Privacy Policy

Saleway GmbH, Schulhausgässli 4, 3098 Köniz, Switzerland. Phone +41 31 5520702, email info@sge-score.com. Commercial register: Commercial Register Office of the Canton of Bern, CH-036.4.066.369-4, VAT CHE-437.932.259 MWST.

For any privacy question or to exercise your rights, contact info@sge-score.com. A data protection officer is not legally required and has not been appointed. No EU representative under Art. 27 GDPR is currently designated.

We process personal data only where necessary to operate the platform, perform the contract, comply with legal obligations, or where you have consented. We never sell personal data and do not use it for purposes incompatible with the original purpose.

On registration we process your email address, password (stored only as a hash), optionally name and profile details, plus registration and sign-in timestamps.

Purpose: providing the account, linking analyses and subscriptions, security. Legal basis: performance of contract (Art. 6(1)(b) GDPR) and legitimate interest in secure operation (lit. f). Retention: until the account is deleted; removal within 30 days thereafter, except for data subject to statutory retention.

When you submit a URL, our server fetches the page, stores excerpts of the publicly accessible content (HTML, metadata, structured data) and evaluates it against our audit criteria. Result, score and recommendations are stored with your account so you can retrieve and export them later.

If the analysed page contains personal data (e.g. third-party imprint details), it is processed purely technically and is neither enriched nor reused. You warrant that you only analyse websites you are authorised to audit (see Acceptable Use Policy).

For evaluation and the Master-Fix we use a large language model (Google Gemini via our platform operator's AI gateway). Transmitted content is not used to train the models.

Legal basis: performance of contract. Retention: until deleted by you or with your account; technical intermediate data is removed automatically after 14 days at the latest.

Payments are processed by Stripe Payments Europe Ltd. Card details are entered exclusively with Stripe and never transmitted to us. We receive the customer ID, payment status, plan, amount, currency and invoice data.

Purpose: contract handling, activation of plans and Master-Fix credits, accounting. Legal basis: performance of contract and legal obligation (Art. 6(1)(b) and (c) GDPR). Retention: invoicing and accounting records for 10 years (Art. 958f Swiss CO).

When you contact us we process your details (name, email, message) to handle the request. System, account and support emails are delivered via Resend. Legal basis: performance of contract or legitimate interest in responding. Retention: 24 months after the request is closed.

The newsletter is only sent after explicit double opt-in and is managed via ActiveCampaign. We store the email address, sign-up time and proof of consent. Legal basis: consent (Art. 6(1)(a) GDPR). You may withdraw at any time via the unsubscribe link or by email; we then delete the data from the distribution list.

When the website is accessed, technically necessary data is logged: truncated IP address, date and time, requested resource, status code, browser type. Purpose: operational security, error analysis, abuse prevention. Legal basis: legitimate interest. Retention: usually 30 days.

Details on cookies and locally stored data are set out in our Cookie Policy (/cookies). Necessary storage (login, theme, consent) is based on our legitimate interest in operating the service; statistics and marketing cookies only with your consent, which you can withdraw at any time via the cookie settings.

We use Google Analytics 4 (measurement ID G-TF6X9WCG8L) with IP anonymisation and Google Consent Mode v2 (default «denied»). Before consent, no analytics cookies are set and no data is transferred to Google.

If you use our Agent API or MCP server, we log the API key identifier, timestamp, requested resource and result status for billing, abuse prevention and diagnostics. Legal basis: performance of contract and legitimate interest. Retention: 12 months.

We share data only with carefully selected providers acting as processors, and with authorities where legally required. The full list is available at /subprocessors:

• Supabase / Lovable Cloud (hosting, database, authentication) — operated in the EU (Frankfurt); standard contractual clauses for support access from the US.
• Lovable (Vercel/CDN, delivery of the website and server functions) — EU/US, EU standard contractual clauses.
• Stripe Payments Europe Ltd., Ireland (payment processing, subscriptions, invoices) — controller for payment data; card details are never transmitted to us.
• Google Ireland Ltd. (Google Analytics 4, Consent Mode v2) — only after your consent; possible transfer to Google LLC (US) under the EU-US Data Privacy Framework.
• Google / Gemini via the platform operator's AI gateway (evaluation of analysed website content, Master-Fix generation) — EU/US, standard contractual clauses; content is not used for training.
• Resend (delivery of system and account emails) — EU/US, standard contractual clauses.
• ActiveCampaign (newsletter and customer communication, only upon sign-up) — US, standard contractual clauses.

Processing takes place primarily in Switzerland and the EU. Where data is transferred to countries without an adequate level of protection, we rely on the EU standard contractual clauses and Art. 16 f. revFADP, plus supplementary safeguards.

Website scoring is automated. It concerns websites, not individuals, and produces no legal effect concerning you within the meaning of Art. 22 GDPR or Art. 21 revFADP. No automated individual decision-making about you takes place.

You have the right to information, rectification, erasure, restriction of processing, data portability, and to object to processing based on legitimate interest. Consent can be withdrawn at any time with future effect.

Send requests to info@sge-score.com. We generally respond within 30 days and may request additional details to verify your identity.

You can delete your account, including analyses, yourself in your profile at any time.

Right to complain: in Switzerland to the Federal Data Protection and Information Commissioner (FDPIC, Bern); in the EU to the supervisory authority of your place of residence.

We apply technical and organisational measures: TLS encryption, encryption at rest, role-based access control at database level, password hashing, logging of administrative access, regular backups and automated availability monitoring.

• Account and profile data: up to 30 days after account deletion
• Analyses and reports: until deleted by you; technical intermediate data max. 14 days
• Invoices and payment records: 10 years (Art. 958f Swiss CO)
• Support correspondence: 24 months
• Server log files: 30 days
• Statistics data: 90 days

We update this policy when our processing or the legal framework changes. The version published on this page applies.