Privacy Policy

This privacy policy explains how Rocket Surgery Labs GmbH, as the operator of the platform Grialto, processes personal data. The revised Swiss Data Protection Act (revDSG) is authoritative. Insofar as the EU General Data Protection Regulation (GDPR) applies, it applies additionally.

1. Controller

Rocket Surgery Labs GmbH Oberfeld 25, 6430 Schwyz, Switzerland E-mail: legal@grialto.com

For all data protection matters you may contact the above address.

2. Which Data We Process

• Account data: first name, last name, username, e-mail address, display name, preferred language for e-mails, password (stored only as a non-reversible hash).
• Challenge data: the details you record about challenges, e.g. event, discipline, goal, result, texts, and the recipient organisation with its payment details. The optional message an athlete writes when completing a challenge is stored with the challenge and e-mailed, unchanged, to the challenge's supporters; it is not published.
• Donation pledge data: the supporter's name and e-mail address, the pledge limits and the amounts calculated from them. No account is needed to make a donation pledge.
• Publicly visible data: a challenge's page publicly shows its details and the athlete's display name. We show a supporter's name only if they choose this when making the donation pledge — shortened (e.g. «Anna K.») and never together with an amount.
• Records of consent: which version of the GTC and of the privacy policy you accepted, and when.
• Payment data: details in connection with the listing fee for publishing a challenge and with voluntary support of the Platform. Payment processing is handled by the payment service provider Payrexx; card data is processed by them and not by us.
• Server log data: when the Platform is visited, our servers automatically log every request: IP address, date and time, HTTP method and requested path (without query parameters), status code, amount of data transferred, processing duration, and the request headers sent by your browser (including User-Agent, Accept-Language and Referrer, the latter likewise without query parameters). In addition, the application logs technical operating events (e.g. errors or indications of abusive access) which may contain an IP address. Credentials — in particular cookies and Authorization headers — are removed before storage and are not logged.

3. Purposes of Processing

We process personal data in order to provide the Platform, manage accounts, handle challenges and donation pledges, collect the listing fee and voluntary support payments, communicate with you by e-mail (e.g. confirmations, reminders, status notifications), fulfil legal obligations, and ensure secure and trouble-free operation.

Submitted challenges may be automatically pre-screened before our team reviews them. For this we send the challenge's details (title, description, motivation, event, goal, recipient organisation with payment details and website) and some account details (display name, domain of the e-mail address, account age, number of challenges created) to an AI language model that Infomaniak operates for us in Switzerland. First name, last name and the full e-mail address are not sent. We also visit the recipient organisation's stated website and look up public registration data for its domain. The pre-screening is only a hint for our team: a human always decides whether a challenge is approved or rejected. Infomaniak does not use the data sent to train AI models.

We process server log data (section 2) solely for secure and trouble-free operation, to defend against abuse and attacks, and for fault diagnosis. This processing is based on our overriding interest in the secure operation of the Platform (Art. 31 revDSG; where the GDPR applies, Art. 6(1)(f) GDPR). No evaluation for advertising or analytics purposes and no profiling take place.

4. Disclosure to Third Parties (Processors)

To provide our services we engage carefully selected service providers who process data on our behalf:

• Payrexx (Payrexx AG, Switzerland) — processing of the listing fee and of voluntary support payments.
• Infomaniak (Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Genève, Switzerland, CHE-103.167.648) — hosting of the Platform, data backups, sending of e-mails (SMTP) and the AI-assisted pre-screening of submitted challenges (section 3).

These service providers receive only the data required for their task and are contractually obliged to maintain confidentiality and comply with data protection.

5. Disclosure of Data Abroad

Data is generally processed and stored in Switzerland. Should disclosure to a country without an adequate level of data protection occur in an individual case, we ensure adequate protection with suitable safeguards (e.g. standard contractual clauses).

6. Cookies

The Platform uses exclusively three technically necessary cookies for logging in: x-auth-token and x-refresh-token (each as an httpOnly cookie) and grialto_logged_in (contains only the value «1» so the page can tell that you are logged in). These are required for operation and store no data for advertising or analytics purposes. In addition, your browser stores locally (in the so-called localStorage) whether you have closed a notice banner. No non-essential cookies are set; a cookie banner is therefore not required. You can block or delete cookies in your browser; logging in may then no longer work.

7. Retention

We retain personal data for as long as required for the stated purposes or on the basis of legal obligations. Thereafter the data is deleted or anonymised. Masking of personal data no longer required, beyond the statutory retention period, is planned.

We keep a log of the emails we send (recipient address, email type, time, delivery status) for operational and evidentiary purposes; the planned masking referred to above applies to the personal data it contains.

We retain server log data (section 2) for a maximum of 90 days; thereafter it is deleted automatically. Individual entries are kept longer only insofar as they are needed to investigate a specific security incident or to pursue legal claims.

8. Your Rights

Within the framework of applicable law, you have the right to information, rectification, erasure and restriction of the processing of your personal data and, insofar as applicable, to data portability. Registered users can delete their account themselves. To exercise your rights, please contact legal@grialto.com. You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC / EDÖB).

9. Changes

We may amend this privacy policy at any time. The version published on the Platform at the relevant time is authoritative.