Privacy Policy
How Cigno processes personal data as controller, across our website and platform.
Version 1.0 · in force from
This policy covers the personal data cigno SA decides about itself. The data clients put into the platform is governed by the General Terms and Conditions and the Data Processing Agreement instead — §1 explains which of the two applies to you.
This policy explains what cigno SA does with personal data when it acts on its own account — as the controller. It is written to meet the information duties in Art. 19 of the Swiss Federal Act on Data Protection (FADP / nLPD, SR 235.1) and Arts. 13 and 14 of the EU General Data Protection Regulation.
It is one of three documents, and it deliberately does not repeat the others. The General Conditions are the contract for the Services. The Data Processing Agreement governs the personal data our clients put into the platform, which we handle only as their processor. Where one of those documents answers a question, this policy points to it rather than restating it, so that the three cannot drift apart. Cookies and similar technologies are dealt with in §10 below.
| Controller | cigno SA, Avenue de Belmont 11, 1009 Pully, Switzerland · CHE-156.831.195 |
| Privacy contact | privacy@cignoai.com |
| Complaints and requests | privacy@cignoai.com |
1Read this first: two roles, two different answers
We handle personal data in two capacities, and which one applies decides who you should be talking to.
| We are the controller | We are the processor | |
|---|---|---|
| Whose data | Visitors to our website, account holders and their users, billing contacts, people who contact support, business prospects, job applicants | Everything a client puts into their workspace — documents, files, prompts, uploads and the deliverables the platform generates ("Client Content") |
| Who decides why it is processed | We do | Our client does |
| Which document governs it | This policy | The Data Processing Agreement between us and that client |
| Who to ask about your rights | Us | The client who holds the workspace |
If a consulting firm has uploaded information about you into Cigno, that firm is the controller of it, not us. We process it only on their documented instructions and we are not permitted to act on your request ourselves. If you write to us anyway we will forward your request to them within five business days and confirm to you that we have done so, as Clause 8.3 of the DPA requires. We will tell you who they are where we are permitted to.
Everything below describes our processing as controller.
2What we collect
Account and user data. Name, business email address, employer, job title, username, hashed password or federated identity token, language and interface preferences, workspace and team memberships, roles and permissions. We get this from you, or from the administrator of your organisation's account.
Billing and contract data. Billing contact and address, VAT or UID number, subscription details, invoices and payment history, purchase order references. We do not store full card numbers; card payments are handled by Stripe, which receives your card details directly.
Operational and security data. Log-in timestamps, IP addresses, device and browser type, feature usage counts, agent-run counts and durations, volumes processed, and error and performance traces. This is the technical data we generate about the running of the platform. Clause 2.1 of the General Conditions defines it as Operational Data, and Clause 2.2 of the DPA records that we are its controller.
There is a boundary here worth stating plainly. Operational data is data about the running of the platform. It is not the in-workspace audit trail — the record of what was done to a client's content and how each output was generated. That audit trail is Client Content, it belongs to the client, and we hold it as processor.
Support and correspondence. The content of emails, tickets and calls with our support and customer success teams, including anything you attach.
Business contacts and prospects. Business contact details you give us in a demo request, newsletter sign-up, event registration or download; your marketing preferences; whether you have unsubscribed; and business contact information we find in public professional sources such as company websites and professional networks. Where we obtain your details from a source other than you, Art. 19(3) FADP and Art. 14 GDPR require us to tell you within one month, and we do.
Website visitors. Cookies and similar technologies, and the identifiers they set. §10 sets out the categories and who provides them.
Job applicants. Where you apply to us directly: your CV and application, correspondence, interview notes and assessment records.
What we ask you not to send us. Please do not put special category data (Art. 9 GDPR), criminal offence data (Art. 10 GDPR) or sensitive personal data (Art. 5(c) FADP) into our website forms, support channels or marketing forms. We do not ask for it and we do not want it there. Such data may legitimately appear inside Client Content, where the DPA and the client's own instructions govern it — Clause 7.4 of the General Conditions and Annex I §C of the DPA set out the notification route for that.
