Cleverdist Privacy Policy

Last updated 4 November 2026 | Effective 6 November 2026

1 Who we are

Cleverdist SA is the controller of the personal data described in this Privacy Policy. Our address is Route de la Galaise 34, 1228 Plan-les-Ouates, Geneva, Switzerland. You can contact us about privacy, your personal data or your rights at info@cleverdist.com.

This policy explains how we collect, use, store, disclose and otherwise process personal data in connection with our website, enquiries, business relationships, professional prospect research, marketing and internal AI-assisted activities. Personal data is information relating to an identified or identifiable person. Professional contact details and information about a person’s role within a company can be personal data; information relating only to a legal entity is not necessarily personal data.

We apply the Swiss Federal Act on Data Protection and other applicable Swiss law. Where our activities fall within its scope, we also apply the EU General Data Protection Regulation and relevant EU or EEA national requirements. The applicable rules depend on the processing and circumstances, rather than citizenship alone.

2 Scope and customer responsibilities

This policy covers visitors to www.cleverdist.com; people who contact us or submit an operational challenge or pilot request; business contacts at customers, prospects, partners and suppliers; participants in our business activities; and professional contacts whose information we obtain through research or enrichment services.

Where Cleverdist processes personal data solely on a customer’s instructions in providing IO or related services, that processing is governed by the relevant customer agreement and data processing agreement. The customer is responsible for determining its purposes and informing the people concerned. We assist that customer with requests as required. Questions about such processing should generally be directed to the customer.

Cleverdist remains responsible for processing for which it determines its own purposes, including managing its business relationships. A particular IO deployment or feature may require additional privacy information. This policy does not give us an unrestricted right to reuse customer operational data, confidential information or personal data for unrelated purposes.

3 Personal data and sources

Information you provide. We receive names, work email addresses, telephone numbers, employers, job titles, countries and other professional details supplied in enquiries, forms, correspondence and meetings. We also receive the content of requests, operational challenges, pilot interests, proposals, feedback and documents you choose to share.

Relationship records. We keep relevant contact history, CRM notes, business correspondence, meeting arrangements, product interests, account associations, proposal and contract information, and records needed for support and administration.

Professional research and enrichment. We may collect names, job titles, employers, business email addresses, business telephone numbers and professional profile information about people at organisations relevant to our offerings. Sources include company websites, publicly accessible professional information, your organisation and B2B data providers, including services accessed through Treg. A provider may compile information from public sources, but the actual source depends on the request and provider. We do not assume all returned data is public or accurate. Public availability does not remove privacy protections.

Evaluations and inferred information. We may create assessments of business relevance, contact or company fit, likely professional responsibilities, stakeholder relationships, decision-making roles and lead priority. These are working assessments, not verified statements about a person’s intentions or authority. A score or inference may itself be personal data.

Website and device information. Our website and its service providers may process IP addresses, browser and device information, timestamps, page addresses, referral information, identifiers and interaction events. Optional analytics and advertising processing is described in section 6.

Preference records. We process subscription choices, consent and withdrawal records, objections and suppression information needed to respect communication preferences.

Provide only information that is relevant and that you are entitled to share. General contact forms are not intended for passwords, API keys, special-category personal data or confidential plant records. Contact us to establish an appropriate channel and any necessary confidentiality or data processing terms before sharing such material.

4 Purposes and legal grounds

Where GDPR applies, we use the following legal grounds according to the purpose and relationship. Swiss law has its own requirements; the GDPR legal grounds below do not replace them.

Responding to enquiries and assessing requests

We use relevant information to acknowledge requests, clarify requirements, arrange discussions, assess feasibility and prepare requested proposals. If you personally request steps towards a contract with you, processing may be necessary under Article 6(1)(b) GDPR. When you act for an organisation, our legitimate interest in responding to and managing that organisation’s request generally provides the relevant ground under Article 6(1)(f).

Managing business relationships

We process contact and relationship records to administer customer, supplier and partner relationships, provide support, maintain accurate records and manage contracts. Grounds include contractual necessity where you personally are a contracting party, legitimate interests in administering corporate relationships, and legal obligations under Article 6(1)(c), such as applicable recordkeeping requirements.

Professional research and business development

We research companies and relevant professional contacts, verify and complete business records, assess relevance to our offerings, map stakeholders and support appropriate business development. Where permitted, we rely on our legitimate interests under Article 6(1)(f) to identify relevant organisations and communicate with suitable professional contacts. That reliance is limited by necessity, reasonable expectations, the nature of the information and the person’s rights. It does not permit indiscriminate data collection or unrestricted outreach.

A data processing ground does not replace separate rules governing promotional email, calls, tracking or platform use. We obtain consent wherever the applicable communication or tracking rules require it.

AI-assisted analysis

AI tools support the enquiry, administration, research and business development purposes explained in this policy. They do not create a new legal ground simply because processing is automated. The relevant ground is the one applicable to the underlying task, subject to purpose limitation, proportionality and any additional legal requirements.

Marketing analytics security and legal requirements

We use consent under Article 6(1)(a) where required for optional analytics, advertising tracking and promotional communications. An existing-customer exception or another lawful ground applies only where its actual conditions are met.

We process proportionate technical and business records to protect systems, investigate misuse, comply with legal duties and establish, exercise or defend claims. Depending on the activity, we rely on a legal obligation or legitimate interests in security and legal protection. Consent may be withdrawn at any time; withdrawal does not affect processing lawfully carried out beforehand.

5 Enquiries, events and communications

Submitting an enquiry, operational challenge or pilot request enables us to respond to that request. Follow-up may include questions, a meeting and a proposal. The request does not automatically subscribe you to unrelated promotional communications.

