Imprint & Privacy Policy

Last updated: 15 July 2026

Squib recognises the importance of protecting the privacy of its users. Transparent and responsible handling of personal data is therefore a key concern for us. This Privacy Policy explains which personal data we collect, for what purposes, and to whom such data may be disclosed.

We also inform you about our data processing principles and practices, which comply with the General Data Protection Regulation (GDPR). This Privacy Policy supplements our Terms of Use.

In the event of discrepancies between the English and German versions of this Privacy Policy, the German version shall prevail.

Contents

1. Who we are and what we do

Squib Ltd. (c/o Lucerne University of Applied Sciences and Arts – Business, Zentralstrasse 9, 6002 Lucerne) operates the website www.squib.app (hereinafter referred to as "we" or "us").

Protecting your personal data is important to us. This Privacy Policy provides clear and transparent information on how we collect and process personal data via our website.

2. Roles and Responsibilities

To the extent that customers create, manage, and conduct surveys using Squib, the respective customer is generally responsible, under data protection law, for the content of the surveys and for any personal data collected within the scope of those surveys.

Squib processes such data as a data processor on behalf of the customer and solely for the purpose of providing the agreed services and in accordance with the applicable contractual agreements.

This does not apply to processing activities where Squib independently determines the purposes and means of processing. This particularly includes personal data processed by Squib for:

• the provision and security of the platform
• the administration of user accounts
• contract management and invoicing
• customer support
• fraud and abuse prevention
• compliance with legal obligations

For these processing activities, Squib acts as an independent controller under applicable data protection laws.

3. Scope of this Privacy Policy

This Privacy Policy informs you about:

• who is responsible for processing your personal data;
• which personal data we collect;
• the purposes for which the data are processed;
• the legal bases for processing;
• recipients or categories of recipients of the data;
• how you can object to data processing; and
• your rights and how you can exercise them.

4. Definitions

Personal data

Personal data refers to any information relating to an identified or identifiable natural person. This includes, for example, name, address, date of birth, email address, telephone number and IP address, as well as information about personal preferences or memberships.

Special categories of personal data

Special categories of personal data (also referred to as sensitive personal data) include:

• data revealing religious, philosophical, political or trade union views or activities;
• data concerning health, private life, racial or ethnic origin, sexual life or sexual orientation;
• data relating to administrative or criminal proceedings and sanctions, as well as social assistance measures;
• genetic and biometric data used to uniquely identify a person.

Where necessary and where you voluntarily provide such information, we may process special categories of personal data. In such cases, enhanced confidentiality requirements apply.

Processing of personal data

Processing means any operation performed on personal data, whether or not by automated means, such as collection, storage, use, modification, disclosure, archiving or deletion.

Disclosure of personal data

Disclosure refers to the transmission or making available of personal data, for example by publication or disclosure to third parties.

5. Contact

If you have any questions or concerns regarding data protection, you may contact our Data Protection Officer: Marco Eichenberger (marco.eichenberger@squib.app)

6. Data security

We take appropriate technical and organisational measures to protect your personal data against loss, unauthorised access, misuse or alteration. Our employees and contractual partners are bound by confidentiality and data protection obligations.

Where data processing is carried out by third parties acting on our behalf, confidentiality and compliance with applicable data protection laws are contractually ensured.

Our website uses SSL (Secure Socket Layer) encryption with the highest level of encryption supported by your browser.

We implement appropriate technical and organizational measures to protect personal data against unauthorized access, loss, misuse, alteration, or unlawful disclosure.

7. Rights of data subjects

Right of access

You may request information at any time about the personal data we process about you. Requests must be submitted together with appropriate proof of identity to marco.eichenberger@squib.app.

Information is generally provided free of charge. Reasonable fees may be charged for additional copies. Requests that are manifestly unfounded or excessive may be refused or subject to a fee, within the limits of the law.

We respond to requests within one month. This period may be extended by up to two additional months where necessary, taking into account the complexity and number of requests. You will be informed accordingly.

To the extent that we process personal data on behalf of a customer, the respective customer is generally responsible for assessing and responding to such requests under applicable data protection laws.

Squib supports the customer in fulfilling these obligations in accordance with applicable legal requirements and contractual agreements.

