1. Data controller
AIAO Sàrl (Aiao Studio) is the controller of personal data processed through this website.
AIAO Sàrl, Route de Saint-Julien 132, 1228 Plan-les-Ouates, Switzerland. UID: CHE-174.802.398. Email: info@aiao.studio.
2. Scope and applicable law
This Privacy Policy explains how we process personal data when you visit aiao.studio or contact us.
We process data in accordance with the Swiss Federal Act on Data Protection (nFADP / nLPD) and, where applicable, the EU General Data Protection Regulation (GDPR), in particular when we offer services to individuals in the European Economic Area.
3. Personal data we collect
Depending on how you interact with the site, we may process:
- Contact form: name, email address, selected service interests, and your project message.
- Technical data: IP address, browser type, device information, referring URL, and server access logs generated when you visit the site.
- Audience measurement: aggregated, non-identifying usage metrics (pages viewed, referrers, country, browser, and device) collected through Cloudflare Web Analytics. This does not use cookies and is not used to identify you.
- Bot protection: when you submit the contact form, Cloudflare Turnstile may process technical signals (such as IP address, browser characteristics, and a one-time challenge token) solely to distinguish humans from automated traffic.
4. Purposes and legal bases
We process personal data for the following purposes:
- Responding to enquiries submitted through the contact form — legal basis: your consent (nLPD / GDPR Art. 6(1)(a)).
- Operating, securing, and maintaining the website — legal basis: legitimate interest in providing a safe and functional online presence (nLPD / GDPR Art. 6(1)(f)).
- Protecting the contact form against spam and automated abuse with Cloudflare Turnstile — legal basis: legitimate interest in security (nLPD / GDPR Art. 6(1)(f)).
- Understanding how the website is used, in aggregate, so we can improve it — legal basis: legitimate interest (nLPD / GDPR Art. 6(1)(f)).
- Complying with legal obligations — legal basis: legal requirement (nLPD / GDPR Art. 6(1)(c)).
5. Recipients and processors
We do not sell personal data. We share data only with service providers that help us operate the website, or when required by law.
Our website is hosted by Hostinger International Ltd.. Hosting infrastructure may be located in the European Economic Area (EEA). The provider processes technical and access data on our behalf under a data processing agreement.
We use Cloudflare Web Analytics (Cloudflare, Inc.) to measure site usage. Cloudflare does not use cookies or localStorage for this product, does not sell the data, and does not use it to identify individual visitors. See Cloudflare's privacy policy.
The contact form is protected by Cloudflare Turnstile (Cloudflare, Inc.). Cloudflare processes a one-time token and limited technical signals on our behalf to prevent automated submissions. This is not used for advertising or profiling. See Cloudflare's privacy policy.
We may also use email services connected to our domain to handle contact enquiries.
6. International transfers
AIAO Sàrl is established in Switzerland. Switzerland benefits from an adequacy decision of the European Commission for transfers from the EEA to Switzerland.
Cloudflare, Inc. is established in the United States and operates a global network. Analytics and Turnstile data may be processed on that network. Where a transfer of personal data would occur, we rely on appropriate safeguards such as standard contractual clauses or equivalent mechanisms when required.
Where data is processed by other providers in the EEA or elsewhere, we likewise rely on adequacy decisions or appropriate safeguards when required.
7. Retention periods
We keep personal data only as long as necessary for the purposes described above:
- Contact enquiries: up to 24 months after the last interaction, unless a longer period is required for legal claims or contractual follow-up.
- Server logs: typically up to 90 days, unless needed for security investigations.
- Cloudflare Turnstile challenge tokens are one-time and short-lived. Cloudflare retains related security telemetry according to its product settings.
- Aggregated analytics metrics: retained according to Cloudflare, Inc.'s product settings, solely for audience measurement.
8. Your rights
Under the nLPD and, where applicable, the GDPR, you may have the right to access, rectify, erase, restrict processing, object to processing, and receive a copy of your data in a portable format.
Where processing is based on consent, you may withdraw consent at any time without affecting the lawfulness of processing before withdrawal.
To exercise your rights, contact us at info@aiao.studio or use our contact form. We may need to verify your identity before responding.
9. Supervisory authorities
You may lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC / PFPDT): edoeb.admin.ch.
If you are in the EEA, you may also lodge a complaint with your local data protection authority.
10. Security
We implement appropriate technical and organisational measures to protect personal data against unauthorised access, loss, or misuse. No online transmission is completely secure.
The contact form uses Cloudflare Turnstile to reduce automated abuse.
11. Data protection officer
AIAO Sàrl has not appointed a data protection officer. For privacy matters, contact info@aiao.studio.
12. Changes to this policy
We may update this Privacy Policy from time to time. The current version is dated 25 August 2026. Material changes will be reflected on this page.