This policy explains how personal data is processed on pod.swisspro.site (the "Site"). It is intended to meet the information duties of the Swiss Federal Act on Data Protection (revFADP / nDSG, Art. 19 ff.) and of the EU General Data Protection Regulation (GDPR, Art. 13 and 14).
1. Controller
Dropking AI (brand: POD.AI)
Switzerland
Email: support@swisspro.site
No data protection officer has been appointed (not mandatory for this operator). Please send any privacy request to the email above.
EU representative (Art. 27 GDPR): we have not appointed a representative in the EU. Data subjects in the EU/EEA can contact us directly at support@swisspro.site, in English, German or Chinese.
2. What we process, why, and on which legal basis
| Activity | Data | Purpose | Legal basis (GDPR) |
|---|---|---|---|
| Visiting the Site (hosting, server logs) | IP address, date/time, requested URL, browser/user agent, referrer, error logs | Delivering the Site, security, abuse and rate-limit protection, troubleshooting | Art. 6(1)(f) — legitimate interest in a secure, working website |
| Shopping cart | Cart contents, chosen country and payment/shipping method, stored in your browser's localStorage ("pod-cart-v1" and checkout preferences) | Keeping your cart between pages and visits; stays on your device until you clear it | Art. 6(1)(b) (steps prior to a contract) and Art. 6(1)(f); strictly necessary, so no consent required (Art. 5(3) ePrivacy Directive) |
| Sign in with an email code | Email address, name (if given), a one-time login code (stored only as a hash, valid for 10 minutes) | Creating and accessing your customer account without a password | Art. 6(1)(b) — contract / your request to use an account |
| Sign in with Google | Name, email address, profile picture, Google account identifier | Creating and accessing your customer account without a password; pre-filling checkout | Art. 6(1)(b) — contract / your request to use an account |
| Sign in with Shop (Shopify Customer Account), where offered | Name, email address, profile picture where provided, saved addresses, Shopify customer identifier | As above, plus pre-filling your shipping address | Art. 6(1)(b) |
| Session cookies | "pod_session" (HttpOnly, Secure, SameSite=Lax, up to 30 days), "pod_guest" for guest orders (same settings, up to 30 days) and a short-lived sign-in state cookie (10 minutes) | Keeping you signed in; protecting the sign-in flow against forgery | Art. 6(1)(b) and (f); strictly necessary |
| Orders, designs and proofs | Name, email, phone (if given), shipping and billing address, ordered items, personalisation texts and uploaded images/designs, design drafts saved in the Studio, proofs and your approval of them, order history, shipment tracking, communication with us | Concluding and fulfilling the purchase contract, showing you a proof before production, production and shipping, customer service | Art. 6(1)(b) |
| Wedding website and RSVP | For couples: the content of the invitation website you publish (names, date, venue, texts, images) and an optional notification email. For guests: the RSVP you submit (name, attendance, party size, optional dietary notes and optional contact details). Please share dietary notes only to the extent the couple needs them, as they may reveal health or religious information | Publishing the invitation website and passing guests' replies to the couple | Art. 6(1)(b) towards the couple; towards guests, Art. 6(1)(f) — the couple's and guests' interest in organising the event |
| POD.AI chat assistant ("Ask POD.AI") | Your chat messages (contact and payment details are automatically redacted before storage), language, country and page, the assistant's answers, your 👍/👎 feedback; order number and email if you ask about an order; your email if you ask to be handed over to a person | Answering questions about products, prices, shipping and orders; handing over to our team; improving answers | Art. 6(1)(b) where the question concerns an order or a planned order, otherwise Art. 6(1)(f) — answering enquiries |
| Google Analytics 4 | Pages viewed, events, approximate location (country/city), device and browser data, a pseudonymous cookie ID; Google does not log or store full IP addresses in GA4 | Understanding how the Site is used and improving it (see section 3) | Art. 6(1)(f) — legitimate interest in measuring and improving the Site; you can object at any time (section 3) |
| Payment (PayPal, TWINT) | Order reference, amount, currency, payment status and transaction ID; payment credentials are entered directly at the payment provider and never reach us | Processing payment, preventing fraud, refunds | Art. 6(1)(b); fraud prevention Art. 6(1)(f) |
| Accounting and tax records | Invoices, order and payment records | Complying with statutory bookkeeping and tax obligations | Art. 6(1)(c) (and Swiss law, e.g. Art. 958f Code of Obligations) |
| Contact by email | Email address, name, content of your message | Answering your request | Art. 6(1)(b) if about a contract, otherwise Art. 6(1)(f) |
Legitimate interests relied on (Art. 6(1)(f)): operating a secure and reliable online shop, preventing fraud and abuse, answering enquiries, and measuring and improving the Site. You may object to this processing at any time (see section 7).
Consent (Art. 6(1)(a)): where a processing activity requires your consent (for example a newsletter), we ask for it first, and you can withdraw your consent at any time with effect for the future.
3. Cookies, localStorage and analytics
Strictly necessary storage: the session, guest and sign-in state cookies and the localStorage cart described above, and the transcript of the chat assistant, which is kept in your browser's sessionStorage only for the current tab and disappears when you close it.
