Privacy policy.

1. Controller

ailean Real Estate Technologies AG, Kuttelgasse 7, 8001 Zurich, Switzerland. UID CHE 415.801.057. Contact for data protection enquiries: via our appointment page.

2. What data we process

We process data you actively provide to us (for example in a contact request, when signing up for the investor update, in a job application or when using the live demo) and data that arises technically when you visit our website (IP address, browser type, time of access).

If you reach our website through a link that carries a campaign tag, for example from one of our ads on LinkedIn or Google, your browser remembers that tag (source, medium, campaign and ad content) for the current session only. If you then book an appointment, we receive it together with your booking so that we can see which campaign brought you to us. If you arrive through a Google ad, this includes its click ID (gclid, gbraid or wbraid). The tag contains neither your name nor your contact details and is not sent to us unless you book. Also for the current session only, your browser remembers the first page you opened on our site and the name of the website that brought you to us (for example www.google.com). We receive these details only together with a booking as well. So that a calendar invitation does not go astray, we check through the Cloudflare DNS service, or Google as a fallback, whether the domain of your email address can receive email when you book; only the domain is looked up, never your address.

Documents in the templates and calculators are created in your browser. Form entries are not sent to our server; they are temporarily kept in browser storage when switching language. The letterhead (company, address, contact and optional logo) stays in local storage on this device until you remove it with “Delete data”. When company search is enabled, the search term from the company or landlord field is sent through our server to the Zefix commercial register to complete the company address. We store neither the search term nor the search result.

3. Purpose of processing

Processing takes place to answer your enquiry, to deliver our contractual services, to ensure the secure operation of our website and to fulfil legal obligations.

4. Legal basis

Processing is based on your consent, a contract with you, or our legitimate interests. For users in the EU we additionally rely on Art. 6 GDPR. Where the revFADP and the GDPR differ, we apply the stricter level of protection.

5. Hosting and storage location

The ailean platform runs on Microsoft Azure in the "Switzerland North" region (Zurich area) with geo redundancy in "Switzerland West" (Geneva area). Our customers' tenant and property data is stored in Switzerland; transmission and storage are encrypted (in transit and at rest). For individual processing steps we use contractually bound service providers (section 6).

6. Service providers (sub processors)

We only pass on data where this is necessary to deliver our services, where you have consented, or where we are legally obliged to. We do not sell data. Every service provider is bound by a data processing agreement. The main services used:

• Microsoft Azure (cloud infrastructure, Switzerland; ISO 27001/27017/27018, SOC 1/2/3)
• Supabase (product database, EU)
• n8n, self hosted (workflow automation, Germany/EU)
• OpenAI (AI inference, EU/USA; enterprise API with zero data retention, no training on ailean inputs)
• Meta / WhatsApp Business API (tenant channel, EU/USA)
• Twilio (SMS/telephony, USA/EU; being replaced by self hosted 3CX in Switzerland)
• Resend, Cloudflare, Railway (email delivery, CDN/security, app hosting, USA/EU)
• Stripe (payment processing, EU; PCI DSS Level 1)
• Google Workspace (internal collaboration, incl. job applications, EU/USA)
• VideoAsk by Typeform (video applications, EU/USA; loaded on the careers page only after your separate choice)
• Run my Accounts AG (accounting, Switzerland)

The complete, continuously updated sub processor list forms part of our data processing agreement and is made available to customers on request. Customers are informed of changes in advance and have a right to object.

7. Disclosure abroad

Where processing takes place outside Switzerland or the EU/EEA (in particular the USA), we rely on the requirements of Art. 16 et seq. revFADP and Art. 44 et seq. GDPR: the Swiss US Data Privacy Framework where the recipient is certified, or the EU Standard Contractual Clauses (SCC 2021/914) with the Swiss annex, supplemented by technical safeguards and a documented transfer impact assessment. If a transfer basis ceases to apply, we inform affected customers without delay.

8. Processing on behalf of property management companies

Where ailean processes tenant data within the platform, ailean acts as a processor on behalf of the respective property management company; the controller within the meaning of data protection law (Art. 5 revFADP, Art. 4 GDPR) is the property management company. The basis is a data processing agreement (DPA) under Art. 9 revFADP and Art. 28 GDPR with instruction rights, confidentiality obligations and technical and organisational measures.

