Privacy policy

Protecting your data matters to us – not just in our products, but also on this website. We process personal data in accordance with the Swiss Data Protection Act (FADP) and, where applicable, the European General Data Protection Regulation (GDPR).

Last updated: October 2026

1. Controller

APPORTUS AG, Lagerplatz 21, CH-8400 Winterthur, Switzerland
hello@apportus.com

2. What data we process

When you visit this website, technically necessary data such as IP address, time, page accessed, referrer as well as browser and device information may be processed. This data serves the secure delivery and operation of the website.
If you contact us by e-mail, phone or the contact form, we process the details you provide, in particular name, e-mail address, topic and message, in order to answer your enquiry.
If you use the website's AI features (section 4), we process the texts you enter there.

3. Contact form

The form transmits your details in encrypted form to our own contact API. From there, the enquiry is delivered via Microsoft Graph to the designated APPORTUS mailboxes. The website does not maintain a separate contact database. To prevent spam and abuse, the requesting IP address is temporarily used in memory for a limit of five requests per hour, but is not logged in the contact service.
In addition, the entry page, any UTM campaign parameters and the contact button that triggered the enquiry are transmitted with the request. This lets us trace which campaign an enquiry originated from. Form input is not transmitted to our analytics tool.

4. AI features on the website

On some pages you can try out artificial intelligence. If you ask our mascot Apporti a question, we send your question, the last three questions and answers of the conversation and the page you are on to OpenAI, whose language model writes the answer. If you paste an e-mail of your own into the «Automation and AI» demo, we send its text to TypeSafe AI, whose model assigns the e-mail to a category and a department. The sample e-mails in the demos are written by us or made up by OpenAI; they contain none of your details.
We do not store your input. It is only transmitted for the respective answer. According to the providers it is not used to train their models; the providers may, however, keep it for a limited time to detect abuse. Please do not enter confidential information or personal data of other people. To prevent abuse, your IP address is temporarily used in memory for a limit of 30 requests per ten minutes.

5. Web analytics and browser storage

We use Umami Cloud for statistical analysis of the website. Umami does not use tracking cookies and does not track visitors across different websites. Data collected includes pages accessed, referrer, campaign parameters (UTM) from the request URL, approximate location (country, region, city), browser, device and language information, interactions and web performance metrics. According to the provider, the IP address is used to derive location and session but is not stored. The browser's "Do Not Track" setting is respected. The public website is measured whether or not you are signed in to the customer portal. In the customer portal, page views and load times are counted separately; Umami receives no login data or user identifier. The login page is not tracked.
For technical monitoring (errors, response times, availability) we use Microsoft Azure Application Insights. The browser reports page views, calls to our own API and JavaScript errors; Azure masks the IP address after deriving the approximate location. Application Insights sets no cookies on this website.
During the browser session we temporarily store campaign origin, the triggering contact button and a timestamp for qualified visits. These entries live in the browser's session storage, cannot be used across websites and are removed at the latest when the browser session ends.
The customer portal sets two strictly necessary cookies: a session cookie for the login (lifetime one hour) and a cookie for the chosen language (lifetime one year). Anyone opening the website agent in the portal receives a third cookie for one day that enables the website preview inside the portal. The portal also keeps in browser storage a notice after signing in or out (until the browser session ends) and, for the website agent, the changes not yet applied (locally, until applied or discarded). These cookies and entries serve no analytics purpose and require no consent.

6. Purposes

We process personal data to provide this website securely, answer enquiries, offer the AI features, understand the usage and technical quality of the website and fulfil legal obligations. We do not sell personal data.

7. Service providers and data transfers

The website is hosted on Microsoft Azure (Azure Container Apps) in the Switzerland North region. Contact enquiries are sent via Microsoft Graph and processed in our Microsoft 365 mailboxes. Umami Cloud is provided by Umami Software, Inc. (USA); the provider runs cloud regions in the EU and the USA, and depending on the chosen region the analytics data is processed in the EU or the USA. Azure Application Insights runs in the Switzerland North region. The input to the AI features (section 4) is processed by OpenAI, L.L.C. (USA) and TypeSafe AI (USA).
For the customer portal additionally: login is by e-mail code via Microsoft Entra External ID, where the user account (e-mail address) is held; we send the code from our Microsoft 365 mailbox. Name, e-mail address, role and access rights of portal users are managed in Microsoft Dataverse. Changes to website content are stored at GitHub, Inc. (USA) with the editing person's name and e-mail address as author. The AI-assisted text generation and translation in the portal sends the entered texts and uploaded images to OpenAI, L.L.C. (USA).
Some of these recipients process data in the USA. According to the Swiss Federal Council, the USA ensures adequate data protection only for companies certified under the Swiss-U.S. Data Privacy Framework. Where this does not apply, we rely on the providers' data processing agreements with the European Commission's standard contractual clauses, as recognised by the Federal Data Protection and Information Commissioner (FDPIC).
Data is only passed on where necessary for the stated purposes, where we are legally obliged to do so or where another permissible basis exists.

8. External links

This website contains simple links to LinkedIn, swiss made software and Pexels. Data is only transmitted to the respective operator once you follow such a link. No social media plugins are embedded.

9. Retention

We retain personal data only for as long as required for the respective purpose, security requirements or statutory retention obligations. Contact enquiries remain in Microsoft 365 in accordance with our operational e-mail and business records rules. We do not store input to the AI features. Data in Application Insights is deleted after 90 days. Analytics data in Umami Cloud is deleted or aggregated according to the periods of the booked plan.

10. Your rights

You have the right to information about, correction and deletion of your personal data as well as – where applicable – data portability or objection to processing. To exercise these rights, contact hello@apportus.com. You may also lodge a complaint with the FDPIC.

11. Changes

We may amend this privacy policy if our data processing or the legal requirements change. The version published on this website at the time applies.