Privacy Policy

Last updated: 2 November 2026 · This policy provides information on the processing of personal data under the GDPR and the Swiss Data Protection Act (revFADP). It applies to the website teisenda.com and to the TEISENDA Hosting platform at app.teisenda.com, including the Connector at mcp.teisenda.com.

The policy has four parts: Part I applies to everything, Part II to the website, Part III to the platform, and Part IV sets out, for both, the service providers, the retention periods and your rights.

Part I – General

1. Controller

We are not required to appoint a data protection officer and have not appointed one. For any data protection matter you can reach us at the address above.

2. Applicable law

As a company based in Switzerland addressing users in the EU/EEA, we are subject both to the Swiss Data Protection Act (revFADP) and – where applicable – to the EU General Data Protection Regulation (GDPR, Art. 3(2)). The revFADP does not require a separate legal basis for each processing operation; we therefore state the relevant GDPR legal bases in each case.

Part II – The website (teisenda.com)

3. Provision of the website

The website consists of static pages. It runs on our own TEISENDA Hosting platform, whose servers are located at Hetzner Online GmbH, Industriestr. 25, 91710 Gunzenhausen, Germany, in the Falkenstein data centre (Saxony, Germany). No CDN is placed in front of it. Name resolution (DNS) for our domains is provided by bunny.net (BunnyWay d.o.o., Cesta komandanta Staneta 4A, 1215 Medvode, Slovenia).

When you access the website, the server processes technically necessary data: IP address, requested domain, time, request, status code, amount of data transferred, referrer and user agent. We need this data to deliver the pages and to protect operations against misuse and attacks. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in secure, functional provision). We delete the logs after 30 days. Data processing agreements under Art. 28 GDPR are in place with Hetzner and bunny.net.

4. Contact by email

The website contains no forms. If you write to us by email at hello@teisenda.com or support@teisenda.com, we process the information in your message (usually name, email address, company and content) in order to answer your enquiry. It is not passed on to third parties.

Purpose: handling your enquiry. Legal bases: Art. 6(1)(b) GDPR (steps prior to entering into a contract or performance of the contract) and Art. 6(1)(f) GDPR (legitimate interest in answering enquiries).

5. Embedded third-party content

This website embeds no third-party content. Fonts, scripts, images and the product videos are held on our own servers and delivered from there. In particular, no Google Fonts are loaded and no external CDNs are contacted. When you visit the website your browser does not connect to any third-party servers. References to app.teisenda.com and docs.teisenda.com are simple links; you only access those pages if you follow them.

6. Cookies, browser storage & tracking

This website sets no cookies. We use no web analytics (no Google Analytics or similar), no tracking, no social media plugins and no advertising pixels.

Selected language. If you select a language in the language menu, your browser stores this choice in local storage (localStorage) under the name teisenda-sprache. Only the language code is stored, for example “en”. It remains in your browser until you delete it there, and it is not transmitted to us. As a result, the home page no longer redirects you according to your browser's language in future, but shows the language you have selected.

Browser language. If you have not yet selected a language, the home page reads the language set in your browser and redirects you to the matching language version. This happens solely in your browser; the language setting is neither sent to us nor stored.

Both are functions that you use yourself and are technically necessary for them. No consent is required for this, and therefore no cookie banner either. Legal basis: Art. 6(1)(f) GDPR (legitimate interest in showing you the website in your language).

Part III – The platform (app.teisenda.com)

This part applies to the TEISENDA Hosting platform at app.teisenda.com – Spaces, members and the hosting of websites – and to the Connector at mcp.teisenda.com, through which you connect Claude or ChatGPT to the platform. What Part II says about cookies and embedded content applies to the website; for the platform, what is stated here applies.

7. Our role: controller or on your behalf

For your account, the management of Spaces, billing and the security of the platform we are the controller. Sections 8 to 17 deal with this.

For the websites you host with us and their visitors, as well as for third-party data in the content you store in your Space, you are the controller; we process this data on your behalf. The Data Processing Agreement (DPA) applies to this.

8. Account & sign-in

For your account we process your first name, last name, email address and your password, which we store only as a hash. Your profile adds your language, date, time and number format, your time zone and – if you provide it – your mobile number. We record that you have agreed to the Terms and Conditions and to this Privacy Policy and have confirmed that you are acting as a business. If you enable two-factor sign-in, the secret for your authenticator app and the backup codes are added. For each sign-in we store a session with browser, operating system and sign-in time; a session is valid for up to seven days.

The purpose is to provide your account and secure sign-in. Legal basis: Art. 6(1)(b) GDPR (contract for the use of the platform).

After registering with an email address and password, you confirm your address via a link that is valid for 7 days. If you do not confirm it, we remove the registration after 7 days plus a buffer of one day in the next daily deletion run.

Sign-in with Google or Microsoft. Instead of using email and password, you can register and sign in with a Google or Microsoft account. We then receive your name, your email address and an account identifier from the provider; the provider learns that you are signing in to TEISENDA. If you do not use this sign-in, no data goes to Google or Microsoft. Legal basis: Art. 6(1)(b) GDPR; you choose this route yourself.

