Privacy Policy

1. Who we are

SafeSignal is operated as a Swiss sole proprietorship (Einzelunternehmen):

SafeSignal
Owner (Inhaber): József András Ujvári
Solarstrasse 7, 8404 Winterthur, Switzerland
contact@safesignal.ch

We are the data controller for personal data processed through safesignal.ch and the scan@mail.safesignal.ch scanning service, within the meaning of the Swiss Federal Act on Data Protection (nDSG) and, where applicable, the EU General Data Protection Regulation (GDPR).

2. What the service does

SafeSignal lets you forward a suspicious email to scan@mail.safesignal.ch. Our system analyses the forwarded message and replies to you with a verdict (safe, suspicious, or scam), an explanation, and recommended actions. There are no user accounts, no logins, and no subscriptions — only optional one-time purchases of scan credits.

3. What data we process

3.1 Forwarded emails

When you forward an email for scanning, we process the full content of that message: subject, body text, links, sender information from the forwarded content, and any attachments (such as PDFs and images, which are analysed for scam signals). Forwarded emails can contain any kind of personal data — about you or about third parties such as the original sender. Please only forward emails from your own inbox.

The content of a forwarded email is processed to produce your verdict and is not kept in a database of ours afterwards. Our service providers may retain data for limited periods under their own policies (see section 5).

3.2 Your email address

We process the email address you send scans from in order to: reply with your verdict, count your free scans (3 per calendar month, tracked per address), and manage any scan credits you have purchased. Credit balances and monthly usage counters are stored, keyed to your email address, in our infrastructure provider's storage (Cloudflare KV).

3.3 Payment data

Scan credit purchases are handled entirely by Stripe. We never see or store card numbers. From Stripe we receive your email address, the product purchased, and a transaction reference, which we use to add credits to your address and send a confirmation email.

3.4 Technical data

Our website and email routing run on Cloudflare's network, which automatically processes standard technical data (such as IP addresses and request metadata) for security and delivery. We do not use analytics tools, advertising trackers, or profiling.

4. How we use your data

• Delivering the scan: analysing the forwarded email and sending you the verdict.
• Quota and credits: counting free scans and managing purchased credits.
• Payments: confirming purchases made through Stripe.
• Security and abuse prevention: keeping the service running and preventing misuse.
• Legal obligations: keeping accounting records where required by Swiss law.

We do not sell your personal data, we do not use it for advertising, and we do not use it to train AI models.

5. Service providers and international transfers

To operate SafeSignal we use the following providers. This means your data — including the content of forwarded emails — is processed outside Switzerland, including in the United States:

• Cloudflare, Inc. (USA, global network): website hosting, email routing, serverless processing, and storage of credit/quota records. Data may be processed at data centres worldwide.
• Anthropic, PBC (USA): the AI analysis of your forwarded email, including attachment content, is performed via Anthropic's API to produce your verdict.
• Resend (USA): sends the verdict and purchase confirmation emails to you.
• Stripe (USA/Ireland): payment processing for scan credit purchases.
• Google Fonts (Google LLC, USA): this website loads fonts from Google's servers, which involves transmitting your IP address to Google.

Each of these providers publishes data-processing commitments, and transfers out of Switzerland and the EEA rely on the safeguards those providers offer (such as EU standard contractual clauses in their data processing terms). You can review their privacy policies on their respective websites.

6. Legal basis for processing

• Performance of a contract / requested service: when you forward an email, you are requesting a scan; we process your data to deliver it (Art. 6(1)(b) GDPR).
• Legitimate interests: service security, abuse prevention, and basic operations (Art. 6(1)(f) GDPR).
• Legal obligation: retention of accounting records (Art. 6(1)(c) GDPR; Swiss Code of Obligations).

7. Data retention

• Forwarded email content is processed to produce your verdict and is not stored in our own systems afterwards.
• Credit balances and monthly free-scan counters are kept while they are needed to provide the service. You can request deletion at any time; note that deleting a credit record forfeits remaining credits.
• Billing records are retained for 10 years as required by Swiss accounting law (Art. 958f Swiss Code of Obligations).

8. Your rights

Under the nDSG and, where applicable, the GDPR, you have the right to request access to, correction of, or deletion of your personal data, to receive it in a portable format, and to object to or restrict certain processing. To exercise any right, email contact@safesignal.ch. We may ask you to verify that you control the email address concerned.

You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch) or, if you are in the EEA, with your local supervisory authority.

9. Security

Connections to our website and email infrastructure are encrypted in transit (TLS). Data stored with our infrastructure provider is encrypted at rest by that provider. Access to our systems is restricted to the operator. No internet service can guarantee absolute security; please do not forward emails containing highly sensitive data (such as passport scans or banking credentials) unless you accept the processing described in this policy.

10. Cookies

We do not set our own cookies and use no analytics or advertising cookies. Our infrastructure provider (Cloudflare) may set strictly necessary cookies for security purposes.

11. Children's privacy

SafeSignal is not directed at children under 16, and we do not knowingly process their data. If you believe a minor's data has been processed, contact us and we will delete it.

12. Changes to this policy

We may update this policy from time to time. The current version, with its "Last updated" date, is always available on this page.

13. Contact