Collect less. Keep private evidence private.

1. Controller and contact

Lukas Jud is the controller for BrandMyHumanoid. StadtHirsch GmbH provides the c/o postal address only. It is not the controller, platform operator, processor, payment recipient, or representative of BrandMyHumanoid.

2. Scope and current service

The public website can be browsed without an account. It does not use a public contact form. Standard hosting and security logs may still record IP address, request time, requested resource, device or browser information, and error or abuse signals.

Account, seller, buyer, moderation, email, upload, and payment processing begins only when the relevant feature is used. The Marketplace Terms explain the B2B-only transactional service.

3. Data we process

• Account and security: email address, authentication identifiers, sessions, access events, IP address, device data, and fraud or abuse signals.
• Seller and robot: public profile and listing fields; private identity, business authority, robot control, ownership, venue, funding, payout-readiness, and fulfilment evidence.
• Buyer and campaign: business or brand name, contact email, Swiss business-establishment declaration and B2B confirmation, optional HTTPS website, campaign note, original artwork, sanitized public derivative, selected spot, and order status.
• Payment and contract: Stripe customer, account, checkout, payment, charge, refund, dispute, and payout identifiers; declared transaction country, billing country collected by Stripe, prices, status, accepted terms version, and reconciliation facts. BrandMyHumanoid does not receive raw card numbers.
• Operations and moderation: consents, attestations, decisions and reasons, reports, support correspondence, proof, webhook records, delivery attempts, and audit events.

4. Why we process data

• To provide requested pages and, when enabled, accounts, listings, moderation, conditional orders, refunds, proof, and support under a contract or to take requested pre-contract steps.
• To secure the service, prevent fraud, preserve inventory and payment truth, investigate reports, enforce the Terms, and improve reliability where those legitimate interests do not override user rights.
• To meet accounting, tax, payment, sanctions, legal-process, platform, and record-keeping duties where processing is required by law.
• On consent only where that is the appropriate basis, such as a future optional non-essential tracker or marketing message. Consent can be withdrawn for future processing at any time.

5. Providers and recipients

Data is shared only as needed with providers and recipients relevant to the enabled feature:

• Netlify for hosting, delivery, and security logs;
• Supabase for authentication, database, and private object storage;
• Stripe for Checkout, Connect onboarding, payments, refunds, disputes, payouts, and payment-risk controls. Stripe may act as an independent controller for parts of this processing under its own privacy notice;
• Resend for transactional email when email is enabled;
• Hostpoint for domain or support-mail infrastructure where enabled;
• the relevant seller or buyer where necessary to form, decide, fulfil, evidence, refund, or dispute a direct physical advertising placement; and
• professional advisers, insurers, payment partners, courts, or authorities where required to protect rights or comply with law.

BrandMyHumanoid does not sell personal data and does not share it for third-party behavioural advertising.

6. International transfers

Providers or their sub-processors may process data outside Switzerland or the country where a user is located, including in the United States. Where required, transfers rely on an adequacy decision, recognized data-protection framework, contractual safeguards such as standard contractual clauses, or another lawful exception. Provider locations and safeguards are checked before transactional launch and when the provider set changes.

7. Cookies and analytics

The current service does not use advertising trackers or non-essential analytics. Essential authentication, load-balancing, fraud-prevention, and security cookies may be used when the related feature is used. They are required to deliver the service and are not used for advertising. A consent choice will be introduced before any optional tracker is added.

The seller wizard stores an unfinished listing draft in this browser's local storage on this device for seven days after the draft is created or last changed. Reopening it without making a change does not extend that period. The draft is not sent to BrandMyHumanoid unless the user deliberately submits it while the live service is enabled. It is removed after a successful submission and, when the wizard is next opened, if it has expired or is invalid. Clearing browser storage removes it immediately.

8. Public content and private evidence

Approved listing fields, robot visuals, spot availability, sanitized logo derivatives, and fulfilment proof may be public. Original logos, identity and ownership evidence, private contact details, payout information, reports, and unapproved proof remain private unless disclosure is required for a transaction, legal duty, or rights claim. Uploaded public images are decoded, dimension-limited, metadata-stripped, re-encoded, and moderated. The server does not fetch a buyer website merely because its URL is submitted.

9. Moderation and automated safeguards

BrandMyHumanoid does not make a solely automated decision that has a legal or similarly significant effect on a user. Human reviewers make publication and content decisions. Deterministic rules protect inventory and payment state, and Stripe may apply its own automated fraud or compliance controls under its privacy notice. A user may ask BrandMyHumanoid for human review through the published support channel.

10. Retention

BrandMyHumanoid keeps data only as long as needed for the purpose, dispute window, security, or legal duty. The target schedule for live operation is:

• account and active draft data while the account or draft remains active, then normally up to 90 days unless linked to a transaction, report, or legal hold;
• rejected or abandoned uploads normally 30 days after the final decision or draft expiry;
• financial, contract, invoice, payment, and audit records for up to 10 years where Swiss accounting or another legal duty applies;
• reports, moderation evidence, and security logs normally up to 12 months, or longer while an active dispute, abuse investigation, or legal hold requires them;
• pseudonymous request-limit identifiers for 24 hours after the latest check; the limiter stores an irreversible keyed digest, not the raw account, email address, or IP address; and
• public content while the listing or placement is active, followed by removal from public display and limited archival retention where needed for proof or legal records.

Provider backups expire according to protected backup cycles. The deletion schedule is applied by a daily production lifecycle job. Deletion may be delayed where a transaction, report, dispute, legal duty, provider backup cycle, or active legal hold requires retention.

11. Your rights

Depending on applicable law, a person may request access, correction, deletion, restriction, portability, or objection; withdraw consent for future processing; and receive information about a decision. A request may require proportionate identity verification. Some data must be retained for contracts, fraud prevention, legal claims, or statutory records.

Signed-in account holders can use the authenticated Privacy Centre to download a structured account export or submit a request with a tracked response deadline. The published support channel remains available where account access is not possible.

A person may complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) and, where EU or EEA law applies, to the competent local data-protection authority. Contact BrandMyHumanoid first where practical so the issue can be investigated promptly.

12. Security, changes, and versions

BrandMyHumanoid uses access controls, private storage, upload sanitization, webhook verification, audit trails, and payment-state reconciliation appropriate to the service. No system is completely secure; users should report suspected misuse through the published support channel and avoid sending secrets or raw payment data.

Material changes are published with a new version and communicated to affected account holders where required. The version accepted with a transaction remains recorded for contract and audit purposes.