3Why we process it
| Purpose | Data | Basis under the GDPR |
|---|---|---|
| Creating and administering your account, authenticating you, and providing the Services | Account and user data; operational data | Art. 6(1)(b) — performance of a contract, or steps before entering one |
| Billing, invoicing, collections, tax and accounting | Billing and contract data | Art. 6(1)(b) contract; Art. 6(1)(c) legal obligation |
| Keeping the Services secure — abuse detection, fraud prevention, rate limiting, intrusion detection, incident investigation | Operational and security data | Art. 6(1)(f) — our legitimate interest in protecting our systems, our clients and their data |
| Operating, maintaining, debugging and improving the Services | Operational data, in aggregate | Art. 6(1)(f) — our legitimate interest in a reliable product |
| Answering your enquiries and providing support | Support and correspondence | Art. 6(1)(b) for clients; Art. 6(1)(f) otherwise |
| Sending service and security notices — outages, breaking changes, incident notifications, policy updates | Account data | Art. 6(1)(b); Art. 6(1)(c) where notification is required by law |
| Marketing to business contacts | Business contact data | Art. 6(1)(f) for existing clients; Art. 6(1)(a) consent for other prospects where national rules require it |
| Measuring and improving our website | Website visitor data | Art. 6(1)(a) consent, obtained before any optional cookie is set — see §10 |
| Enforcing our terms, and establishing or defending legal claims | As relevant | Art. 6(1)(f) — our legitimate interest in legal protection |
| Complying with legal obligations and lawful authority requests | As relevant | Art. 6(1)(c) |
| Recruitment | Applicant data | Art. 6(1)(b) — steps before a contract; Art. 6(1)(f) for keeping a record of the process |
A note on Swiss law. The FADP does not require a legal basis in the way the GDPR does. Processing by a private person is lawful if it observes the principles in Arts. 6 and 8 — lawfulness, good faith, proportionality, purpose limitation, accuracy and security. Where processing would otherwise breach personality rights, we rely on the justifications in Art. 31, principally the performance of a contract and our overriding private interest in security, product reliability and direct marketing. Art. 3(1)(o) of the Unfair Competition Act (SR 241) governs marketing email, and we observe its consent requirement and its existing-customer exemption.
Objecting, and withdrawing consent. You can object to anything we base on legitimate interests, on grounds relating to your situation, and we will stop unless we can show compelling grounds that override your interests — for security processing that will usually be the case. Objection to direct marketing is absolute: we will always stop, no reasons needed. You can withdraw consent at any time, and doing so does not affect processing already carried out.
Do you have to give us your data? Account and billing data is a contractual necessity — without it we cannot open your account or invoice your organisation. Everything else, including marketing data and the optional profile fields, is voluntary and there is no consequence if you decline.
4What we do not do
We do not sell personal data, and we do not share it for anyone else's marketing.
We do not train AI models on Client Content. We do not use it to train, fine-tune, re-train, evaluate, benchmark or otherwise develop or improve any model, our own or anyone else's; we impose the same restriction by contract on every provider in our supply chain that receives it; and we have not opted in to any provider programme that would permit it. This is not a preference we could quietly change — it is a warranty in Clause 18.2(e) of the General Conditions, given in Clause 11.6 of them and flowed down by Clause 6.1 of the DPA. Where a provider retains a limited abuse- or safety-monitoring capability that we cannot contractually disapply, we disclose it in Annex III to the DPA rather than claim that nothing is retained.
We do use aggregated, anonymised operational metrics — average agent runtime, error rates, feature adoption — to make the Services more reliable. Clause 10.4 of the General Conditions requires that those metrics cannot identify a client, a user or any Client Content, and that they do not incorporate or reveal it.