Rectification and erasure

You have the right to request correction, completion or deletion of your personal data, provided that no statutory retention obligations or overriding legal grounds apply.

Please note that exercising these rights may affect contractual relationships, potentially leading to early termination or other consequences.

Restriction of processing

You may request restriction of processing where you contest the accuracy of the data, the processing is unlawful, the data are no longer required, or you have objected to the processing.

Restricted data may only be stored and otherwise processed with your consent or for the establishment, exercise or defence of legal claims, or for reasons of overriding public interest.

Data portability

You have the right to receive personal data that you have provided to us in a structured, commonly used and machine-readable format and to transmit such data to another controller, where processing is based on consent or a contract and carried out by automated means.

Right to object and withdrawal of consent

You may withdraw your consent at any time. Withdrawal does not affect the lawfulness of processing carried out prior to withdrawal.

Where processing is based on legitimate interests, you may object for reasons arising from your particular situation. We will assess your objection and either stop or adjust processing, or demonstrate compelling legitimate grounds.

You may object at any time to processing for direct marketing or analytics purposes.

Right to lodge a complaint

You have the right to lodge a complaint with a competent data protection supervisory authority.

8. General principles of data processing

Categories of data and sources

We primarily process personal data that you provide to us or that is collected when you use our website. In some cases, we may also receive personal data from third parties.

Processed data may include:

• identification data (e.g. name, address, date of birth);
• contact details (e.g. email address, telephone number);
• financial data;
• online identifiers (e.g. cookies, IP addresses);
• location and traffic data.

Data sources may include publicly available sources, public registers, authorities, professional networks, correspondence with third parties, credit agencies, and website usage.

Legal bases for processing

We process personal data in accordance with applicable data protection laws, in particular the Swiss Federal Act on Data Protection (FADP), the Ordinance on Data Protection (DPO) and, where applicable, the General Data Protection Regulation (GDPR). In doing so, we observe the principles of lawfulness, transparency, proportionality, purpose limitation and data security. Processing is lawful where one of the following legal bases applies:

• your consent;
• performance of a contract or pre-contractual measures;
• compliance with legal obligations;
• protection of vital interests;
• performance of a task in the public interest;
• legitimate interests, unless overridden by your interests or rights.

Certain personal data are required to conclude or perform contracts or to ensure secure website operation (e.g. IP address).

Retention and Deletion of Data

We process and store personal data only for as long as necessary for the respective processing purposes, for the performance of contractual obligations, for the provision and security of the platform, for compliance with legal retention obligations, or for the establishment, exercise, or defense of legal claims.

Data from customer accounts and survey projects is generally stored for the duration of the contractual relationship or the active use of the respective account.

After termination of the contractual relationship, deletion of an account, or once the purpose of processing no longer applies, the affected data will be deleted or anonymized, unless legal, regulatory, security-related, or contractual reasons require further retention.

Deletion is generally carried out from the productive systems. Data that is still contained in backup copies at the time of deletion will no longer be used productively and will be permanently removed as part of the regular backup and recovery cycles.

Disclosure to third parties

We may engage third parties (processors) to provide services such as accounting, legal advice, IT services, hosting, payment processing, and analytics. These parties are contractually bound to comply with data protection requirements.

We may also disclose personal data where required by law or to authorities.

International data transfers

Personal data may be transferred worldwide. Where data are transferred outside the EEA to countries without adequate data protection, we ensure appropriate safeguards, such as EU Standard Contractual Clauses and additional technical measures.

9. Specific data processing activities

Website access and log files

When you visit www.squib.app without registering, technical data automatically transmitted by your browser are processed.

Processed data include:

• internet service provider;
• IP address;
• browser and operating system information;
• date and time of access;
• referrer URL.

These data are processed to ensure website functionality and IT security, based on our legitimate interests. Log files are deleted after each session.

Contact enquiries

When you contact us, we process the data you provide, such as name, contact details, content and timing of your enquiry. Processing is based on our legitimate interest in handling enquiries and providing customer support.

Cookies

Our website uses cookies. Some cookies are technically necessary, others require your consent. Cookies are used to store preferences, optimise website presentation, analyse usage and improve our services.

Consent-based cookies are activated only after your consent via the cookie banner. Necessary cookies may be disabled via browser settings, which may limit website functionality.

