Controller
Substring AG, Lindenhofstrasse 1, CH-3048 Worblaufen, Switzerland. Data protection questions: hello@substring.ch.
Still to be filled in
- Representative in the EU under Art. 27 GDPR
- The current list of processors with their locations
Privacy
Draft. This text has not been reviewed by a lawyer yet and is not legally binding. It sets out what the final version has to cover. The reviewed version follows before the public launch.
What we process and why
- Account data (email address, password hash, language settings) — to provide the service, on the basis of the contract with you.
- Campaigns, company profile, hit feedback — to run the matching you asked for.
- Sending logs, error logs and rate-limit counters — legitimate interest in operating the service securely.
What we do not process
Contract notices contain contact persons of the contracting authority — name, email, telephone. We store them in the raw layer because the source delivers them as part of the record, but we do not display them, do not include them in search results and do not send them to any translation or embedding model. You go to the source for them.
Processors
- Hosting (Switzerland / EU).
- Transactional email delivery.
- Stripe for payment and invoicing.
- Translation and embedding providers. Only notice text is sent to them — never contact persons. Your company profile is embedded, which means it is sent to the embedding provider.
Cookies and analytics
Only technically necessary cookies (your session). No advertising cookies, no third-party trackers, no consent banner — because there is nothing to consent to.
Your rights
Export of all your campaigns and hits as JSON, and deletion of your account, are self-service in the settings. Data is deleted 30 days after cancellation. You also have the rights to information, rectification, restriction and objection, and the right to complain to a supervisory authority.