Privacy policy

1. Controller

ai-zone.ch - Sutter, Bühlplatz 3, 3012 Bern, Schweiz · E-mail: · UID: CHE-193.917.978. You can send data protection requests to this e-mail address.

2. Allocation of roles between Clavanza and hosts

Clavanza is responsible in particular for data relating to host accounts, platform commissions, its own security measures, misuse prevention, support requests, fee calculator sign-ups and its own operating logs.

As a rule, the host with whom you make an enquiry or booking is responsible for your guest and booking data. Where Clavanza processes such data for enquiries, bookings, communication, payment and the stay on the host's instructions, Clavanza acts as a processor. Where Clavanza processes data for its own security, statutory obligations, commission settlement or the enforcement of rights, it does so as a controller in its own right.

3. Categories of personal data processed

Depending on your use, we process in particular:

• •master and contact data, namely name, address, e-mail address and telephone number;
• •account and registration data, namely user account, password hash, roles, permissions and records of consent;
• •contract and transaction data, namely booking references, travel period, number of guests, accommodation, prices, commission amounts, payment status, cancellations and refunds;
• •communication data from enquiries, support cases and system-related messages;
• •listing data, namely property details, texts, images, prices, availability and house rules;
• •technical data, namely IP address, device and browser information, times of access, content accessed, error and security logs;
• •consent and preference data, namely cookie settings and newsletter or fee calculator sign-ups;
• •inputs in the fee calculator, namely nightly price, length of stay, cleaning fee, assumed number of bookings and selected comparison channels;
• •content and reports submitted voluntarily.

Complete card and bank account details are processed directly by Stripe and do not reach the servers of Clavanza.

4. Origin of your data

We receive data directly from you, from hosts in the course of managing accommodation, from your use of the platform and the technical logs generated in the process, from Stripe and other service providers insofar as this is necessary for payment status, identity verification, security or troubleshooting, and from publicly accessible registers insofar as this is necessary and permissible for identity, eligibility or misuse checks.

5. Purposes of processing

We process your personal data in particular for the following purposes:

• •provision, operation and further development of the platform;
• •registration, authentication and administration of your host account;
• •presentation and administration of listings;
• •technical handling of enquiries, bookings, payments, cancellations and refunds;
• •communication with hosts, guests and interested parties;
• •commission settlement, accounting and compliance with statutory retention obligations;
• •ensuring IT security, misuse prevention and error analysis;
• •handling of support requests and legal claims;
• •audience measurement and improvement of the website, where your required consent has been given;
• •sending the newsletter for hosts, if you have subscribed to it;
• •operating our pages on Facebook and Instagram and advertising for Clavanza and for properties on Clavanza;
• •translation and technical support for listing content;
• •compliance with statutory and regulatory obligations.

6. Legal bases for processing

Where a specific legal basis is required, we base processing on the initiation and performance of contracts, statutory obligations, your consent and overriding private or public interests, in particular in the secure and economic operation of the platform, the prevention of misuse and the enforcement of rights. You can withdraw your consent at any time with effect for the future.

7. Recipients and service providers

We only disclose your personal data insofar as this is necessary for the purposes described, required by law or permitted by you.

The recipients and service providers used include in particular:

• •Infomaniak Network SA, Switzerland, for hosting and backups;
• •Stripe, depending on the specific payment and Connect configuration in Switzerland, the European Economic Area and/or the USA, for payment processing, identity verification, fraud prevention and optional Stripe services such as “Link”;
• •Resend, USA, for sending transactional and informational e-mails;
• •Google, in particular Google Analytics 4 and Google Maps Platform, USA, for audience measurement exclusively after your consent and for the map in the catalogue and the location map on the property pages only after your express activation, respectively; when a map is loaded, Google receives your IP address, technical information about your browser and the map section displayed;
• •Anthropic, USA, exclusively via a business API or enterprise account for expressly triggered translation and content functions, for the automatic translation of published reviews and, only after documented approval, for certain pseudonymised technical analysis purposes;
• •Have I Been Pwned for the data-minimising check of new passwords against known data breaches;
• •Meta Platforms Ireland Limited, Ireland, for our pages and our advertising on Facebook and Instagram (section 13);
• •Zernio Software SL, Spain, for creating and managing our ads on Facebook and Instagram (section 13);
• •authorities, courts and legal advisers insofar as this is required by law or necessary for the enforcement of rights.