9. Spaces, members & invitations

A Space is a company's shared workspace on the platform. For this we store the name and time zone of the Space, the members with their roles (Owner, Administrator, User, Read-only), the teams of the Space and pending invitations. The members of a Space see your name, your email address, your role and the date you joined in the member list.

If someone invites you to a Space, we process the email address to which the invitation is sent and send you the invitation by email. It names the Space, the role and the inviting person; its link is valid for 7 days.

Legal bases: Art. 6(1)(b) GDPR for members; Art. 6(1)(f) GDPR for the invitation to a person who does not yet have an account (legitimate interest of the inviting company in bringing its team together on the platform).

10. Websites, files & custom domains

We store the website files you upload, the versions of your projects, your settings for visibility and redirects and the custom domains you connect to your websites. Database and file storage run on our own servers at Hetzner in Falkenstein (Germany); we do not use any third-party storage service. Legal basis: Art. 6(1)(b) GDPR.

For each project the platform keeps a log of changes with Space, project, acting account, channel (app or Connector), operation, detail and time. It is kept until the Space is deleted. If you delete your account, we remove the attribution to you in this log.

For custom domains we obtain TLS certificates from Let's Encrypt. In the process, the name of the domain goes to the certificate authority and appears in the public certificate logs. To check whether a domain is set up correctly, we query its DNS records from public DNS resolvers.

11. Hosting your websites & their visitors

We store your websites and deliver them, including under your own domains. You are the controller for the visitors to these websites; we are the processor (section 7). If you are a visitor to such a website, please contact its operator with any data protection questions.

The websites are served directly from our server at Hetzner in Falkenstein, with no CDN in front. For each request the server logs IP address, requested domain, time, request, status code, amount of data transferred, referrer and user agent. We delete these logs after 30 days.

If a website is private, only members of the Space for whom it has been shared can access it, and only after signing in to TEISENDA. After sign-in, the website sets the cookie __Host-ts. It is valid for 12 hours, is extended as long as the website is being used, and is re-checked after 7 days at the latest. During sign-in, the cookie __Host-ts-n is added for 5 minutes.

12. Connected applications (Connector)

Via the Connector at mcp.teisenda.com you can connect Claude (Anthropic) and ChatGPT (OpenAI) to your Spaces and use them to manage your websites. The data you retrieve or upload there goes to the respective provider at your instigation.

What goes to Claude or ChatGPT. The application receives your name and, for each Space of the connection, the Space ID, name, an indication of any suspension and the products booked. If you trigger an action, the Connector sends the result back. Depending on the action, this includes: your projects with name, address and quota; versions with time and status; file lists and file contents of your websites; the visibility of a website; custom domains including DNS records; redirects. For sharing a private website the Connector states only the number of selected people and teams, never the names of other members.

The sole purpose is to enable you to manage your websites from within the application. The recipient is the provider you have chosen yourself: Anthropic for Claude, OpenAI for ChatGPT. It processes the data on the basis of your own contract with it, not as our processor. How long the data remains there is determined by its terms and privacy notices. Legal basis for the transfer: Art. 6(1)(b) GDPR. You can disconnect at any time in your personal settings under “Connected applications”.

What the Connector stores. The Connector runs on a dedicated server at Hetzner in Falkenstein. For each connection it records: the name the application provides, the host to which the sign-in returned, the times of connecting and of last use, and the Spaces of the connection. It stores codes, access tokens and the sign-in cookie only as a hash. An application's sign-in is valid for one hour and can be renewed up to 60 days after the last renewal.

Connector logs. A sign-in log records every sign-in, every revocation and every sign-out, and for a sign-in the name and host of the application; we delete entries older than 12 months. The service log states, for each call, the action, user, request number and time; in the event of errors, error messages with individual values such as a Space ID may follow. It is kept for a maximum of 3 months. The Connector does not store the content of your requests, the responses or your conversations; only error messages may contain individual values from them.

The access log of the web server in front of the Connector contains IP address, time, method, the full address including parameters, status code, response size, referrer and user agent, but no content of requests or responses, no tokens and no cookies. For calls from Claude or ChatGPT the IP address belongs to the provider; during sign-in, to your browser. The log is deleted after 14 to 15 days. After 30 calls without a valid sign-in within 10 minutes, the server blocks an IP address for one hour. When connecting, it sets a cookie for 10 minutes whose name begins with __Host-tm.

Legal basis for connection data: Art. 6(1)(b) GDPR; for the logs: Art. 6(1)(f) GDPR (security and traceability).

13. Payment & invoices

You pay for the Max plan and packages by card via the payment provider Stripe. Stripe handles the subscription and the card payment and calculates the tax. For this, the following goes to Stripe: company name, billing address, email for invoices and – if provided – the VAT ID, which is checked against the EU register (VIES). Legal bases: Art. 6(1)(b) GDPR (payment), (c) (invoicing, tax) and (f) (fraud prevention).

You enter the card details directly into Stripe fields. We never see or store the card number, only the card brand, the last four digits and the expiry date.

