Software privacy policy
Version 1.0 · Effective 24 June 2026 · Last updated 24 June 2026
This is the version the panel ships today, under Settings → Legal.
AI Admin Panel — Privacy Policy
Controller: 23 Investments GmbH, Aeschstrasse 4, CH-8834 Schindellegi, Switzerland ("23 Investments", "we", "us", or "our")
Privacy contact: [email protected]
Version: 1.0 · Effective date: 24 June 2026 · Last updated: 24 June 2026
This Privacy Policy explains how 23 Investments GmbH processes personal data in connection with AI Admin Panel ("AAP"), including our website, the self-hosted software (license validation and telemetry, support), and the managed cloud Service. It is written to address both the revised Swiss Federal Act on Data Protection (FADP/nFADP) and, where applicable, the EU General Data Protection Regulation (GDPR).
Controller vs. processor. For some processing we are the controller (we decide why and how data is processed) — for example, your account, billing, telemetry, and website data. For the personal data your organization manages about its own End Customers within the cloud Service, you are the controller and we act as your processor; that processing is governed by the Data Processing Agreement, not this Policy.
1. Who we are and how to contact us
23 Investments GmbH is the controller for the processing described in this Policy. Contact us at [email protected] (or [email protected] for data-protection matters) or by post at the address above.
2. The personal data we process
Depending on how you interact with us, we may process:
- Account and identity data — name, business name, email, username, role, and authentication identifiers (managed via our identity system, Zitadel).
- Billing and transaction data — billing contact, address, tax identifiers, plan, and payment status. Card details are processed by our payment processor (Stripe); we do not store full card numbers.
- Self-hosted telemetry and license data — instance identifier, License Key, software version, operating-system and server characteristics, and aggregate usage counts (for example, number of managed customers and services, template-usage counts, uptime). See the EULA, Section 2.2.
- Service usage and log data — IP address, device and browser information, timestamps, actions taken in the panel, API requests, and diagnostic logs.
- Support and communications data — the content of your messages, support tickets, and any live-chat interactions.
- AI feature data — prompts, inputs, configuration, and related metadata processed to provide the AI Features; see Section 7.
- Website and marketing data — cookies and similar technologies (see the Cookie Policy), newsletter subscriptions, and event/webinar registrations.
We generally collect personal data directly from you or automatically through your use of AAP. We may also receive data from our infrastructure, payment, and analytics providers.
3. Why we process it and our legal bases
| Purpose | Examples | Legal basis (GDPR) |
|---|---|---|
| Provide and operate AAP | Account creation, provisioning, license validation, delivering features | Performance of a contract (Art. 6(1)(b)) |
| Billing and payments | Charging fees, invoicing, fraud prevention | Contract (Art. 6(1)(b)); legal obligation (Art. 6(1)(c)) |
| Security and abuse prevention | Telemetry, logging, detecting misuse, enforcing the AUP | Legitimate interests (Art. 6(1)(f)); legal obligation |
| Support | Responding to tickets and chat | Contract; legitimate interests |
| Product improvement | Aggregate/anonymized usage analysis | Legitimate interests (Art. 6(1)(f)) |
| Communications and marketing | Service notices; newsletters where you opted in | Legitimate interests; consent (Art. 6(1)(a)) for marketing |
| Legal compliance | Tax records, responding to lawful requests | Legal obligation (Art. 6(1)(c)) |
Under the FADP we rely on the corresponding justifications (contract performance, overriding legitimate interests, legal obligation, or consent). Where we rely on consent, you may withdraw it at any time.
4. Sharing and sub-processors
We share personal data with:
- Service providers / sub-processors that help us run AAP (hosting, payments, communications, analytics, AI providers). A current list is in the Sub-processors document.
- AI providers you connect to deliver AI Features — these are engaged by you under your own provider relationship and are not our sub-processors (see Section 7).
- Professional advisers, auditors, and authorities where necessary for legal compliance or to establish, exercise, or defend legal claims.
- Successors in the context of a merger, acquisition, or reorganization, subject to this Policy.
We do not sell personal data.
5. International transfers
We are based in Switzerland. Where we transfer personal data outside Switzerland or the EEA — including to providers in the United States — we rely on appropriate safeguards, such as the European Commission's Standard Contractual Clauses (SCCs) with the Swiss addendum / FDPIC-recognized amendments, transfers to countries with an adequacy decision, or other lawful transfer mechanisms (which may include the EU–US and Swiss–US Data Privacy Frameworks where a provider is certified). You may request a copy of the relevant safeguards by contacting [email protected].
6. Retention
We keep personal data only as long as necessary for the purposes above, including the life of your account plus any period required for legal, tax, accounting, or dispute-resolution purposes. For the cloud Service, Customer Data is handled per the data-export and deletion process in the Terms of Service (Section 6.4) and the DPA. Aggregated or anonymized data that no longer identifies you may be retained indefinitely.
7. AI Features and third-party models
AAP's AI Features let you connect AI models you choose and control — a third-party AI provider you configure (such as Anthropic, OpenAI, or OpenRouter), models you run locally, or your hosting provider's inference/GPU API. 23 Investments does not provide any AI model of its own and does not train, or use your data to train, any AI model. When you use an AI Feature, the inputs and context you submit are transmitted to the provider you have selected and are processed under your relationship with that provider (or, for local models, within your own environment); these AI providers are your providers, not sub-processors of 23 Investments. We recommend choosing providers that offer confidentiality and no-training commitments for API data. This keeps your AI usage sovereign — you decide which provider processes your data and where.
8. Your rights
Subject to applicable law (GDPR and/or FADP), you have the right to:
- access the personal data we hold about you and obtain a copy;
- rectify inaccurate or incomplete data;
- erase data ("right to be forgotten") in certain circumstances;
- restrict or object to certain processing, including direct marketing;
- data portability for data you provided, where applicable;
- withdraw consent at any time where processing is based on consent; and
- lodge a complaint with a supervisory authority.
To exercise your rights, contact [email protected]. We may need to verify your identity. We will respond within the timeframes required by law. Exercising certain rights may delay or limit the availability of some services (for example, support that requires the data).
Supervisory authorities. In Switzerland, the Federal Data Protection and Information Commissioner (FDPIC) — https://www.edoeb.admin.ch. In the EU/EEA, your local data-protection authority.
9. Security
We implement technical and organizational measures appropriate to the risk, including encryption in transit and at rest, per-instance isolation, access controls, audit logging, and key management. No system is perfectly secure; we cannot guarantee absolute security. A summary of security measures for cloud processing on your behalf is set out in the DPA.
10. Cookies and similar technologies
Our website and panel use cookies and similar technologies as described in the Cookie Policy, subject to your consent where required.
11. Children
AAP is a business product not directed to children. We do not knowingly process the personal data of children in a manner requiring consent. If you believe a child's data has been provided to us, contact [email protected].
12. Changes to this Policy
We may update this Policy from time to time. We will post the updated version with a new "last updated" date and, for material changes, provide additional notice where required by law.
13. Contact
23 Investments GmbH, Aeschstrasse 4, CH-8834 Schindellegi, Switzerland · [email protected] · https://www.aiadminpanel.com.