If tenants address data protection requests directly to ailean, we forward them to the responsible property management company without delay. We report data breaches to our customers within 48 hours of becoming aware of them. After the end of the contract, personal data is returned or deleted at the customer's choice without instruction, at the latest after 30 days.

9. Artificial intelligence and data protection

ailean does not use customer data (inputs and outputs) to train or fine tune AI models; for model improvements we use exclusively irreversibly anonymised or aggregated data with no personal reference. The integrated language model (OpenAI) is operated via the enterprise API with zero data retention and is contractually excluded from training on ailean inputs. Customers and data subjects in any case have a right to object (opt out) exercisable at any time.

10. Your rights

You have the right to access, rectification, erasure, restriction of processing and data portability. You may withdraw your consent at any time and lodge a complaint with the competent supervisory authority (in Switzerland: the Federal Data Protection and Information Commissioner, FDPIC).

11. Cookies and tracking

Technically necessary settings (such as language preferences and your cookie choice) remain locally in your browser and are not transmitted to us. In addition, we use Google Analytics 4 and Google Ads (both Google Ireland Limited, Ireland) and, on general B2B pages, the LinkedIn Insight Tag (LinkedIn Ireland Unlimited Company, Ireland) for audience and campaign measurement.

Google Analytics is only activated after you have given explicit consent in the cookie notice (Google Consent Mode v2, default setting «denied»). Without consent, no analytics cookies are set and no data identifying you is transmitted to Google. If you consent, Google processes usage data (including a truncated IP address, device and browser information, and pages viewed) for audience measurement; this may involve a transfer to the USA, based on the EU Standard Contractual Clauses or the Data Privacy Framework (see section 7).

Independently of the cookie notice, we measure on our servers how our outreach performs (for example emails, letters and LinkedIn messages sent, personal booking links opened and booked, replies and meetings) and send these counts to Google Analytics via the Measurement Protocol. Only the event type, campaign, channel, text variant, time and, where applicable, cost are transmitted, but no names, email or IP addresses, no CRM identifiers and no identifier assigned to an individual person. Google therefore receives no information that can be related to you. Opening a booking page sets no cookie and loads no Google script for this purpose. The legal basis is our legitimate interest in measuring our campaigns (Art. 6(1)(f) GDPR, Art. 31 revFADP).

If we contact you by email, letter, LinkedIn or phone, you receive a personal booking link that is assigned to you and to that contact. If you open it, we record in our CRM (Bitrix24) that and when you opened it, how often, which contact it belongs to and whether you booked an appointment through it. So that checks by your company’s mail server do not count as your own opening, our booking service classifies each request by network operator, browser identifier and time since sending; only this classification is stored, for automated checks also the name of the checking network, but no IP address. No cookie is set and no third party script is loaded for this; nothing that can be related to you is sent to Google Analytics. So that you can return to the booking page later without the link, your browser keeps your personal booking link in local storage on this device for up to 30 days; once the link has expired or been revoked, it is deleted there. The legal basis is our legitimate interest in targeted and restrained outreach (Art. 6(1)(f) GDPR, Art. 31 revFADP). If you object to our outreach, we no longer record openings either.

Links we share in outreach messages, posts, ads or printed material run through our own domain (ailean.re/t/…), without a third party link shortening service. Personal links contain your first and last name and a random ending so that they cannot be guessed, and they are assigned to you; when you open one, we record this in our CRM as described above. For every link we also count visits per day, separating people from automated checks by mail and chat systems, as well as by country, device type (computer, phone, tablet) and referrer. Of the referring page we store only the domain, or the note «QR code» if the link came from one of our QR codes. To tell different visitors on the same day apart, our web server at Cloudflare derives an encrypted identifier from the IP address, browser identifier and date; it changes every day and cannot be traced back to the IP address. We neither pass on nor store the IP address itself. No cookie is set and no third party script is loaded. The counts are kept on our own servers at Hetzner in Germany and are not passed to advertising or analytics providers. The legal basis is our legitimate interest in measuring our outreach and campaigns (Art. 6(1)(f) GDPR, Art. 31 revFADP).

