revFADP, clause by clause.

Last updated: April 7, 2026

1. Applicable law

lynox AI is operated by Brandfusion Burlet, a Swiss sole proprietorship based in Rapperswil-Jona, Canton of St. Gallen, Switzerland. As a Swiss data controller, lynox AI is subject to the revised Federal Act on Data Protection (revDSG / revFADP), which entered into force on September 1, 2023, along with the Data Protection Ordinance (DSV/DPO) and the Ordinance on Data Protection Certifications (VDSZ/ODPC).

This page explains how lynox complies with Swiss data protection law. It supplements our Privacy Policy and Data Processing Agreement.

2. Data processing principles (Art. 6 revDSG)

All processing of personal data by lynox AI adheres to the following principles enshrined in Art. 6 revDSG:

• Lawfulness — Personal data is processed lawfully, based on consent, contract performance, legitimate interests, or legal obligation.
• Good faith — Processing is conducted in good faith and in a manner consistent with the reasonable expectations of data subjects.
• Proportionality — Only personal data that is necessary for the stated purpose is collected and processed. We do not collect data speculatively or in excess of what is required.
• Purpose limitation — Personal data is collected for specified, explicit purposes and is not further processed in a manner incompatible with those purposes.
• Accuracy — We take reasonable steps to ensure that personal data is accurate and, where necessary, kept up to date.
• Storage limitation — Personal data is retained only for as long as necessary for the purposes for which it was collected. See our Privacy Policy for specific retention periods.

3. Information duty (Art. 19 revDSG)

In compliance with the duty to inform under Art. 19 revDSG, we disclose the following:

Information	Details
Identity of the controller	Brandfusion Burlet (lynox AI), Rapperswil-Jona, Switzerland
Contact	[email protected]
Purpose of processing	Website operation, managed hosting provision, AI-assisted business services, billing, marketing (with consent)
Recipients	Sub-processors as listed in our DPA: Anthropic, Mistral AI, Stripe, Hetzner, Cloudflare, Plausible
Cross-border transfers	See Section 4 below

4. Cross-border data transfers (Art. 16-17 revDSG)

Under Art. 16(1) revDSG, personal data may be disclosed abroad if the Federal Council has determined that the legislation of the destination state or the international body ensures adequate protection. Under Art. 16(2) revDSG, where no adequacy decision exists, the disclosure must rely on appropriate safeguards (SCCs, BCRs, etc.); Art. 17 revDSG governs limited exceptions where neither adequacy nor safeguards are available.

Countries with adequate protection

The EU/EEA is recognized by the Swiss Federal Council as providing adequate data protection (Annex 1 DSV). Transfers to Hetzner (Germany) and Plausible (Estonia) are covered by this adequacy decision.

Transfers to the United States

Certain sub-processors are based in the United States (Anthropic, Stripe, Cloudflare). For these transfers, we rely on:

• Standard Contractual Clauses (SCCs) — EU Commission-approved SCCs (Decision 2021/914), recognized as appropriate safeguards under Art. 16(2)(d) revDSG, are incorporated into all relevant sub-processor agreements.
• Swiss-US Data Privacy Framework — Where the sub-processor is certified under the Swiss-US Data Privacy Framework (recognized by the Federal Council), transfers may additionally rely on this framework.
• Supplementary measures — Encryption in transit (TLS 1.3) and at rest (AES-256-GCM) is applied to all data subject to cross-border transfers.

Mistral AI: EU-based AI inference

AI inference runs by default through Anthropic (US) via its direct API under the safeguards described above, with Mistral AI serving as the worker/failover profile. Mistral AI is a France-based company operating its direct API within the EU, and any managed customer can select it in Settings as their main inference provider to keep primary inference within the EU — a manual choice, not an automatic or segment-based default. Data and container hosting remain in the EU (Hetzner, Germany) regardless of provider choice.

5. Data subject rights (Art. 25-29 revDSG)

Under the revDSG, data subjects have the following rights, which apply under Swiss data protection law:

• Right of access (Art. 25 revDSG) — You may request information about whether and what personal data we process about you, the purpose of processing, the retention period, the origin of the data, and any recipients.
• Right to data portability (Art. 28 revDSG) — You may request that your personal data be provided to you or to a third party in a commonly used electronic format.
• Right to rectification — You may request correction of inaccurate personal data.
• Right to deletion — You may request deletion of your personal data, subject to any legal retention obligations.
• Right to object — You may object to processing based on legitimate interests.

To exercise any of these rights, contact [email protected]. We will respond within 30 days as required by Art. 25(7) revDSG.

6. Professional secrecy (Art. 321 StGB)

Certain professions in Switzerland are subject to professional secrecy obligations under Art. 321 of the Swiss Criminal Code (StGB) — including lawyers (Anwälte), doctors (Ärzte), auditors (Revisoren), and fiduciaries (Treuhänder). For these professionals, the choice of AI infrastructure has particular legal significance:

• Self-hosted with EU-native models only — Data remains on your own infrastructure and you can restrict inference to EU-based providers (e.g. Mistral AI, local models), avoiding any transfer to US jurisdiction. Professionals subject to secrecy obligations should independently assess the suitability of any configuration with their own legal counsel — lynox does not warrant any configuration as sufficient for a specific secrecy duty.
• Managed Hosting — Isolated per-tenant container on a Hetzner tenant host (Germany); dedicated single-tenant VPS available as Enterprise option. Important: by default the main inference provider is Anthropic (US, covered by DPA and SCCs). A regulated professional who needs to keep inference within the EU must affirmatively select Mistral AI (France, EU) as their main provider in Settings, or self-host with EU-only models, or use the dedicated-VPS option — the EU-inference configuration is not a default and is not applied automatically. Container and data hosting are in the EU in all cases. lynox does not access conversation content in normal operations; narrow exception-based access applies only in response to abuse reports or legal requests (see our Privacy Policy).
• Anthropic direct API (US jurisdiction — the default) — By default, conversation data is transmitted to Anthropic's US infrastructure for inference. While covered by DPA and SCCs, this involves US jurisdiction. Because this is the default configuration, we recommend that professionals subject to Art. 321 StGB either switch the main provider to Mistral AI (EU) / self-host with EU-only models, or consult legal counsel, before relying on managed hosting.

lynox does not provide legal advice. Professionals subject to secrecy obligations should independently assess which configuration meets their regulatory requirements.

7. Supervisory authority

The competent supervisory authority for data protection in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC / EDÖB):

Eidgenössischer Datenschutz- und Öffentlichkeitsbeauftragter (EDÖB)
Feldeggweg 1
3003 Bern
Switzerland
www.edoeb.admin.ch

Data subjects have the right to lodge a complaint with the FDPIC if they believe their data protection rights have been violated.

8. Technical and organizational measures

In accordance with Art. 8 revDSG and Art. 1-4 DSV, we implement appropriate technical and organizational measures to ensure a level of security appropriate to the risk. Details of these measures are described in the security annex of our Data Processing Agreement.

9. Contact

For all questions regarding data protection under Swiss law:
[email protected]

Brandfusion Burlet (lynox AI)
Rapperswil-Jona, Switzerland