Privacy policy
This policy explains how Hostcraft handles personal data on this website (hostcraft.ch) and in the Hostcraft application (app.hostcraft.ch and the customers’ learning spaces at their own addresses under hostcraft.ch). It follows the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).
1. Who is responsible
Hostcraft (sole proprietorship), Switzerland, info@hostcraft.ch.
For the personal data of learners and other users in a customer’s learning space, the customer (usually the employer) is the controller and we process that data on its behalf. If you learn with Hostcraft through your organisation, please contact it first; we will help it answer your request.
2. Visiting this website
This website uses no analytics, no advertising and no tracking, and it sets no cookies. To deliver the pages and keep them secure, our servers and our network provider process technical data such as your IP address, the date and time, the page requested and your browser’s identification. We use this data only to run and protect the website and keep it only as long as needed for that.
The website’s fonts are stored on our own server and load from hostcraft.ch, like the pages themselves. Your browser doesn’t connect to Google or any other font service.
3. When you contact us
When you email or call us, we process your name, contact details and the content of your message to answer you and, if you are interested, to prepare a quote.
4. Customers and billing
For customers we process the names and business contact details of contact persons, company details, the contract and billing details, and our correspondence. We use them to provide the service, send invoices, and meet our legal obligations.
Payments are processed by Stripe. Card and bank details are entered with and stored by Stripe; we don’t receive or store full card numbers. Stripe processes payment data under its own privacy policy.
5. Using the Hostcraft application
To provide the application, we process data that customers and their users provide or that arises from use:
- Account data: name, email address, role, sign-in and security data (including two-factor authentication), invitations;
- Learning data: progress, answers, scores, XP, streaks, badges and leaderboard settings;
- Content: training material the customer uploads (such as PDF manuals) and the lessons and activities made from it;
- Usage data: technical logs needed to run, secure and troubleshoot the application.
The application uses cookies only to sign you in and keep you signed in, and your browser’s local storage for settings such as sound. It uses no analytics or advertising cookies.
6. AI processing of training material
To draft lessons and activities, the training material a customer uploads is sent to AI model providers, which may process it outside Switzerland and the EU, including in the United States. The drafts are published to learners only after a person at the customer approves them. Training material should contain no personal data; please remove it before uploading. Learners’ personal data is not used to create AI drafts.
In Hostcraft Learn (learn.hostcraft.ch), your topic and uploaded material are sent to OpenAI through our VPS OpenCode agent to create and review learning modules and transcribe scans or photos. In this personal app, automatic checks and a separate AI review approve and publish completed modules to your library. You can optionally inspect the generation in Studio. Uploaded material is also sent to Jev for independent source checking. The app asks for your permission before each generation request. If you decline, nothing is sent for AI generation and you can continue using your existing learning library. You can request deletion of your account and material using the contact details below. These providers may process material outside Switzerland and the EU; their processing depends on the service and account settings. Do not upload personal or confidential material that you do not have permission to share.
7. Service providers and where data is stored
We use carefully selected providers that process data on our behalf:
- a hosting provider, whose servers for the website and application are in Helsinki, Finland (EU);
- a database, file storage and sign-in provider, which stores application data in Zurich, Switzerland;
- a network provider that delivers and protects our websites;
- an email provider that sends invitations and sign-in emails;
- AI model providers for drafting activities (see section 6);
- Stripe for payments (see section 4).
Some of these providers may process data in countries without data protection equivalent to Switzerland’s, such as the United States. In that case we rely on the safeguards recognised under Swiss and EU law, such as the standard contractual clauses or a recognised data privacy framework.
8. Legal basis
Where the GDPR applies, we process personal data to perform a contract or take steps before one (Art. 6(1)(b)), to meet legal obligations (Art. 6(1)(c)), and for our legitimate interest in running, securing and improving our website and service (Art. 6(1)(f)).
9. How long we keep data
We keep personal data only as long as needed for the purposes above. Account and learning data are kept for the duration of the customer’s subscription and deleted after it ends, unless the customer asks for an export first. Accounting records, including invoices, are kept for 10 years as required by Swiss law.
10. Security
We protect data with encrypted connections (HTTPS), access controls, separate learning spaces per customer and two-factor authentication.
11. Your rights
Request account deletion: Hostcraft and Choco Sphere
To request deletion of your app account and associated personal data, email info@hostcraft.ch. Tell us which app and learning space you use and the email address associated with your account. Specify whether you want your whole account or particular personal data removed. Never send a password or learner PIN. A parent must request deletion of a child profile. If your account belongs to an employer or another organisation, contact that organisation first; it controls the records in its learning space, and Hostcraft helps it handle your request. We may verify your identity and clarify which accounts, profiles and learning records your request covers. The retention rules in section 9 apply to records that must be kept, including accounting records retained for 10 years.
Within the limits of the applicable law, you can ask for access to your personal data, for its correction or deletion, for restricted processing, and for a copy of data you provided to us. You can object to processing and withdraw consent at any time. Write to info@hostcraft.ch.
You can also complain to a data protection authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); in the EU, the authority in your country.
12. Changes
We update this policy when our processing changes. The current version is always on this page. This policy is available in English and German; both versions are equivalent.