Privacy Policy

This privacy policy explains how Rocket Surgery Labs GmbH, as the operator of the platform Grialto, processes personal data. The revised Swiss Data Protection Act (revDSG) is authoritative. Insofar as the EU General Data Protection Regulation (GDPR) applies, it applies additionally.

1. Controller

Rocket Surgery Labs GmbH Oberfeld 25, 6430 Schwyz, Switzerland E-mail: legal@grialto.com

For all data protection matters you may contact the above address.

2. Which Data We Process

• Account data: first name, last name, username, e-mail address, display name, preferred language for e-mails, password (if you set one; stored only as a non-reversible hash). An account can also be used without a password: you then sign in via a sign-in link we e-mail to you.
• Challenge data: the details you record about challenges, e.g. event, discipline, goal, result, texts, and the recipient organisation with its payment details. The optional message an athlete writes when completing a challenge is stored with the challenge and e-mailed, unchanged, to the challenge's supporters; it is not published.
• Donation pledge data: the supporter's name and e-mail address, the pledge limits and the amounts calculated from them. No account is needed to make a donation pledge. When you confirm that you have made your donation, you can choose to show your name and/or your amount to the athlete of that challenge. Only that athlete sees these details (on their dashboard and in one summary e-mail); they are not published.
• Publicly visible data: a challenge's page publicly shows its details and the athlete's display name. We show a supporter's name only if they choose this when making the donation pledge — shortened (e.g. «Anna K.») and never together with an amount.
• Records of consent: which version of the GTC and of the privacy policy you accepted, and when.
• Payment data: details in connection with the listing fee for publishing a challenge and with voluntary support of the Platform. Payment processing is handled by the payment service provider Payrexx; card data is processed by them and not by us.
• Server log data: when the Platform is visited, our servers automatically log every request: IP address, date and time, HTTP method and requested path (without query parameters), status code, amount of data transferred, processing duration, and the request headers sent by your browser (including User-Agent, Accept-Language and Referrer, the latter likewise without query parameters). In addition, the application logs technical operating events (e.g. errors or indications of abusive access) which may contain an IP address. Credentials — in particular cookies and Authorization headers — are removed before storage and are not logged.
• Magazine (magazine.grialto.com): we run our magazine with WordPress, hosted by Infomaniak. When you read it, Infomaniak's web server logs every request: IP address, date and time, requested address, status code, amount of data transferred, Referrer and User-Agent. The magazine sets no cookies for readers and loads no content from third parties (fonts are served from our own server; no comments, no profile pictures). For authors we keep an account (name, e-mail address, password only as a hash, two-factor sign-in details); when they sign in, WordPress sets technically necessary sign-in cookies (wordpress_*, wp-settings-*).

3. Purposes of Processing

We process personal data in order to provide the Platform, manage accounts, handle challenges and donation pledges, collect the listing fee and voluntary support payments, communicate with you by e-mail (e.g. confirmations, reminders, status notifications), fulfil legal obligations, and ensure secure and trouble-free operation.

On your request we e-mail you a sign-in link. The link can be used only once and is valid for 15 minutes. It is used to sign in and to confirm sensitive account actions (e.g. changing your password or deleting your account). Athletes also receive a summary e-mail about which supporters have made their donation; names and amounts appear in it only if the supporter in question chose this.

Submitted challenges may be automatically pre-screened before our team reviews them. For this we send the challenge's details (title, description, motivation, event, goal, recipient organisation with payment details and website) and some account details (display name, domain of the e-mail address, account age, number of challenges created) to an AI language model that Infomaniak operates for us in Switzerland. First name, last name and the full e-mail address are not sent. We also visit the recipient organisation's stated website and look up public registration data for its domain. The pre-screening is only a hint for our team: a human always decides whether a challenge is approved or rejected. Infomaniak does not use the data sent to train AI models.

We process server log data (section 2) solely for secure and trouble-free operation, to defend against abuse and attacks, and for fault diagnosis. This processing is based on our overriding interest in the secure operation of the Platform (Art. 31 revDSG; where the GDPR applies, Art. 6(1)(f) GDPR). No evaluation for advertising or analytics purposes and no profiling take place. The one exception: from the magazine's server log data, Infomaniak produces aggregated access statistics for us (e.g. page views per article) — without cookies and without profiling.

4. Disclosure to Third Parties (Processors)

To provide our services we engage carefully selected service providers who process data on our behalf:

• Payrexx (Payrexx AG, Switzerland) — processing of the listing fee and of voluntary support payments.
• Infomaniak (Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Genève, Switzerland, CHE-103.167.648) — hosting of the Platform and of the magazine, data backups, sending of e-mails (SMTP) and the AI-assisted pre-screening of submitted challenges (section 3).

These service providers receive only the data required for their task and are contractually obliged to maintain confidentiality and comply with data protection.

5. Disclosure of Data Abroad

Data is generally processed and stored in Switzerland. Should disclosure to a country without an adequate level of data protection occur in an individual case, we ensure adequate protection with suitable safeguards (e.g. standard contractual clauses).

6. Cookies and Local Storage

The Platform uses exclusively three technically necessary cookies for logging in: x-auth-token and x-refresh-token (each as an httpOnly cookie) and grialto_logged_in (contains only the value «1» so the page can tell that you are logged in). These are required for operation and store no data for advertising or analytics purposes. No non-essential cookies are set; a cookie banner is therefore not required. You can block or delete cookies in your browser; logging in may then no longer work. The magazine sets no cookies for readers (for the sign-in cookies for authors see section 2).

In addition, your browser stores locally (in the so-called localStorage):

• whether you have closed a notice banner;
• your selection in an unsent donation pledge on a challenge, so that it is still there when you come back. It is kept for 7 days and deleted when you log out;
• unsaved input in the form for creating a challenge — never passwords, bank details or account details. It is kept for 7 days and deleted when you log out;
• a flag that the celebration animation for a completed challenge has already been shown.

These entries stay on your device, are never sent to Grialto and are used neither for tracking nor for analytics. You can remove them by clearing the site data in your browser; the Platform also works without them.

7. Retention

We retain personal data for as long as required for the stated purposes or on the basis of legal obligations. Thereafter the data is deleted or anonymised. Masking of personal data no longer required, beyond the statutory retention period, is planned.

We keep a log of the emails we send (recipient address, email type, time, delivery status) for operational and evidentiary purposes; the planned masking referred to above applies to the personal data it contains.

We retain server log data (section 2) for a maximum of 90 days; thereafter it is deleted automatically. Individual entries are kept longer only insofar as they are needed to investigate a specific security incident or to pursue legal claims.

Infomaniak keeps the magazine's access logs (section 2) according to its own retention periods (currently at least 7 days) and then deletes them automatically. The aggregated access statistics produced from them contain no personal data.

8. Your Rights

Within the framework of applicable law, you have the right to information, rectification, erasure and restriction of the processing of your personal data and, insofar as applicable, to data portability. Registered users can delete their account themselves. To exercise your rights, please contact legal@grialto.com. You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC / EDÖB).

9. Changes

We may amend this privacy policy at any time. The version published on the Platform at the relevant time is authoritative.