Privacy notice

Agenticsis, Earhart-Strasse 10, 8152 Glattpark (Opfikon), Switzerland, is the controller ("we"). Legal details are in the imprint.

Privacy questions and requests: info@agenticsis.ch, subject "Privacy request". We have not appointed a data protection officer; the founder is responsible for data protection.

We follow the Swiss Federal Act on Data Protection (revFADP) and, for people in the EU and EEA, the EU General Data Protection Regulation (GDPR).

• What: your IP address, the page you open, the time, your browser and device type, in technical server logs.
• Why: to deliver the pages and keep the service secure.
• Legal basis: our legitimate interest in a working and secure website (GDPR Art. 6(1)(f)).
• No tracking: the school uses no analytics, advertising or social media trackers. Your browser stores only what the school needs to work: your theme and language and, when you sign in, your session. These are strictly necessary, so we do not ask for consent.

When you download a free resource with your email address, we store the email address, the resource, the language and the time.

• Why: to give you the file and to know which resources are useful.
• Legal basis: your request (GDPR Art. 6(1)(b)) and our legitimate interest in improving the resources (Art. 6(1)(f)).
• Newsletter, only if you tick the box: we also store that you agreed, when, and the exact text you agreed to. Before the first newsletter we send you an email to confirm your address. You can unsubscribe at any time with the link in every newsletter or by writing to us. Legal basis: your consent (Art. 6(1)(a)).
• Kept: until you ask us to delete it, and at the latest 24 months after your last download. If you confirmed the newsletter, until you unsubscribe.

• What: email address, name, profile picture and, if you add them, a short bio and your LinkedIn link; your password in encrypted (hashed) form; sign-in times and the devices you signed in with; your two-step login setting; the version of the course terms you accepted and when.
• Sign in with Google or GitHub: the provider tells us your name, email address and profile picture, and learns that you signed in to the school. Their own privacy policies apply.
• Why: to give you an account and keep it secure.
• Legal basis: our contract with you (GDPR Art. 6(1)(b)) and our legitimate interest in security (Art. 6(1)(f)).
• Who sees your profile: you and the school's administrators. Other learners do not see it.
• Emails: sign-in, password and security emails are sent through our email provider (see "Service providers").

• What: the courses you open, the lessons you complete, where you stopped a video, your watch time, the time you spend signed in to the hub, and points.
• Why: to show your progress, let you continue where you stopped, support you and improve the courses.
• Legal basis: our contract with you (GDPR Art. 6(1)(b)) and our legitimate interest in improving the courses (Art. 6(1)(f)).
• Who sees it: you and the school's administrators. If a company pays for your place, it receives only whether you enrolled and whether you completed a course, never your time online or watch time.

Messages you send to the school and our answers are stored with the date and time and whether they were read. You and the school's administrators can see them. Legal basis: our contract with you (GDPR Art. 6(1)(b)).

Payments run through Stripe. Your card details go directly to Stripe and never reach us.

• What we keep: your email address, the course, the amount, the date, the Stripe reference, the version of the course terms you accepted, your request to start the course immediately, and a refund if there is one.
• Why: to give you access, to answer questions about your purchase, and because Swiss bookkeeping law requires these records.
• Legal basis: our contract with you (GDPR Art. 6(1)(b)) and our legal obligation (Art. 6(1)(c); Swiss Code of Obligations Art. 958f).
• Kept: 10 years, also after you delete your account (then without the link to your account).
• Stripe processes payment data as an independent controller for payment processing, fraud prevention and its legal duties, under the Stripe Privacy Policy.

Some lessons play videos hosted by YouTube (Google) or Vimeo. We embed them in privacy-enhanced mode (youtube-nocookie.com, Vimeo with "do not track"). When a lesson with such a video opens, your browser loads the player from YouTube or Vimeo, which receive your IP address and browser information; after you press play they may store information in your browser. Their own privacy policies apply (Google, Vimeo). Legal basis: our legitimate interest in showing the lessons (GDPR Art. 6(1)(f)).

These providers process data on our behalf under data processing agreements, unless marked as independent.

• Supabase Inc. (USA): database, sign-in and file storage. Data region: Frankfurt, Germany (eu-central-1).
• Vercel Inc. (USA): hosting. Server functions run in Frankfurt (Germany); pages are delivered from the Vercel location closest to you.
• Twilio Inc. (SendGrid, USA): sending the school's account and security emails.
• Stripe (Stripe Payments Europe Ltd., Ireland, and its group): payments; independent controller (see "Buying a course").
• Google and GitHub: sign-in, only if you choose it; independent controllers.
• Google (YouTube) and Vimeo: lesson videos; independent controllers.

Some of these companies are in the USA or belong to US groups. For transfers outside Switzerland and the EU/EEA we rely on the Swiss-U.S. and EU-U.S. Data Privacy Framework where the provider is certified, and otherwise on the European Commission's standard contractual clauses with the additions Swiss law requires.

• Account, profile, progress and messages: until you delete your account.
• Free-resource emails: until you ask us to delete them, at the latest 24 months after your last download (newsletter subscribers: until they unsubscribe).
• Purchase records: 10 years (Swiss bookkeeping law).
• Record of your privacy requests (what you asked and when we answered): 5 years, as proof.
• Server logs at Vercel: a short time only, as set by Vercel.
• Backups: deleted data can remain in our database provider's backups until they are overwritten, at most 7 days.

You can ask for a copy of your data, its correction or deletion, the restriction of processing and a copy in a portable format, and you can object to processing based on our legitimate interest. You can withdraw a consent at any time, for the future.

• In the school: your Account page lets you download all your data as a file, correct your profile and delete your account yourself.
• By email: info@agenticsis.ch, subject "Privacy request". We answer within 30 days.
• Complaints: you can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU and EEA, to the data protection authority of your country.

Connections are encrypted. Rules inside the database limit access, so each learner reads only their own data. Administrators need two-step login. You can turn on two-step login for your own account on the Account page.

The school does not make automated decisions about you and does not send your personal data to AI models.

The school is meant for adults. Please do not create an account if you are under 16.

We update this notice when the school changes. The version date is at the top. When a change matters for you, we show it the next time you sign in.