Stripe's script (js.stripe.com) is not loaded with the page, but only when you open the “Payment” step in the booking flow or change your payment method. According to Stripe, it collects data about your device and your interaction, including cookies and IP address, to prevent fraud. The script is necessary for the payment you trigger at that moment; we do not obtain consent for it. Where the card fields do not load, we redirect you to Stripe's payment page.

For the Space we store the billing details (company, address, attention of, email for invoices, invoice language, VAT ID, order reference) and the invoices. Invoices and the record of the VAT ID check are retained in accordance with the statutory retention periods, even if the Space is deleted.

14. Platform emails

We send all platform emails via Brevo (Brevo GmbH, Cologne, Germany – part of Sendinblue SAS, Paris, France; servers in the EU), from the sender noreply@mail.teisenda.com: the confirmation of your email address, invitations, password resets, security notifications, emails about deleting an account or Space, notices about usage, emails about your subscription and invoices as PDF attachments. Emails about subscription, payment and invoices go to the email address for invoices. A data processing agreement under Art. 28 GDPR is in place with Brevo. Legal basis: Art. 6(1)(b) GDPR; security notifications Art. 6(1)(f) GDPR.

The emails contain our logo. If your email program loads images, it fetches the logo from teisenda.com; in doing so, our server processes your IP address as described in section 3.

15. Security, logs & monitoring

Security log. The platform keeps a log of security-relevant actions. If a Space is deleted, the entry is retained without reference to the Space. We delete entries after 12 months.

Server logs. As with the website, the platform's servers process technically necessary data such as IP address and time for each request. We delete access logs after 30 days. The application output contains lines that may include individual values from a request only in the event of errors; it is overwritten as soon as its file reaches a fixed size. We store error messages from background tasks for as long as we need them for error analysis.

Monitoring. We monitor operations with our own services on our own servers at Hetzner in Helsinki (Finland). One service receives from the servers only the signal that a run was successful, and no personal data. A second one evaluates the system logs of our servers in order to detect attacks and disruptions. In doing so, it keeps IP addresses of visitors to the hosted websites and the Connector in memory for a few minutes, assigns them an approximate location using a local database and discards them; they are not stored. For 12 months it archives sign-ins and commands of server administration as well as server error messages.

Support access. TEISENDA staff can switch into your account in support in order to reproduce a problem. This only happens if you ask us to, and every access is logged.

Backups. We back up the platform database daily. The backup is encrypted before it leaves the server and is kept on storage at Hetzner. We keep 7 daily and 4 weekly snapshots. We also back up the hosted websites daily and encrypted; of these we keep 14 daily, 8 weekly and 6 monthly snapshots. Deleted data may therefore still be contained in backups for that long.

Legal basis for the security log, server logs, monitoring, support access and backups: Art. 6(1)(f) GDPR (security, availability and traceability of operations).

16. Platform cookies

The platform sets only cookies that are technically necessary. None of them serves analytics or advertising. No consent is required for this, and a cookie banner is therefore not necessary.

17. What the platform does not use

The platform uses no analytics or tracking tool and no advertising cookies. It does not embed any third-party content, except for the Stripe card fields in the “Payment” step. The fonts are held on our own servers; Google Fonts are not loaded. We do not sell your data and do not pass it on to third parties for their own purposes.

Part IV – For website and platform

18. Processing on our behalf, recipients & transfers abroad

We use carefully selected service providers that process personal data on our behalf. Data processing agreements (Art. 28 GDPR) are in place with them:

On the platform, further providers are added – only if you use the respective function yourself. They process the data on the basis of your own contract with them:

Our own servers are located in Germany and Finland. We access them from Switzerland and from EU member states; an adequacy decision of the EU Commission exists for Switzerland. Stripe, Google, Microsoft, Anthropic and OpenAI may also process data in countries outside the EU and Switzerland, in particular in the USA. Where we initiate such a transfer, we rely on an adequacy decision (for example for recipients certified under the EU-U.S. Data Privacy Framework or the Swiss-U.S. Data Privacy Framework) or on standard contractual clauses under Art. 46 GDPR. In the case of Google, Microsoft, Anthropic and OpenAI, the transfer takes place at your own instigation; the privacy notices of the respective provider apply.

19. Retention periods

We store personal data only for as long as it is necessary for the respective purpose or as long as statutory retention obligations apply. In detail:

Once the respective period has expired, the data is deleted or anonymised. Data deleted on the platform may still be contained in backups until the stated backup snapshots expire.

20. Your rights

Within the statutory requirements you have the right to:

• access (Art. 15 GDPR)
• rectification (Art. 16 GDPR)
• erasure (Art. 17 GDPR)
• restriction of processing (Art. 18 GDPR)
• data portability (Art. 20 GDPR)
• object (Art. 21 GDPR) and to withdraw consent given with effect for the future

An email to hello@teisenda.com is sufficient to exercise these rights. You also have the right to lodge a complaint with a supervisory authority (in Switzerland: the FDPIC; in the EU: the data protection authority responsible for you).