Privacy Policy

The controller for the processing described in this policy (except where section 3 says otherwise) is:

We are a small business and are not required to appoint a data protection officer under Art. 37 GDPR or a data protection advisor under the Swiss FADP. Privacy requests are handled by the owner personally.

We are established in Switzerland, so the revised Swiss Federal Act on Data Protection (FADP, in force since 1 September 2023) applies to our processing. Where we offer our service to customers and their end-customers in the European Economic Area, the EU General Data Protection Regulation (GDPR) also applies. Where the two differ, we apply the stricter standard.

References in this policy to a "legal basis" follow GDPR terminology. Under Swiss law, processing does not always require a specific legal basis in the same way; we still describe our reasons so you can see why each processing takes place.

This is the most important distinction in this policy, and it decides who you should contact about your data.

If you received a review invitation from a business and want your data deleted, the business that sent it is your first point of contact. If you write to us instead, we will forward your request to that business without undue delay and support them in answering it.

Website visitors. When you open repfarm.com, our hosting infrastructure processes the technical data your browser transmits: IP address, date and time of the request, the page requested, referrer, browser type and version, operating system and language. This data is needed to deliver the page and to keep the service secure and stable. Legal basis: Art. 6(1)(f) GDPR (our legitimate interest in a functioning, secure website). We do not use this data to build profiles and we do not merge it with other sources.

Your language choice is stored in your browser's local storage so the site opens in the same language next time. This is a functional setting under your control, not a tracking cookie, and is deleted when you clear your browser storage. See our Cookie Policy.

This website does not currently use analytics, advertising or social media tracking. If that changes, we will update this policy and ask for your consent before any non-essential cookie or tracker is set.

Contacting us. If you write to us by email, we process your email address, your name if you give it, and the content of your message, in order to answer you. Legal basis: Art. 6(1)(b) GDPR where your enquiry concerns a contract or pre-contractual steps, otherwise Art. 6(1)(f) GDPR.

Account and customer data. To open and operate a repfarm account we process: name, business name and address, email address, phone number if given, login credentials in hashed form, language and account settings, the business locations you manage, and your subscription status. Legal basis: Art. 6(1)(b) GDPR (performance of the contract with you).

Billing data. Payments are handled by an external payment service provider. We do not receive or store full card numbers. We do process the data needed to issue and keep invoices: billing name and address, VAT identification number if applicable, subscription and payment history. Legal bases: Art. 6(1)(b) GDPR (contract) and Art. 6(1)(c) GDPR together with Art. 958f of the Swiss Code of Obligations (statutory retention of accounting records).

Use of the platform. We process log and usage data generated when you use the platform (logins, actions taken, error and diagnostic records) to operate the service, investigate faults, prevent abuse and improve the product. Legal basis: Art. 6(1)(b) and Art. 6(1)(f) GDPR.

Direct communication about the service. We send you service messages that are part of the contract: trial expiry, billing notices, security and availability information, material changes to these terms. You cannot unsubscribe from these while you hold an account, because they concern the contract itself.

We send marketing emails about repfarm only where you have consented or where the law otherwise allows it for existing customers. You can withdraw consent or object at any time, at no cost beyond your own transmission costs, using the unsubscribe link or by writing to info@repfarm.com. Legal basis: Art. 6(1)(a) GDPR (consent) or Art. 6(1)(f) GDPR.

When a business uses repfarm, it uploads or generates personal data relating to its own customers. Depending on how the business configures the service, this can include:

For this data the business customer is the controller: it decides who is contacted, on what basis, and how long the data is kept. We process it only to provide the service and only on the customer's documented instructions. Our obligations are set out in the Data Processing Agreement, which forms part of our Terms of Service.

Our business customers are responsible for having a valid legal basis for contacting their customers, for providing them with the required privacy information, and for complying with the rules on electronic direct marketing in their country.

repfarm uses AI models to draft replies to reviews, to generate social media content from review text, and to support visibility features. The data given to the model is the review or feedback content, the business profile and tone settings configured by the customer, and the instructions the customer has set.

What this means in practice:

Where the EU Artificial Intelligence Act imposes transparency duties on the person who publishes AI-generated content, those duties fall on the business publishing the reply. The approval workflow in repfarm exists so that human review and editorial control are possible before publication.

We do not sell personal data and we do not trade it.

Personal data is disclosed only in the following situations:

We engage service providers who process personal data on our behalf under contract, in the following categories: hosting and content delivery; payment processing; integrations with the review and social platforms the customer connects; message delivery by email, WhatsApp and SMS; and AI text generation.

A current list of the sub-processors we use is available on request at info@repfarm.com.

Processing takes place in Switzerland and the European Economic Area. Where a service provider processes data outside those regions, the transfer is based on an adequacy decision or on the EU Standard Contractual Clauses together with the Swiss addendum, with additional safeguards where required.

Some providers process data in other countries, including the United States. Where that happens we rely on one of the following safeguards:

Switzerland benefits from an adequacy decision of the European Commission, so transfers from the EEA to us do not require additional safeguards.

Account and platform data is deleted or anonymised within 90 days of the end of the contract, unless longer retention is required by law. Accounting records are kept for ten years under Swiss law. Technical log data is deleted within 90 days.

We use technical and organisational measures appropriate to the risk, including encryption of data in transit, access control on a need-to-know basis, hashed credentials, logging of administrative access, regular backups and separation of production from test environments.

No system is completely secure. We cannot guarantee that data will never be accessed, altered or lost, and we ask you to protect your own login credentials and to enable any additional authentication we offer.

If a personal data breach occurs that is likely to result in a high risk to the persons concerned, we notify the Swiss Federal Data Protection and Information Commissioner as soon as possible in accordance with Art. 24 FADP and, where the GDPR applies, the competent supervisory authority within 72 hours under Art. 33 GDPR. Where we act as processor, we notify the affected business customer without undue delay so that it can meet its own obligations.

Under the GDPR and the Swiss FADP you have the right to:

To exercise any of these, write to info@repfarm.com. We answer within 30 days. If a request is complex we may extend that period and will tell you why. We may ask you for information needed to confirm your identity, and we will not use that information for anything else. Exercising these rights is free of charge; we may charge a reasonable fee only for manifestly unfounded or excessive repeat requests.

If we act as processor rather than controller, we will forward your request to the responsible business customer and tell you that we have done so.

You also have the right to complain to a supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern; in the EEA, the supervisory authority of your country of residence, place of work, or the place of the alleged infringement.

We are a Swiss business and do not currently meet the thresholds that make a company a "business" under the California Consumer Privacy Act. We therefore do not claim CCPA or CPRA status. We do not sell or share personal information as those terms are defined in that law, and we will not discriminate against anyone who asks us about their data. If you are a California resident and want to know what we hold about you, write to info@repfarm.com and we will answer as we would under section 11.

We do not carry out automated individual decision-making, including profiling, that produces legal effects concerning you or similarly significantly affects you.

repfarm is a business tool intended for use by companies and their staff. It is not directed at children, and we do not knowingly collect data from anyone under 16. If you believe a child's data has reached us, tell us and we will delete it.

We may update this policy when the service, our providers or the law change. The date at the top always shows the current version. If a change materially affects how we handle your data, we will tell account holders by email or through the platform before it takes effect.

Questions, requests or complaints about this policy: info@repfarm.com, or by post to Saracista Solutions, In der Dorfmatt 3, 4132 Muttenz, Switzerland.