Privacy notice

HICONIUM AG collects information you give us, operational information produced when you use the platform, and the limited measurement information described below. We do not buy data; we do not enrich your profile from third-party brokers; and we do not run programmatic advertising. The information below is the entire list of categories we touch.

We do not sell, lease, or rent personal data. We do not run profile-based advertising. We do not feed personal data into third-party AI models for training, fine-tuning, or evaluation.

Different categories sit on different legal bases. Founding Garage applications run on the contract we are negotiating with you (Art. 6(1)(b) GDPR; Art. 31 revFADP). The Founders List runs on consent (Art. 6(1)(a) GDPR; Art. 5(6) revFADP). Operational logs and security records run on legitimate interest (Art. 6(1)(f) GDPR; Art. 31(1)(c) revFADP). Where we are required to retain information by Swiss commercial law, we do so on legal obligation (Art. 6(1)(c) GDPR; Art. 31(1)(c) revFADP).

Browser statistics, session replay, Google Analytics storage and pseudonymous account-level measurement run only on your consent (Art. 6(1)(a) GDPR; Art. 5(6) revFADP). The daily-changing server-side visit count and the limited cookieless Google Consent Mode pings used for aggregate service measurement run on our legitimate interest in understanding and securing the platform (Art. 6(1)(f) GDPR; Art. 31(1)(c) revFADP). Those pings do not use analytics storage, an account identifier, advertising data, or information you entered. You may object to legitimate-interest processing and refuse or later withdraw statistics consent.

Write to privacy@hiconium.com or to HICONIUM AG, Privacy, Badenerstrasse 567, 8048 Zürich, Switzerland. We will acknowledge within five business days and resolve within thirty.

Hiconium is operated from Switzerland. Some of the technical infrastructure that keeps the platform running — hosting, content delivery, analytics tag delivery, Google Analytics and transactional email — is provided by partners with operations in the European Economic Area and, in limited cases, in the United States. Where that is the case, transfers happen under the European Commission's Standard Contractual Clauses, an applicable Data Privacy Framework certification, or the equivalent Swiss-issued addendum.

A list of our material data processors is published below and updated when it changes. If a processor is added that you would like to know about earlier than the next refresh, write to privacy@hiconium.com.

Hiconium uses first-party, strictly necessary browser storage for forms, security, sign-in, display preferences and your consent choice (hiconium:consent). We also count visits server-side without consent through a daily-changing anonymous hash of connection facts, with no cookie, stored IP address, or replay. With statistics consent, our first-party browser analytics use hiconium:analytics:vid for up to 13 months and hiconium:analytics:sid for the session. Session recordings capture navigation, clicks, scrolling, page structure and typed input except passwords, payment details and fields marked private; they remain on Cloudflare infrastructure operated for Hiconium.

We use Google Analytics 4 (measurement ID G-HRQHDWBRKM) through Cloudflare Zaraz in Advanced Consent Mode. Until you accept statistics — and whenever you refuse — analytics_storage is denied. Limited cookieless pings may still carry the consent state, a sanitised page route or type, an event name, an approved coarse event category, and limited screen or language information to Google for aggregate measurement. They contain no stored or reusable Google Analytics or Zaraz client identifier and no Hiconium account identifier. The Google component may generate fresh, ephemeral client and session values for an individual cookieless ping; the denied component cannot store or reuse those values. If you consent, the first-party Zaraz/GA4 storage may create pseudonymous visitor and session identifiers for up to two years and Google may receive pseudonymous page, event, session and signed-in account information. Query parameters, external referrers, the original IP address and the raw browser user agent are hidden from Google. ad_storage, ad_user_data and ad_personalization always remain denied: we do not use Google Ads or personalised advertising.

We never send Google names, email addresses, phone numbers, postal addresses, number plates, VINs, vehicle or garage record identifiers, document contents, typed input, search terms, query strings, share or invitation tokens, file names, or exact location. This restriction applies independently of your statistics choice. First-party analytics events are kept for 13 months, session recordings for 30 days and Google Analytics user-level event data for no longer than 14 months; aggregate reports may remain after identifiers expire. Recordings are accessible only to authorised staff. You can refuse or withdraw statistics consent at any time through the Cookies link in the footer; withdrawal stops future consent-based collection. Google describes how it processes partner-site data at policies.google.com/technologies/partner-sites.

We treat security as part of the design, not an addition. Sensitive member content — title documents, identity papers, contracts, ownership and provenance records — will be encrypted on the member’s device with a passphrase only the member holds (Section 4.2 of the Terms of Service). Hiconium cannot read those documents in their decrypted form. Operational data sits behind authenticated APIs, transport-layer encryption, and access logs.

If you discover a vulnerability, write to security@hiconium.com. We acknowledge within one business day and resolve material issues as quickly as the nature of the issue allows. Responsible disclosure is welcome and credited unless you ask otherwise.