We do not make automated decisions about you. We do not take decisions based solely on automated processing that produce legal effects or similarly significant effects, within the meaning of Art. 22 GDPR or Art. 21 FADP. What the platform produces are drafts and analyses for a human professional to review, judge and adopt, and that person remains responsible for the result. Where a client uses those outputs in its own decisions about individuals, the client is responsible for meaningful human review and for informing the people affected; Clause 11.9 of the General Conditions records that, and we assist under Clause 8 of the DPA.
5Artificial intelligence and transparency
The Services use AI, including large language models. Where you interact directly with a Cigno agent, the interface tells you so, as Art. 50(1) of the EU AI Act requires. Where the platform generates synthetic content, we mark it as artificially generated in a machine-readable format where that is technically feasible, under Art. 50(2).
We act as the provider of a limited-risk AI system under the AI Act, and our clients act as deployers. Clause 11.10 of the General Conditions sets out what each of us undertakes as a result, including the AI-literacy duty in Art. 4. If a change in the Services or in a client's disclosed use case would bring the system within Annex III of the AI Act, we notify that client.
6Who we share it with
Service providers. We use third parties for hosting, model inference, authentication, transactional email, document processing, payments, analytics, error monitoring and internal tooling. Each is bound by a written data processing agreement imposing confidentiality, security and use restrictions.
The providers that process Client Content are listed, with their processing locations and transfer mechanisms, in Annex III to the DPA. We give clients at least 30 days' notice before adding or replacing one, and they may object under Clause 7.3 of the DPA.
The providers we use for our own operations, which do not receive Client Content, are listed in Annex III §D. As at the date of this policy they are Mixpanel, Google Ireland, GitHub, Atlassian, Notion, Xero and Bastion.
Stripe is different: for the card details it collects directly from you it acts as an independent controller, not as our processor, and its own privacy notice governs that.
Professional advisers — lawyers, auditors and accountants, under professional confidentiality.
Authorities, where we are legally required to disclose. Clause 4.4 of the DPA sets out how we handle those requests where Client Personal Data is involved: we notify unless prohibited, disclose the minimum required, and challenge requests we consider unlawful. We apply the same approach to the data covered by this policy.
An acquirer, in a merger, acquisition or sale of the business, in which case this policy continues to apply until superseded on notice.
7Where it goes
Our platform is hosted in the European Union, on Scaleway infrastructure in Paris. Model inference runs in the European Union — Paris or Frankfurt — or, where a client elects Swiss residency, in Zurich. Because we are a Swiss company, administration and support access takes place from Switzerland.
Transfers between the EEA and Switzerland need no additional safeguard in either direction. Switzerland has held a European Commission adequacy decision since 2000, which the Commission confirmed as continuing to provide adequate protection in its report of 15 January 2024; and the EU and EEA States are listed in Annex 1 to the Swiss Data Protection Ordinance as providing adequate protection. Clause 11.2 of the DPA records both.
Art. 19(4) FADP requires us to name the countries personal data may reach. As at the date of this policy: France and Germany for hosting and inference; Switzerland for our own operations, support and Swiss-residency inference; Ireland for authentication, transactional email and document text extraction; the United States for network edge and TLS termination, optional web search, and our own product analytics and internal tooling; and the United Kingdom, Australia, New Zealand and Czechia for internal business tooling only.
Where a transfer goes to a country without an adequacy decision, we rely on the EU Standard Contractual Clauses with the Swiss addendum and, where relevant, the UK Addendum, supported by a documented transfer impact assessment, and on the Data Privacy Framework where the recipient is certified for it. Annex III to the DPA states the mechanism for each provider. You can ask us for a copy of the safeguards at privacy@cignoai.com.
