Controller
Flex Studio Sàrl
c/o Agence Copilote Sàrl
Avenue de la Plantaud 8
1870 Monthey
For any question about your data: hello@pretty.design
Our role depending on the data
- Controller: for data about website visitors, prospects, application users and our customers (account, billing, support).
- Processor: for the content our customers publish in their reports (texts, images, documents, including third-party data) and for data about the readers of those reports. We process it only on the customer's instructions, and the customer remains responsible for it (see the appendix to our terms and conditions).
If you read a report or your data appears in one, please first contact the organisation that published it. We will help it respond.
pretty.design website
Contact form
We collect your name, email address, company and phone number (both optional), and whether you would like a call back. We use this data solely to answer your request and prepare a possible offer. It is sent to us by email through Infomaniak's servers in Switzerland.
Audience statistics
We measure traffic with Umami, a tool hosted on our own servers. It sets no cookies, does not store your IP address and builds no profile. We only see aggregated statistics (page views, referrer, device type, country).
Displayed currency
To show prices in CHF or EUR, we infer your country from your IP address, as well as from your browser's time zone and languages. The IP address is checked against a database hosted on our own servers. It is neither stored nor shared with any third party. IP geolocation by DB-IP (CC BY 4.0 licence).
Cookies
The website only uses three functional cookies, with no advertising or tracking:
- i18n_redirected: remembers the selected language;
- detected_currency: remembers the currency inferred from your browser for one year;
- preferred_currency_override: remembers the selected currency (CHF or EUR) for one year.
Third-party content
The website's fonts, images and videos are served from our own servers. No third-party content is loaded during your visit.
pretty.design application
Data processed
- User account: first name, last name, email address, password (stored hashed, never in plain text), linked organisations and role.
- Organisation: name, email, phone number, address, custom domain and settings (theme, analytics tool ID).
- Content: the reports, texts, figures, images, documents and themes you create or upload.
- Security: login history (email address used, success or failure, date) and a log of actions performed in the application (page or feature used, date, user). Your IP address is used temporarily to prevent abuse.
- Service emails: account validation, password reset and invitations.
Your session is kept in your browser's local storage (token valid for 8 hours), together with a few display preferences. The application uses no tracking cookies.
Purposes and legal bases
We process this data to provide the service and perform the contract, ensure security and support, invoice our services and meet our legal obligations. Under the GDPR, the legal bases are performance of the contract (Art. 6(1)(b)), our legitimate interest in securing and improving the service (Art. 6(1)(f)) and our legal obligations (Art. 6(1)(c)).
Access by our team
For support, configuration and maintenance, the administrator of Flex Studio Sàrl has technical access to all workspaces. This access is restricted to a single person bound by confidentiality and is used for these purposes only.
Published reports and readers
The customer chooses the visibility of each report:
- Public: accessible to anyone with the link. The report may be indexed by search engines.
- Private: restricted to people invited by the customer.
To display a report and generate its PDF version, our servers process the reader's IP address (technical logs, abuse prevention).
Depending on the customer's configuration, a report may load third-party services directly from the reader's browser: YouTube videos (privacy-enhanced mode), Google Fonts or Adobe Fonts, Spline 3D scenes, Google Analytics or another analytics tool. These providers then receive the reader's IP address and may process it outside Switzerland, in particular in the United States.
A customer who enables an analytics or tracking tool is solely responsible for it. It is up to the customer to inform its readers and to tell us which measures must be put in place to comply with applicable law, such as a consent banner.
Hosting and processors
Our servers, databases, files, backups and emails are hosted by Infomaniak Network SA in data centres located in Switzerland.
The application interface and some service emails load fonts from Google's servers (Google Fonts). Your browser then sends your IP address to Google, which may process it in the United States.
When data is disclosed outside Switzerland, it is to countries with an adequate level of protection or on the basis of appropriate safeguards (for example the Swiss-U.S. Data Privacy Framework or standard contractual clauses).
We do not sell or rent your data.
Retention periods
- Contact requests: for as long as needed to handle your request, then for no more than two years if no contract is concluded.
- Account and content: for the whole term of the contract, then deleted within 90 days of its end. An unconverted free trial is deleted 30 days after it expires.
- Login and activity logs: 12 months at most.
- Backups: deleted data disappears from backups as they rotate.
- Accounting records: 10 years, as required by law.
You can ask us to delete your account and all your data at any time by writing to hello@pretty.design.
Security
We protect your data with appropriate technical and organisational measures: encrypted connections (HTTPS), hashed passwords, restricted access, time-limited sessions, regular backups and hosting in Switzerland.
Your rights
You may at any time request access to your data, its correction, its deletion or its delivery in a common format, and object to certain processing. Under the GDPR, you may also request restriction of processing.
Write to us at hello@pretty.design. We reply within 30 days and may ask you to prove your identity.
You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (www.edoeb.admin.ch) or, if you live in the European Union, with the authority in your country.
Changes
We may update this policy. The date of the last update is shown at the top of the page. Our customers are informed of significant changes by email.