Privacy Policy.

At Uhuu AG (company number: CHE-297.374.793), protecting your privacy is our top priority. We design our services and technologies according to the principle of "privacy by design" and make sure your data is protected, processed transparently and used responsibly. We meet the requirements of the EU General Data Protection Regulation (GDPR) and the revised Swiss Federal Act on Data Protection (revFADP).

1. Our commitment to data protection

As a provider of a cloud-based document automation platform, we know how important the protection of personal data is. Data protection is an integral part of our product development, from the very start. Our processes and tools are continuously reviewed and improved to ensure data minimisation and transparency.

We use privacy-friendly technologies, limit the use of cookies to what is necessary and collect only the data that is truly required to provide our services.

2. Purpose of this privacy policy

This privacy policy explains how we process personal data when you:

• use our website (uhuu.io),
• register and gain access to our platform,
• communicate with our support or team by email or other means,
• have a contractual or support-related relationship with us.

It describes the types of data, our purposes of processing, your rights and the measures we take to protect your data.

Important: This policy applies only where Uhuu acts as the controller. Where data is processed on behalf of our customers (e.g. content entered by users in the platform), the respective customer is the controller, and their privacy policy applies in these cases.

3. Who is responsible for your data?

Controller: Uhuu AG Klosbachstrasse 134, CH-8032 Zurich, Switzerland mail@uhuu.io

If you have questions about data processing, you can reach us at the email address above.

4. What data we collect

We process the following categories of personal data:

a) User data

• First and last name
• Email address
• Contact details (e.g. company name, phone number)
• Profile pictures (optional)
• Settings and feedback
• Communication history with our team

b) Platform and account data

• Login information (hashed passwords)
• User roles and team memberships
• Usage behaviour in the platform (e.g. document creation, history)

c) Technical data

• IP address, browser and device type, operating system
• Timestamps of access and actions
• Error logs and session data

d) Cookies and analytics data

• Session and preference cookies
• Analytics data (e.g. through privacy-friendly tools such as Plausible)

We do not use cross-site tracking, and third-party cookies only in the cases described in section 13. Cookie settings can be adjusted in your browser.

5. Why we process your data

We process personal data for the following purposes:

• Providing and maintaining our services
• Managing your account and answering enquiries
• Improving our offering through technical analysis
• Sending technical messages or product updates
• Complying with legal obligations and enforcing our terms
• Detecting, preventing and responding to security risks or misuse

6. Legal bases for processing

Processing is based on the following legal bases:

• Performance of a contract
• Legitimate interest (e.g. improving our platform)
• Consent (where required)
• Legal obligations

7. Disclosure and transfer of personal data

We do not sell your data. However, we may share data with:

• Our subprocessors (see Annex B)
• Service providers: hosting, support, analytics
• Payment providers (e.g. Stripe) for billing
• Authorities, where legally required
• Buyers or partners in the event of a company sale or merger

Data transfers outside the EEA or Switzerland only take place with appropriate safeguards (e.g. standard contractual clauses).

8. Retention period

We store personal data only as long as necessary for the stated purposes or required by law. For example:

• Account data: up to 60 days after the end of the contract
• Backups: up to 7 days after deletion
• Communication data: up to 12 months

9. Your rights

You have the following rights under the GDPR and Swiss data protection law:

• Access: What data we have stored about you
• Rectification: Correct inaccurate or incomplete data
• Erasure: Have data deleted, where applicable
• Restriction: Restrict processing in certain circumstances
• Objection: Object to processing (in case of legitimate interest)
• Data portability: Request a structured copy of your data
• Withdrawal of consent: At any time, where data is based on consent

To exercise these rights, please send a message to mail@uhuu.io. We may request additional information to verify your identity and usually reply within 30 days.

If you are dissatisfied, you can also contact the competent data protection authority.

10. Security measures

To protect your data, we use appropriate technical and organisational measures, including:

• SSL/TLS encryption
• Access controls and logging
• Secure data storage and backups
• Regular security reviews

In the event of a security incident affecting your data, we will inform you in accordance with legal requirements.

11. Use of cookies

We use cookies to:

• Manage sessions
• Store user preferences
• Carry out anonymous usage analytics (e.g. with Plausible)

We do not use advertising tracking. We use third-party cookies only in the cases described in section 13.

Types of cookies:

Cookies can be deleted or blocked in your browser.

12. Embedded content & third-party integrations

When Uhuu services are embedded in other websites (e.g. via widgets or iframes), technical data such as IP address and browser type are processed to deliver the display securely.

• Uhuu does not use third-party cookies in embeds.

13. Website: forms and embedded videos

On our website (uhuu.io) we process data in the following cases that the other sections do not describe separately:

a) Demo and contact form

When you submit the demo or contact form, we process the details you enter (name, work email address, company, industry, message, language) to answer your request. The legal basis is our legitimate interest in handling enquiries or the initiation of a contract. The details are delivered to us through an internal notification channel on the Discord service (Discord Inc., USA). The safeguards described in section 7 apply to transfers to the USA.

b) Spam protection

To protect against abuse and spam, these forms use a puzzle that your browser solves in the background (proof of work) and a hidden field. The puzzle is created and checked by our own server; no data is sent to third parties and no cookies are set. We also limit the number of requests per IP address; for this the IP address is processed only briefly in memory and is not stored. The legal basis is our legitimate interest in the security of our website.

c) Embedded videos (YouTube)

On some pages you can play a video that we embed from YouTube (Google Ireland Limited, Ireland, and Google LLC, USA) in enhanced privacy mode (youtube-nocookie.com). When you click play, we first show a notice; the player is loaded only when you click “Load video”. Before that, no data is sent to YouTube. Once loaded, YouTube processes your IP address and device information, may use cookies or similar technologies and may transfer data to the USA (section 7). The legal basis is your consent, which you give by clicking “Load video”. You can withdraw it at any time with effect for the future by closing the video and deleting your browser's cookies and site data. Google's privacy terms apply.

Apart from the services named in this section, we do not use third-party cookies on our website.

14. Changes to this policy

We may update this privacy policy in case of legal or functional changes. In the event of material changes, we will inform you by email or directly on our platform.

The current version can always be found at: uhuu.io