Privacy policy
What is collected, why, for how long, and who else has access. Without the runaround.
Last updated: 3 September 2026.
This is a courtesy translation. In the event of any discrepancy, the French version prevails.
Data controller
Createur Digital - Fred Contat, Chemin de la Riettaz 4, 1442 Montagny-près-Yverdon, Suisse. For any question or request concerning your data: contact@createurdigital.ch.
The service is aimed at customers established in Switzerland and in the European Union. The processing therefore complies with both the Swiss Federal Act on Data Protection (revFADP) and the General Data Protection Regulation (GDPR).
What is collected, and why
| Data | Why | Legal basis |
|---|---|---|
| Name and email address | Create the account, confirm the address, send the alerts you asked for | Performance of the contract |
| Password | Authenticate access. Stored as a hash, never in clear text — it is readable neither by us nor by anyone else | Performance of the contract |
| Session IP address and browser | Secure the connection, spot abnormal use, limit abuse | Legitimate interest |
| Workspace, role, invitations | Keep data separated and manage the team’s access | Performance of the contract |
| Log of sensitive actions (invitation, role change, deletion, creation of a sharing link) | Be able to establish who did what in a workspace shared by several people | Legitimate interest |
| Alert recipients: email addresses, Slack webhook URL | Deliver alerts where you ask for them | Performance of the contract |
| Tracked sites, keywords, markets, recorded positions | Provide the service itself | Performance of the contract |
No data is collected for advertising purposes, resold, or used to train a model.
Cookies
The site sets two cookies, and no others. Your session cookie keeps you signed in: it is inaccessible to the page’s JavaScript, restricted to the site itself, encrypted in production, and expires after thirty days. Your language cookie remembers which of the four versions of the site to serve you when you come back to the bare address; it holds nothing but a two-letter code and lives for a year.
There is no analytics, no advertising tracker and no third-party cookie. That is why you will not see a consent banner: cookies strictly necessary to the operation of the service — keeping you signed in, answering you in your language — do not require one.
Your theme choice — light, dark or automatic — is remembered in your browser’s local storage. That is not a cookie: it is never sent to the server and never leaves your device.
Who else has access
The providers below act on our behalf, only to the extent necessary for their role, and are bound by a confidentiality undertaking.
| Recipient | Role | What is passed to them |
|---|---|---|
| Hetzner Online GmbH | Hosts the application and its database, on servers located in Finland, European Union | All the data, at rest on its disks |
| DataForSEO | Queries search results in order to establish positions | The keywords and the market parameters. No account data, no name, no email address |
| MailerSend, or the configured SMTP relay | Delivers confirmation and alert emails | The recipient’s name and address, and the content of the message |
| Slack | Only if you configure a webhook — the message goes to your own workspace | The content of the alert you asked for |
The scheduled-task engine, which triggers the nightly checks, is self-hosted on the same server: no third party is involved.
Your data is hosted in Finland, therefore inside the European Union. This hosting involves no transfer to a third country, either under European law or under Swiss law.
Where one of the other providers processes data outside the European Union or Switzerland, the transfer is governed by the European Commission’s standard contractual clauses or by a recognised equivalent mechanism.
For how long
| Data | Retention |
|---|---|
| Position history | Kept as long as the account is active. This is a deliberate choice: nobody can query a search engine about the past, so deleted history cannot be rebuilt |
| Detailed search results, which feed the competitive analysis | 365 days |
| Log of alerts sent | 180 days |
| Raw responses from the data provider | 14 days — and this retention is disabled by default |
| Sessions | 30 days, extended with use |
| Account, workspace and action log | Until the account is deleted |
Your rights
You have a right of access, rectification, erasure, restriction, objection and portability over the data concerning you. Write to contact@createurdigital.ch: a reply follows within a maximum of thirty days.
Account deletion. It is requested in writing — the interface does not offer a button for it yet. It results in the erasure of the account, its workspaces, their projects and all the associated position history, within thirty days, except for data an accounting obligation requires us to keep.
If you consider that your rights are not being respected, you may refer the matter to the competent authority: the FDPIC in Switzerland, or the data protection authority of your country of residence in the European Union.
If you track your own clients’ sites
The keywords and domains you enter remain your responsibility: towards your own clients you are the data controller, and we act only as a processor. Avoid recording, in a project label or a keyword, personal data that has no business being there.
Security
Passwords are stored hashed. Each workspace is kept separate, and membership is re-checked server-side on every request rather than inferred from a value sent by the browser. The tokens of shared report links are also stored hashed: a copy of the database would give access to no report.
Traffic goes over HTTPS, the database exposes no port on the network, sign-in attempts are rate-limited, and the execution of unexpected scripts is blocked by a content security policy with a single-use token.
In the event of a data breach likely to create a risk to your rights, you will be informed and the competent authority notified within the legal deadlines.
Changes
This policy may change along with the service. Any substantial change is announced by email to account holders before it takes effect. The terms and conditions and the legal notice complete this document.