If you reach ailean.re, demo.ailean.re or kpi.ailean.re through a personal link from one of our outreach messages and accept in the cookie notice, we connect your visit to your contact record. For this, your browser keeps a random visitor ID in local storage. We record which pages you open, how long you are active on them, how far you scroll, which links and buttons you click, how much of a video or audio you play, whether you use the calculator or a template (only that you do, never what you enter) and how far you get with booking an appointment. If you move between these sites with your consent, we pass the visitor ID along in the address fragment (#); the other site only takes it over once you consent there as well. We do not record form entries, query parameters, mouse movements or screen recordings. The data stays on our own servers at Hetzner in Germany and is not passed to advertising or analytics providers. We keep a summary of your visits (for example how often and when, which topics and how far a booking got) in our CRM (Bitrix24) so that any further contact from us matches your interest; this summary remains part of your contact history. We delete the individual events after twelve months. The legal basis is your consent (Art. 6(1)(a) GDPR, Art. 31 revFADP). If you decline or withdraw your consent, the visitor ID is deleted and nothing further is recorded. Without a personal link, your visit is not connected to anyone.

By way of exception, for visitors from Switzerland and Liechtenstein (country as reported by the network provider, no IP address stored): if you arrive through your personal link, we record your visit as described above from the moment you arrive, even without prior consent. The legal basis is our legitimate interest in matching our outreach to your actual interest (Art. 31 revFADP). You can object at any time, with «Decline» in the cookie notice or via change cookie settings; the identifier is then blocked and deleted and we record nothing further. Google Analytics, Google Ads and the LinkedIn Insight Tag are still loaded only with your consent.

The LinkedIn Insight Tag also loads only after your explicit consent. LinkedIn processes the URL visited, referrer, IP address, device and browser characteristics, and timestamp to attribute campaign results, produce audience statistics and create website audiences. The tag is technically disabled on our appointment pages and personalised client pages. Enhanced Matching is not configured; names, email addresses and other identifiers entered by you are not passed to the tag. Data may be transferred to the USA (see section 7).

Google Ads (Conversion Tracking), provided by Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland (parent company: Google LLC, USA), relies on the same consent as Google Analytics: it loads only after you have given explicit consent in the cookie notice (Google Consent Mode v2, default setting «denied»). We use it to measure whether visitors who reach our website through one of our Google ads go on to book an appointment, and to optimise our campaigns accordingly. Google processes cookies and similar identifiers, the ad click ID (gclid, gbraid or wbraid), the pages viewed, the completed booking as a conversion, your IP address, which Google truncates, and device and browser information.

The legal basis is your consent (Art. 6(1)(a) GDPR, Art. 31 revFADP), which you can withdraw at any time (see below). Data may be transferred to the USA under the Data Privacy Framework between the EU or Switzerland and the USA and the EU Standard Contractual Clauses (see section 7). Google determines the retention period; conversion cookies are usually kept for no more than 90 days. For more information, see Google’s privacy policy; you can manage personalised advertising in Google’s ad settings. If you book an appointment, we also store the click ID and campaign tags with your booking in our CRM (Bitrix24) so that we can attribute the appointment to the right campaign (see section 2). If a booking results from a Google ad, we also report the click ID back to Google Ads together with the outcome, that is whether an appointment was booked and whether it later led to a customer relationship, each with its date. We do not transmit your name, email address or other contact details. This lets us measure which campaigns lead to conversations and customers. The legal basis is our legitimate interest in measuring the effectiveness of our advertising (Art. 6(1)(f) GDPR, Art. 31 revFADP); you can object at any time (see below).

Your consent is voluntary and can be withdrawn at any time with effect for the future: change cookie settings. The legal basis is your consent (Art. 6(1)(a) GDPR, Art. 31 revFADP).

On the careers page, VideoAsk loads only after you choose the button that opens it. Only then does your browser connect to VideoAsk and transmit the technical connection data required for the service. Camera, microphone and optional screen sharing are used only after browser permission and only within the application dialog. The legal basis is your separate consent.

12. Security

We implement the technical and organisational measures required under Art. 8 revFADP and Art. 32 GDPR: encryption in transit and at rest, multi factor authentication, role based need to know access, tenant separation, logging, and backup and contingency concepts. Details of our security architecture can be found under Security.

13. Changes

We may amend this privacy policy at any time. The current version is always available on this page.

Version: 6 November 2026.