8How long we keep it
| Data | Retention |
|---|---|
| Account data | For the life of the account, then 90 days after closure |
| Billing, invoices and contracts | 10 years from the end of the financial year — Art. 958f of the Swiss Code of Obligations |
| Operational and security logs | 12 months, or longer where needed to investigate a specific incident |
| Support tickets and correspondence | 24 months from closure |
| Business contact and marketing data | Until you unsubscribe or object, and reviewed every 24 months for continued relevance |
| Cookie consent records | 12 months, as evidence of consent — see §10 |
| Breach documentation | At least 2 years from notification — Art. 15(4) of the Swiss Data Protection Ordinance |
| Applicant data | 6 months after the process closes, unless you agree to us keeping it longer |
Client Content is not on this list, because we do not decide how long it is kept. The client does. Clause 23.7 of the General Conditions and Clause 12 of the DPA set out what happens on termination: a 30-day window for the client to choose return or deletion, deletion from live systems within 30 days of that, and encrypted backups fully expunged within 90 days.
Where the law requires us to keep something, we restrict its processing to that purpose rather than carrying on using it.
9How we protect it
Our technical and organisational measures are set out in full in Annex II to the DPA, which is published separately and kept current. We would rather point you to the real document than summarise it here, because a summary is where overstatement creeps in.
Two things are worth saying on this page. Our control environment is designed to the SOC 2 Trust Services Criteria and is structurally aligned with the principles of ISO/IEC 27001, but we do not hold a SOC 2 attestation or an ISO/IEC 27001 certificate, and we do not represent that we do. And our staff cannot see Client Content by default: business personnel see anonymised operational metadata, infrastructure personnel manage the environment rather than its contents, and any exception is explicit, time-bound and logged.
If a personal data breach happens:
- Where we are the controller — the data described in this policy — we notify the Swiss Federal Data Protection and Information Commissioner as soon as possible where the breach is likely to result in a high risk to the people affected (Art. 24(1) FADP), we notify the competent EU supervisory authority within 72 hours where Art. 33(1) GDPR applies, and we tell the people affected directly where the law requires it.
- Where we are the processor — Client Content — we notify the client within 36 hours of becoming aware, under Clause 9.1 of the DPA and Clause 17.7 of the General Conditions. That is deliberately shorter than the controller's own 72-hour deadline, so that the client has time to act. We do not notify any authority or any individual on a client's behalf without their instruction, because that decision is theirs.
10Cookies and similar technologies
Two different rules apply to us. Switzerland, where we are established, sets an information-and-objection standard in Art. 45c(b) of the Telecommunications Act. The EU sets a stricter prior-consent standard in Art. 5(3) of the ePrivacy Directive. Rather than serve one standard to some visitors and another to the rest, we apply the stricter EU standard to everyone.
What that means in practice: nothing optional is set until you agree to it; refusing is as easy as agreeing, and offered with equal prominence; every optional category starts switched off; we do not treat scrolling or dismissing a banner as agreement; we do not make access to the site conditional on accepting optional cookies; and you can change your mind at any time, with effect from the next page load.
Strictly necessary — always on. Cookies and local storage that keep you signed in, protect against cross-site request forgery, route you to a working server, remember your language, remember your cookie choices so we do not keep asking, and protect the site against bots and denial-of-service attacks. These come from us, from Cloudflare, which provides our network edge, and from Auth0, which provides authentication. They cannot be switched off, because without them the service you asked for cannot be delivered — which is why Art. 5(3) of the ePrivacy Directive exempts them from consent.
Analytics — off until you agree. Cookies and identifiers that tell us which pages are read, where people get stuck and what to fix. Our providers are Mixpanel and Google Analytics, both listed in Annex III §D to the DPA among the providers processing personal data for which we are the controller. We do not use them to build advertising profiles and we do not sell what they collect.
No advertising inside the platform. Once you are signed in we set only strictly necessary cookies, plus product analytics where you have agreed to it. We run no advertising or third-party marketing trackers in the authenticated platform, and no Client Content is ever transmitted to an analytics provider.
Some cookie identifiers are personal data under Swiss and EU law even though they contain no name. Where they are, everything else in this policy applies to them.
Your controls. You can change your cookie choices at any time, and every major browser also lets you block or delete cookies for any site — though blocking the strictly necessary ones will break sign-in. When you make a choice we record the choice, its timestamp and the version of this policy you saw, as evidence that it was validly obtained, and we keep that record for 12 months. We ask again when the set of cookies changes materially, and in any event after 12 months.