Service providers are classified according to their actual role as processors, independent controllers or joint controllers. The mere designation as a service provider does not in every case mean a relationship of instruction.

8. Payment processing and Stripe Link

Payments are processed via Stripe. In doing so, the booking reference, amount, currency, e-mail address, payment status and other required information in particular are transmitted. Complete card and bank details are collected directly by Stripe.

Stripe may offer you the “Link” feature, with which you can store and reuse payment and contact details in your own Stripe account. Stripe is responsible for this optional cross-account feature in accordance with its privacy information. Clavanza does not decide on storage in your Stripe Link account and has no access to the complete payment information stored there.

9. Artificial intelligence and automated checks

Language or image models may be used for certain functions. Listing texts, the free texts of the arrival information and images are transmitted only if you as a host trigger the function or use a clearly designated platform function. Published guest reviews are automatically translated into the languages of the respective website; only the text of the review and the host's reply are transmitted, without names, booking details or ratings, and the original remains available alongside the translation. Beyond this, guest, payment, account, contact, contract or confidential data is not transmitted to model providers. For this purpose, Clavanza exclusively uses a business API or enterprise account whose contractual terms exclude the use of the transmitted content for training general models.

Automated checks may generate notes on breaches, quality problems or patterns of misuse. They do not lead to blocking, removal, a contractual measure, or a pricing or payment decision without human review. No exclusively automated individual decisions are taken that have significant legal effects for you.

10. Disclosure abroad

The following disclosures abroad may take place: Stripe, depending on the entity used and the Connect configuration, to the European Economic Area and/or the USA; Resend to the USA; Google, where Google services are activated, to the USA; Anthropic, where content functions are activated, for the translation of published reviews or for approved technical analysis, to the USA. For our pages and ads on Facebook and Instagram, Meta processes data in Ireland and the USA, and Zernio in Spain, the United Kingdom and, for logs, the USA. Infomaniak processes the data intended for this in Switzerland.

For disclosures to the USA, Clavanza ensures before activating the respective data flow that the specific transfer is legally permissible. Where a recipient is certified under the Swiss-U.S. Data Privacy Framework for the relevant processing, this basis may be used; otherwise, recognised standard data protection clauses and the necessary additional safeguards are agreed. For Anthropic, the data categories, purpose, sub-processors, deletion periods and the contractual no-training provision are also documented. Pseudonymised data remains personal data as long as it can be attributed with reasonable effort.

11. Cookies and analytics

We use technically necessary cookies for sign-in, security, session management and storing your cookie selection. Optional analytics cookies and Google Analytics 4 are only loaded after your express consent. You can withdraw your consent or give it again at any time via the “Cookie settings” link available on every page. Personal payment links, guest portals and comparable sensitive pages do not, as a rule, load any analytics scripts. Further details can be found in the cookie policy.

12. Fee calculator and newsletter for hosts

You can use the fee calculator without registering and without providing an e-mail address. If you use “Report a figure” to report information you consider incorrect, we process your report and, if you provide it, your e-mail address in order to look into the report and to be able to reply to you.

You only receive the newsletter for hosts if you have subscribed to it: when registering, under “My account” or via a sign-up field on our website. For this we process your e-mail address, your language and the time and source of your consent. A sign-up without a user account is verified via a confirmation link; without confirmation nothing is sent. The newsletter is sent via our service provider Resend. The links carry a marker that allows the reach measurement, if you have consented to it, to recognise that a visit came from the newsletter.

You can withdraw your consent at any time, via the link in every newsletter e-mail or under “My account”. If a newsletter e-mail cannot be delivered permanently or you report it as spam, we stop sending to that address on our own initiative. We keep the information on consent and withdrawal as evidence insofar as this is necessary to safeguard our rights.

13. Facebook and Instagram

Clavanza has a page on Facebook (facebook.com/clavanza.ch) and a profile on Instagram (instagram.com/clavanza.ch). For people in Switzerland and the European Economic Area, both services are provided by Meta Platforms Ireland Limited, Merrion Road, Dublin 4, Ireland. When you visit these pages, follow us there or react to a post, Meta processes your data under its own privacy policy and on its own responsibility, including in the USA. We have no influence over this.

