Privacy Policy

1. Controller

The controller responsible for processing your personal data is:

Tartaruga Studio Sàrl
Impasse de la Poste 1A, 1669 Porsel, Switzerland
Email: [email protected]

2. Scope

This policy explains how we handle personal data when you visit our website and when you join our waitlist. We process personal data in accordance with the EU General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP), as applicable.

3. What data we collect

• Waitlist sign-up: your email address, an invite code generated for you, the invite code you arrived with (if any), your approximate position in the queue, and the date and time of sign-up.
• Server and access data: when you visit the site, our hosting provider processes technical data such as your IP address, browser type and the pages requested, to deliver and secure the site.
• Direct contact: if you email us, we process the information you choose to provide.

4. Purposes and legal bases

• Operating the waitlist (sending you a confirmation, managing your position and the referral mechanism): performance of pre-contractual / contractual steps at your request, and our legitimate interest in running an orderly launch (Art. 6(1)(b) and (f) GDPR).
• Delivering and securing the website: our legitimate interest in a stable, secure service (Art. 6(1)(f) GDPR).
• Responding to enquiries: our legitimate interest in communicating with you (Art. 6(1)(f) GDPR).

5. Service providers (processors)

We use carefully selected providers who process data on our behalf under data-processing agreements:

• Supabase, database hosting for waitlist data, in the EU region (Frankfurt, Germany).
• Cloudflare, website hosting, content delivery and security.
• Resend, sending transactional emails (e.g. your waitlist confirmation). Activated once email delivery is enabled.
• Google (Google Ireland Limited), web analytics via Google Analytics; only active if you consent to the "Analytics" category (see section 7).

Where a provider processes data outside Switzerland or the EU/EEA, we rely on appropriate safeguards such as the EU Standard Contractual Clauses.

6. Personal data in websites we migrate for customers

This policy covers our own website and the waitlist. When the paid service launches and we migrate and host a website for a customer, that website may contain personal data of the customer's own visitors and contacts (for example through contact forms). For that data the customer is the controller and ShiftPress acts as a processor: we process it only on the customer's documented instructions and under a separate data-processing agreement (DPA). That agreement, rather than this policy, governs such customer-site data.

7. Cookies and analytics

Our site is built to be data-minimal. We do not set tracking or advertising cookies without your consent. Strictly necessary storage may be used to remember an invite code during your visit.

Google Analytics. With your consent we use Google Analytics, a web analytics service provided by Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland). Google Analytics helps us understand how visitors use our site so we can improve it. It processes cookies and data such as your truncated IP address, browser and device type, the pages you view and your approximate region, and sends them to Google.

This processing only happens if you accept the "Analytics" category in our cookie banner. The legal basis is your consent (Art. 6(1)(a) GDPR). Before you consent, Google Analytics is not loaded and no related cookies are set. You can withdraw your consent at any time with effect for the future by opening the cookie settings at the bottom of the page and turning analytics off.

Google may also process data in the United States. For such transfers we rely on appropriate safeguards, in particular the EU Standard Contractual Clauses. For more on how Google processes data, see Google's Privacy Policy.

8. Retention

We keep waitlist data until the launch process is complete or until you ask us to delete it, whichever comes first. Server logs are kept only as long as needed for security and operation.

9. Your rights

Subject to applicable law, you have the right to access, rectify, erase, restrict or object to the processing of your personal data, and the right to data portability. You can withdraw consent at any time. To exercise any of these rights, contact [email protected].

You also have the right to lodge a complaint with a supervisory authority, in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EU, your local data protection authority.

10. Data security

We use appropriate technical and organisational measures (including encryption in transit and access controls) to protect your data against unauthorised access, loss or misuse.

11. Changes

We may update this policy as the product evolves. The current version is always available on this page.

12. Contact

For any privacy question, email [email protected].