbH |
| Address | Bahnhofstrasse 55, 6403 Küssnacht am Rigi, Switzerland |
| support@signalscore.ch | |
| Website | signalscore.ch |
2. Scope
This policy applies to all personal data processed through the SignalScore web application at signalscore.ch, including account registration, authentication, credit check requests, and report generation. It covers data about our users and data incidentally relating to natural persons associated with assessed companies.
3. Categories of Personal Data
3.1 Account Data
- Email address (login identifier)
- Password (stored exclusively as a cryptographic hash)
- Organisation name (optional, for multi-user accounts)
3.2 Usage Data
- Credit checks performed (company name, date, result summary)
- Watched companies (monitoring watchlist) and alerts generated from new SHAB publications
- Timestamps of login events and report generation
- IP addresses in server-side access logs
- API usage metrics (request count, function, response status)
3.3 Payment & Billing Data
- Billing email address
- Subscription tier and invoice history
- Stripe customer and subscription identifiers
We do not store credit card numbers or bank account details. Payments are processed by our payment provider Stripe; card data is entered on and held by Stripe, never on our servers.
3.4 Technical Data
Standard HTTP headers (browser type, OS, screen resolution, referring URL, language).
3.5 Analytics Data
We use PostHog (EU-hosted) to understand product usage: page views on route change, and the events signup and checkout_started. When you are logged in, your user ID is passed to PostHog via identify() so events can be linked to your account; this link is cleared on logout. PostHog is configured in cookieless mode — no cookies or browser storage are used to identify you between sessions. Autocapture and session recording are disabled. Analytics runs only on the production domain (signalscore.ch).
3.6 Support Requests
When you contact support (via the form on /support or by email to support@signalscore.ch), we process the data you provide: name, email address, subject, category, and message content. Requests are stored in our internal support system, operated by Predivo GmbH on EU-hosted infrastructure. We use AI (Claude by Anthropic) to help classify requests and draft acknowledgment replies; a human remains responsible for support decisions. Support correspondence is retained as long as needed to handle your request and for a reasonable follow-up period.
4. Data About Assessed Companies
Data collected about assessed entities (company name, legal form, address, register entries, public website content, Google Maps data, news articles, LinkedIn profiles, DNS records) constitutes publicly available business information and does not typically qualify as personal data of natural persons.
Sole Proprietorships (Einzelunternehmen)
Where the assessed company is a sole proprietorship, business data is inherently linked to the natural person who is the sole proprietor. We rely on our legitimate interest (Art. 31 para. 1 nDSG) for this processing. Rights of affected persons are described in Section 11.
5. Purposes and Legal Bases
| Purpose | nDSG Basis | GDPR Basis |
|---|---|---|
| Contract performance — credit checks, reports, account management | Art. 31(2)(a) | Art. 6(1)(b) |
| Legitimate interest — security, fraud prevention, service improvement | Art. 31(1) | Art. 6(1)(f) |
| Legal obligation — audit trails, tax records (Art. 962 CO) | Art. 31(2)(b) | Art. 6(1)(c) |
| Consent — marketing communications (currently not applicable) | Art. 31(1) | Art. 6(1)(a) |
6. AI-Powered Analysis
Automated Decision-Making Disclosure
SignalScore uses Claude by Anthropic to analyse company data. Reports are indicative only and not legally binding. No fully automated decisions with legal effect on assessed companies are made. Users may request human review at support@signalscore.ch.
- Only aggregated, publicly available company data is sent to Anthropic
- No user account data (email, password, billing) is shared with the AI provider
- Users interpret and act on reports at their own discretion and risk
7. Data Recipients & Processors
| Processor | Purpose | Location |
|---|---|---|
| Supabase Inc. | Database, auth, edge functions | EU (Frankfurt) |
| Stripe Payments Europe Ltd. | Payment processing, subscription billing | EU (Ireland); card processing may involve Stripe Inc., USA |
| PostHog (PostHog Inc.) | Cookieless product analytics (page views, signup/checkout events) | EU |
| Anthropic PBC | AI-powered company analysis (Claude) | United States |
| Google LLC | Maps API, News (via SerpAPI) | United States |
| SerpAPI LLC | News search aggregation | United States |
| Firecrawl | Web content extraction | United States |
| Zyte | Web content extraction (fallback) | European Union |
| Browserless Inc. | Headless browser rendering | United States |
We do not sell, rent, or commercially share personal data with third parties.
8. Cross-Border Transfers
Primary data storage is in the EU (Frankfurt) via Supabase. Some processors are US-based (Art. 16–17 nDSG). We ensure adequate protection through:
- EU Standard Contractual Clauses (SCCs) — Decision 2021/914, recognised under Art. 16(2)(d) nDSG
- Swiss-US Data Privacy Framework — where processors have certified
- Supplementary measures — sensitive user data (passwords, billing) is not transferred outside the EU
9. Data Retention
| Data | Retention | Rationale |
|---|---|---|
| Account data | Account duration + 90 days | Recovery grace period |
| Credit reports | 12 months, then anonymised | User reference |
| API usage logs | 6 months | Security & quota enforcement |
| Server logs | 30 days | Troubleshooting |
| Billing records | 10 years | Swiss tax law (Art. 962 CO) |
10. Your Rights
Under the nDSG (Art. 25–27) and, where applicable, the GDPR:
Right of access
Art. 25 nDSG
Obtain a copy of your personal data and processing information
Right to rectification
Art. 6(5) nDSG
Request correction of inaccurate personal data
Right to erasure
"Right to be forgotten"
Request deletion, subject to legal retention obligations
Right to data portability
Art. 28 nDSG
Receive your data in a machine-readable format
Right to object
Legitimate interest basis
Object to processing based on legitimate interest
Right to withdraw consent
Where applicable
Withdrawal does not affect prior lawful processing
Right to lodge complaint
See Section 17
File a complaint with the FDPIC supervisory authority
To exercise your rights, contact support@signalscore.ch. We respond within 30 days.
11. Rights of Assessed Companies
- Request information about data held (sourced from public registers)
- Report inaccuracies — corrections should go to the originating register
- Request human review of AI-generated analysis
- Sole proprietorships: exercise nDSG rights per Section 10 above
12. Data Security
13. Cookies
We use only essential, technically necessary cookies for authentication. No tracking, advertising, or marketing cookies are used. We do run cookieless product analytics (see Analytics Data) that sets no cookies. See our Cookie Policy for details.
14. Children
SignalScore is a B2B service not directed at persons under 18. We do not knowingly collect data from minors.
15. Changes to This Policy
Material changes will be communicated via email at least 14 days before taking effect. Continued use after the effective date constitutes acknowledgement.
16. Contact
Predivo GmbH
Bahnhofstrasse 55, 6403 Küssnacht am Rigi, Switzerland
17. Supervisory Authority
| Authority | Federal Data Protection and Information Commissioner (FDPIC) Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB) |
| Address | Feldeggweg 1, 3003 Bern, Switzerland |
| Phone | +41 58 462 43 95 |
| Website | www.edoeb.admin.ch |
For GDPR subjects, you may also lodge a complaint with your EU/EEA member state supervisory authority.
This English version is provided for convenience only. The German version is legally binding.