Meta provides us with statistics about these pages, for example how many people visited them or saw a post (Page Insights). We only receive them in aggregated form and cannot attribute them to any individual. We are jointly responsible with Meta for the processing from which these statistics arise. In an agreement with page operators, Meta has assumed primary responsibility for this processing, including for handling your rights. You can therefore contact Meta directly. If such a request reaches us, we forward it to Meta.

If you send us a message or a comment via Facebook or Instagram, we process the name displayed there and the content in order to reply to you. Please send confidential information, for example about a booking or a payment, by e-mail instead.

We advertise on Facebook and Instagram for Clavanza and for properties on Clavanza. For this purpose, we transmit to Meta the ads with text and image as well as the target area, language, budget and duration. We only use photos and details from a listing with the host's consent. The ads are created and managed via our service provider Zernio Software SL, Spain. Meta decides who is shown an ad on the basis of the target area and language and the data Meta itself holds about its users. We do not pass on any data of visitors to our website to Meta: we use neither the Meta pixel nor any other Meta tools on our website and do not upload any lists of customers or prospects to Meta.

If one of our ads or another tagged link brings you to our website, the address contains a campaign tag (UTM parameters). If you then register as a host, we store this tag with your account, together with the time of registration and of the first approval. This shows us which advertising leads to new hosts. We do not set a cookie for this. Google Analytics 4 only evaluates the tag if you have consented to audience measurement.

On our website, Facebook and Instagram are only linked. We do not embed any content, buttons or scripts from Meta. Data only reaches Meta if you follow such a link.

• •Meta Privacy Policy
• •Instagram Privacy Policy
• •Page Insights Controller Addendum

14. Retention and deletion

We retain your data for as long as is necessary for the respective purposes. Booking, invoice, payment and commission records are, as a rule, retained for ten years from the end of the relevant financial year.

Your host account can initially be deactivated on request. Final deletion or anonymisation takes place as soon as no ongoing bookings, outstanding claims, statutory retention obligations or overriding interests in the enforcement of rights stand in the way. Security-relevant server logs are, as a rule, deleted after 90 days unless a security incident, suspected misuse or a legal claim requires longer retention. Backups are overwritten in the regular cycle; selective early deletion from immutable backups may be technically impossible.

We record changes made in the administration area in a change log (who, when, what, with the previous and the new value), as well as operations that an AI carries out or proposes in the system. The log serves traceability and the clarification of discrepancies, is accessible only to the operator of the platform and is retained for ten years. Passwords, access codes and guests' contact details are not stored in it in plain text.

15. Data security

We take appropriate technical and organisational measures against loss, unauthorised processing, alteration, disclosure and access. These include encrypted transmission, access restrictions, role-based permissions, secure password storage, logging of security-relevant events, data backups and protection against automated attacks. Absolute security can nevertheless not be guaranteed.

16. Data security breaches

Data security breaches are assessed in accordance with a documented procedure. Where Clavanza acts as a processor, it informs the responsible host without delay. Where there is a statutory reporting obligation, the report to the Federal Data Protection and Information Commissioner or the information of the data subjects takes place in accordance with the applicable provisions.

17. Your rights

Within the scope of applicable law, you can in particular:

• •request information about your personal data being processed;
• •have inaccurate or incomplete data rectified;
• •request the deletion or anonymisation of your data;
• •request the release of certain data in a common electronic format;
• •object to processing;
• •withdraw a consent given with effect for the future;
• •request a human review of an automated individual decision, should one exceptionally take place.

Your rights may be restricted or deferred where statutory obligations, overriding interests of third parties or our own overriding interests stand in the way. To prevent unauthorised disclosure of information, we may request suitable proof of identity. If your request concerns guest or booking data, your host is, as a rule, responsible; Clavanza assists the host in handling it.

18. Complaints

If you have questions or complaints, you can first contact ai-zone.ch - Sutter. You can also contact the Federal Data Protection and Information Commissioner.

19. Changes to this privacy policy

We may amend this privacy policy if processing activities, technical systems, service providers or legal requirements change. The current version is published on the platform. We will inform you in an appropriate manner of material changes that directly affect you as a registered host.