Google Analytics 4: we use Google Analytics, a web analytics service of Google Ireland Limited (Ireland) and Google LLC (USA), with the measurement ID G-GED5TST3DP. Google Analytics sets the cookies "_ga" and "_ga_<ID>" (up to 2 years) to recognise your browser across visits. Google processes this usage data on our behalf; in GA4, IP addresses are not logged or stored. Event data is deleted automatically after the retention period set in our Google Analytics property. You can object at any time by blocking or deleting cookies in your browser or by installing Google's browser add-on (tools.google.com/dlpage/gaoptout). More information: policies.google.com/privacy.
We do not use advertising or retargeting cookies.
4. Recipients and processors
We share data only as far as necessary, with:
- Our hosting provider — website hosting, database and server logs on a server in Frankfurt, Germany (processor).
- Google Ireland Ltd. / Google LLC — Google Analytics (processor), and, only if you choose "Continue with Google", authentication (Google is an independent controller for your Google account).
- Shopify Inc. / Shopify International Ltd. — only if you choose "Continue with Shop", where offered (independent controller for your Shop account).
- PayPal (Europe) S.à r.l. et Cie, S.C.A. (Luxembourg) — payment processing (independent controller).
- TWINT AG (Switzerland) — payment processing (independent controller).
- Our print and fulfilment partners in China, and the carriers YunExpress and 4PX — name, delivery address, phone (if given), email and order contents needed to produce, ship and track your order.
- Twilio SendGrid, Inc. (USA) — sending order, proof, shipping and login-code emails (processor).
- The couple who published a wedding website — the RSVP replies submitted through that website.
- Authorities, where we are legally obliged.
We do not sell your personal data. The chat assistant's answers are generated on our own server; chat messages are not passed to third-party AI providers.
5. International transfers
We are based in Switzerland. The European Commission recognises Switzerland as providing an adequate level of data protection (adequacy decision), so data may flow from the EU/EEA to us. Our website and database are hosted in Germany (EU), which Switzerland recognises as providing adequate protection. Some recipients (e.g. Google, Twilio SendGrid, Shopify) process data in the USA. Such transfers are based on the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework where the recipient is certified, and otherwise on the European Commission's Standard Contractual Clauses (as recognised and adapted for Switzerland by the FDPIC). Your items are made and shipped from China: our production partners and our carriers YunExpress and 4PX are based in China, a country without an adequacy decision; we transmit to them only the data needed to produce and deliver your order, because this is necessary to perform the contract with you (Art. 49(1)(b) GDPR, Art. 17(1)(b) revFADP). You can request a copy of the relevant safeguards from us.
6. Retention
| Category | Retention |
|---|---|
| Server logs | Up to 30 days, unless needed to investigate an incident |
| localStorage cart / checkout preferences | On your device until you clear it or complete/empty the cart |
| Session and guest cookies | Up to 30 days or until you sign out; sign-in state cookie and login codes 10 minutes |
| Customer account (sign-in profile, saved addresses) | Until you ask us to delete your account |
| Unordered designs / quotes | Studio drafts are deleted automatically after 30 days, unaccepted quotes after 90 days |
| Chat assistant conversations | Transcript in your browser: until you close the tab. On our server: only the most recent 1,000 conversations are kept; older ones are deleted automatically |
| Wedding website and RSVP replies | As long as the couple keeps the website; deleted with the website or on request |
| Google Analytics | Cookies up to 2 years; event data according to the retention period set in our Google Analytics property |
| Orders, invoices, payment records | 10 years (Swiss bookkeeping obligations, Art. 958f CO) |
| Emails with us | As long as needed for the request, max. 2 years, unless part of order records |
7. Your rights
Under the GDPR (and correspondingly the revFADP) you have the right to:
- access your data (Art. 15);
- rectification of inaccurate data (Art. 16);
- erasure (Art. 17);
- restriction of processing (Art. 18);
- data portability in a structured, machine-readable format (Art. 20);
- object at any time, on grounds relating to your particular situation, to processing based on Art. 6(1)(f) (Art. 21);
- withdraw consent at any time with effect for the future (Art. 7(3)), where processing is based on consent.
To exercise your rights, write to support@swisspro.site. We may need to verify your identity. We respond within one month (GDPR) / 30 days (revFADP).
Right to lodge a complaint: you may complain to a supervisory authority, in particular in the EU/EEA member state of your habitual residence, place of work or the place of the alleged infringement (Art. 77 GDPR), and in Switzerland to the Federal Data Protection and Information Commissioner (FDPIC / EDÖB), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch.
8. Is providing data required?
Using the Site and placing an order requires the data needed to fulfil the contract (name, email, shipping address, payment). Without it we cannot accept or deliver your order. Signing in with Google or Shop is optional; you can check out as a guest. There is no statutory obligation to provide data to us beyond what is needed for the contract.
9. Automated decision-making
We do not use automated decision-making, including profiling, that produces legal or similarly significant effects (Art. 22 GDPR / Art. 21 revFADP). Payment providers may carry out their own fraud checks under their own privacy policies.
10. Security
Connections are encrypted via HTTPS, session cookies are HttpOnly and Secure, and stored credentials for connected services are encrypted. No system is completely secure; we will notify you and the authorities of breaches as required by law.
11. Changes
We may update this policy when our processing changes. The current version and its effective date are always published at pod.swisspro.site/privacy.