Privacy

This privacy notice explains which personal data Werkwave processes when you use our website — and which rights you have. The Swiss Data Protection Act (revFADP) applies.

Werkwave is responsible for the data processing. Contact for privacy requests: info@werkwave.ch

Which data we process

We only process data you share with us yourself — and only as far as needed for our service:

  • Contact details from the free analysis (name, e-mail address, optional phone number) — so we can send you your evaluation and recommendation.
  • Your answers from the analysis (selected topics, industry, team size, urgency) as well as any message you write to us through the contact form — these are the basis of your recommendation, or of our reply.
  • A voluntarily provided website address — for the automatic review of your online presence. We store only derived metrics from that review.
  • Your consent (time, wording version, source, and the IP address you consented from, together with how we determined that address) — as proof that we may contact you.
  • Your IP address when you submit the form and in our processing log, together with the entry point (which page or step you came from) — to protect against misuse (limiting automated requests) and so that we can trace our own processing steps.
  • Technical error data (error messages with request context, including the IP address) — to detect and fix problems.

Cookies

We use technically necessary cookies to keep your entries together during the analysis and store your acknowledgement of the cookie notice. For web analytics, PostHog may also set analytics cookies unless you object.

Web analytics with PostHog EU runs on an opt-out basis: you can object to capture here or by e-mail at any time.

Hosting

Our website and database run in Frankfurt (EU) — a location we chose deliberately; the database region is fixed to Frankfurt at project creation. The two platforms behind them, hosting and database, are operated by US companies certified under the Swiss-U.S. Data Privacy Framework. Where the data resides and which jurisdiction the operator answers to are two different questions — so we state both.

Service providers (processors)

The following service providers process data on our behalf:

Located in the EU — deliberately chosen by us

For hosting and the database we chose Frankfurt (EU) as the location. Both platforms are operated by US companies certified under the Swiss-U.S. Data Privacy Framework. Our business mailbox and our ranking-measurement service are operated by EU providers:

  • Vercel — data center in Frankfurt (EU)Hosting and delivery of the website. Operated by Vercel Inc. (USA); compute is pinned to the Frankfurt region.
  • Neon — database in Frankfurt (EU)Storage of all collected data. Operated by Neon (Databricks, Inc., USA); the region is fixed to Frankfurt at project creation.
  • IONOS — business mailbox in Germany (EU)Receiving and replying to your enquiry by e-mail. Operated by IONOS SE (Germany).
  • DataForSEO — ranking measurement, Estonia (EU)Measures the Google search position of connected customer websites. Only the tracked search terms and the website address are sent — no contact data and no visitor data. Operated by DataForSEO OÜ (Estonia); parts of its infrastructure run on US providers under Standard Contractual Clauses.

Third-country by the nature of the service

These services are, by their nature, provided by US companies. All are certified under the Swiss-U.S. Data Privacy Framework:

  • Google LLC (USA)Automatic website review (Places, PageSpeed) — receives only the website address you provide, no contact data. For connected customer websites we additionally read Google Analytics and Google Search Console, and only as daily totals: how many contact enquiries and job applications there were, and how often the site appeared in search. We do not see individual visitors.
  • Sentry (Functional Software, Inc., USA)Error diagnostics — technical error data with request context, including the IP address.
  • PostHog Inc (USA)Web analytics — currently not active; when activated, run on the EU cloud instance, with an objection option.
  • Meta Platforms, Inc. (USA)Advertising campaigns — currently not active; no personal data flows yet.

Without Swiss-U.S. Data Privacy Framework certification

These service providers are not certified under the Swiss-U.S. Data Privacy Framework. By design, Inngest receives no directly identifying personal data; for one limited internal notification, Resend receives the details Werkwave needs to handle your enquiry:

  • Inngest Inc. (USA)Background workflow orchestration — receives no directly identifying data, only internal identifiers and the website address.
  • Resend (USA)Internal notification to Werkwave after your offer request — sends contact details and the selected configuration only to our own mailboxes. Customer-facing e-mail through Resend is not active.

Disclosure abroad

Within the EU and EEA, an adequate level of data protection applies. Transfers to the USA take place only to recipients certified under the Swiss-U.S. Data Privacy Framework — or in a way that no directly identifying personal data is transferred.

Your rights

You have the right to access, correct, delete, and receive a copy of your data at any time. You can withdraw your consent at any time — a short message is enough. Please use the contact address above.

Last updated: July 2026. We will update this notice when our data processing changes.