Netlify

We use Netlify, a service provided by Netlify, Inc., USA, for hosting and the technical provision of our website.

In particular, the following data may be processed: IP address, time and type of access, content accessed, referrer URL, and information about the browser, operating system and device used. The data is processed to provide the website, ensure its security and stability, and detect technical errors and unauthorised or abusive access.

Where the GDPR applies, the processing is carried out for the performance of a contract or on the basis of our legitimate interests pursuant to Art. 6(1)(b) and (f) GDPR. Netlify and its appointed sub-processors may process data in particular in Switzerland, the EEA and the USA. Cross-border disclosures are safeguarded by recognised legal safeguards, in particular standard contractual clauses adapted as required under Swiss data protection law.

Supabase

We use Supabase, a service provided by Supabase Pte. Ltd., Singapore, for databases, user management, authentication, data storage and other technical functions of our platform.

Depending on how the platform is used, the data processed may include account and contact details, login data, project and survey data, submitted content, and technical log and security data. The data is processed to provide, manage and secure the platform and to perform our contractual obligations.

Our primary project region is located in Zurich. In connection with support, security and administrative services, data may also be processed in Singapore, the USA and other countries. Where the GDPR applies, the processing is based on Art. 6(1)(b) and (f) GDPR. Cross-border disclosures are safeguarded in particular by standard contractual clauses adapted as required under Swiss data protection law.

HubSpot

We use HubSpot, a service provided by HubSpot Germany GmbH and affiliated companies of the HubSpot group, to manage contacts, process enquiries and send newsletters or other information.

The data processed may include, in particular, names, email addresses, company details, information submitted through forms, communications, and the time and evidence of consent. Where the relevant functions are enabled, the opening of emails and the clicking of links may also be recorded.

The data is processed for communication with customers and prospective customers and for the management and analysis of our communications. Where the GDPR applies, the processing is based, depending on the purpose, on consent, the performance of a contract or our legitimate interests pursuant to Art. 6(1)(a), (b) or (f) GDPR. Consent may be withdrawn at any time. Data may be processed in particular in Germany, Ireland and the USA. Cross-border disclosures are safeguarded by recognised legal safeguards, in particular standard contractual clauses adapted as required under Swiss data protection law.

Tracking pixels

We may use tracking pixels (web beacons) on our website or in emails to analyse usage and improve services. Processing is based on your consent. You may prevent such tracking by using browser extensions or blocking external images in email clients.

Stripe

We use the payment service provider Stripe for processing payments. Stripe is operated by Stripe, Stripe Payments Europe Ltd., 1 Grand Canal Street Lower, Grand Canal Dock, Dublin, Ireland.

What data do we process?

As part of the payment processing, the following data may be processed in particular:

• Name
• Email address
• Billing and payment information
• Transaction data (e.g. amount, date, payment method)
• Any other data required for payment processing

Payment data is collected and processed directly by Stripe. We generally only receive the information necessary to confirm and process the payment.

For what purpose do we process the data?

The processing is carried out for the purpose of processing payments, fulfilling contractual obligations, and preventing misuse and fraud.

To whom do we disclose the data?

Payment processing is carried out through Stripe. The data required for the payment process is transmitted to Stripe. Stripe may share the data with additional service providers or affiliated companies as part of providing its services.

International data transfers

Stripe may also transfer personal data to countries outside Switzerland or the European Economic Area, particularly to the United States. Such transfers are carried out in compliance with applicable data protection laws and using appropriate safeguards (e.g. standard contractual clauses).

Pirsch Analytics

We use the web analytics service Pirsch Analytics provided by Emvi Software GmbH, Germany, to analyze the use of our website.

What data do we process?

As part of the web analytics process, technical usage data is processed, in particular (e.g. accessed pages, time of access, and similar information).

For what purpose?

To statistically analyze the use of our website and to improve our services and offerings.

Disclosure and international transfers

The data is processed by the provider Pirsch Analytics. Further information on data processing can be found in the provider’s privacy policy.

Google Maps

We integrate Google Maps to display location-based information. Data such as IP address, technical information and interaction data may be processed. Data may be transferred internationally.

Amendments to this Privacy Policy

We may amend this Privacy Policy at any time. The current version is published on www.squib.app. No separate notification will be provided.