If you want the itemised list — every cookie by name, with its provider, purpose and lifetime — write to privacy@cignoai.com and we will send you the current one.
11Children
The Services are a business tool and are not directed at children. We do not knowingly collect personal data from anyone under 16. If you believe a child has given us personal data, write to privacy@cignoai.com and we will delete it.
12Your rights
| Right | What it means |
|---|---|
| Access | Confirmation of whether we process your data, a copy of it, and information about purposes, recipients, retention, its source and any automated decision-making — Art. 25 FADP; Art. 15 GDPR |
| Rectification | Inaccurate data corrected and incomplete data completed — Art. 32(1) FADP; Art. 16 GDPR |
| Erasure | Your data deleted where the grounds apply — Art. 32(2) FADP; Art. 17 GDPR |
| Restriction | Processing paused while a dispute about accuracy or lawfulness is resolved — Art. 18 GDPR |
| Portability | Your data in a structured, commonly used, machine-readable format, or transmitted to another provider — Art. 28 FADP; Art. 20 GDPR |
| Objection | Object to processing based on legitimate interests, and to direct marketing at any time and absolutely — Art. 30(2)(b) FADP; Art. 21 GDPR |
| Withdraw consent | At any time, without affecting what came before — Art. 7(3) GDPR |
| Human review | Where a decision is taken about you by automated means alone, state your view and ask for review by a person — Art. 21 FADP; Art. 22(3) GDPR |
How to exercise them. Email privacy@cignoai.com. We respond within 30 days, the period set by Art. 18 of the Swiss Data Protection Ordinance, and in any event within the one-month GDPR deadline — which we may extend by two further months for complex or numerous requests, telling you within the first month if we need to. Access is free. We may charge a reasonable fee, or decline, only where a request is manifestly unfounded or excessive, and we will explain why.
We may need to verify who you are before we act. We will not ask for more than is necessary to do that.
If your data is in a client's workspace, we are the processor and must refer you to that client, as §1 explains.
13Complaints, and two things we tell you plainly
If you are unhappy with how we have handled your data, tell us first at privacy@cignoai.com — we would rather put it right. You can also complain to a supervisory authority:
- Switzerland — you may report the matter to the Federal Data Protection and Information Commissioner, Feldeggweg 1, 3003 Bern (edoeb.admin.ch), who may open an investigation under Art. 49 FADP. Swiss law does not give you a right to a decision on an individual complaint; you enforce your rights directly by civil action under Art. 32 FADP.
- EU and EEA — the supervisory authority where you live, where you work, or where the alleged infringement took place. The list is at edpb.europa.eu.
- United Kingdom — the Information Commissioner's Office, ico.org.uk.
You may also go to court.
Two disclosures we would rather make on this page than leave you to discover:
We have not appointed a representative under Art. 27 GDPR or Art. 27 UK GDPR. Clause 18.2(f) of the General Conditions says the same. This does not affect your ability to complain to your own supervisory authority or to contact us directly at privacy@cignoai.com, and we answer requests from anywhere on the same terms.
We have not appointed a Data Protection Officer under Art. 37 GDPR, or a data protection advisor under Art. 10 FADP. Our assessment is that our core activity is supplying a professional workflow tool rather than large-scale monitoring of individuals or large-scale processing of special category data. We review that assessment annually and will revisit it if our clients' use of the platform changes. Our privacy contact is privacy@cignoai.com.
14Changes
We review this policy at least once a year. If we change it in a way that materially affects how we handle your personal data, we will email account holders and post a notice in the platform at least 30 days before it takes effect. The version and date at the top tell you which version you are reading, and we keep a dated archive of superseded versions, available on request.
This policy is published in English. Where we provide a translation it is for convenience, and the English version prevails in the event of a discrepancy, except where mandatory law provides otherwise.