Where we offer subscriptions or other optional communications, we identify the relevant purpose and request permission where required. We distinguish necessary request or service communications from promotion. Contact details found through research, a completed lead file or an AI score do not themselves establish consent to outreach.

You can unsubscribe using the mechanism in a promotional message or contact info@cleverdist.com. You may object to direct marketing, including associated profiling, at any time. We stop the relevant processing when that right is exercised and may retain a limited suppression record to ensure that you are not contacted again for that purpose.

If we obtain business contact data from a third party rather than from you, we provide an individual privacy notice identifying Cleverdist, the purpose and legal ground, the relevant data categories and source, and your rights, with access to this full policy. Where Article 14 GDPR applies, we provide that information within a reasonable period and no later than one month after obtaining the data, or earlier at the first communication or first disclosure to another recipient. This also applies when the first contact is by telephone. Any legal exception is assessed and documented individually. Publishing this policy or deleting a record is not treated as an automatic exemption from a notice duty that has arisen. Ask info@cleverdist.com for the source of information concerning you.

6 Cookies analytics and advertising

Cookies are small text files stored on your device when you visit a website. We also use similar technologies, tracking tags and browser storage. These technologies support website operation and, with your consent, analytics and advertising measurement. Cookie-free transmission can still involve personal data.

Your choices

When you first visit, our consent banner lets you accept or reject optional technologies. Analytics and advertising tags are blocked until you give consent for the relevant category; rejecting optional processing is as easy as accepting it. We do not send optional analytics or advertising measurement requests before that permission. You can change or withdraw consent through the cookie settings in the website footer. Withdrawal does not affect earlier lawful processing. Browser settings can also restrict or delete cookies, but do not necessarily withdraw recorded consent or stop every data transmission. Contact info@cleverdist.com if you need help.

Strictly necessary technologies

Technologies used solely to deliver a service you request, remember your privacy choice or provide necessary security may be exempt from the device-access consent requirement. This exemption is assessed by purpose, not just the provider’s label. Where personal data is processed, we rely on our legitimate interest in providing a secure, functioning website or another applicable ground. We do not use the necessary category for optional analytics or advertising.

Google Analytics and Google Tag Manager

With analytics consent, we use Google Analytics 4 to understand page visits, navigation, engagement, referral sources, device and browser characteristics and approximate location. Google explains that GA4 does not log or store individual IP addresses, although an IP address is processed to derive approximate location. Identifiers and events can still be personal data. We configure user-level and event-level retention to 14 months. This setting does not govern all aggregated reports, cookie lifetimes or copies held in other systems. Google Signals is disabled and we do not use GA4 data for advertising.

We use Google Tag Manager to deploy and manage tags. Each tag remains subject to its own purpose and consent requirements. LinkedIn advertising processing below is separate from the Google Analytics configuration. Google’s European service arrangements identify Google Ireland Limited where applicable; the contracting entity and recipient roles are determined by the relevant terms.

Google Privacy Policy

How Google uses information from sites and apps

GA4 cookie names and configurable lifetimes

GA4 data retention

HubSpot tracking and CRM

With analytics consent, the HubSpot tracking code records website interactions, including pages viewed, visit times, session activity, referral information and visitor identifiers. When you submit an identifying form, HubSpot can associate earlier consented visits and subsequent consented activity with your contact record. We use this to understand professional interests and support relevant follow-up. Form submission does not itself provide analytics or marketing consent. HubSpot, Inc. and relevant affiliated entities process information under the applicable service arrangements. CRM records, subscription preferences and optional behavioural tracking have separate purposes and controls.

HubSpot Privacy Policy

HubSpot cookies and published durations

LinkedIn Insight Tag and advertising

With advertising consent, the LinkedIn Insight Tag supports campaign attribution and conversion measurement. Where enabled and consented, it can support website audiences and retargeting. The tag can transmit page URLs, referrers, IP addresses, browser and device information, timestamps and identifiers. LinkedIn may associate activity with member information under its own arrangements. This category is optional and separate from analytics and from business-contact research. The relevant European arrangements can involve LinkedIn Ireland Unlimited Company.

LinkedIn Insight Tag information

LinkedIn Privacy Policy

LinkedIn Cookie Policy, cookie names and lifetimes

Cookie lifetimes

The following table identifies common Google and HubSpot cookies and their published provider lifetimes. These are provider descriptions, not a statement that every cookie is present on every visit. Shorter website settings and browser restrictions may apply. Consent preferences and the relevant technologies can be reviewed through our website cookie controls. Cookie expiry is different from server-side retention.

For analytics and advertising personal-data processing we rely on consent under Article 6(1)(a) GDPR where applicable, in addition to the relevant device-access rules. Google, HubSpot and LinkedIn may process data in the United States. Transfers require the applicable safeguards described in section 9; provider documentation alone does not establish that a particular transfer qualifies for a framework or exemption.

7 AI-assisted business processing

We use a company-managed ChatGPT Business account and Codex, including a connection to HubSpot, to assist with professional research, analysis and administration. Jev by TypeSafe and Treg are used within our Codex workflows. Using a tool through Codex describes how staff access it; it does not mean that processing remains on a local device or within Switzerland or the EEA.

Retrieving and analysing business records

Authorised users can retrieve relevant HubSpot records and use AI to summarise business information, organise research, evaluate professional relevance and prepare material for internal review. The data involved may include names, employers, roles, professional contact details, company records, relevant CRM notes and correspondence, and the content supplied to a task. Prompts, retrieved data, generated responses and working files may contain personal data.

Only data relevant to the business task should be used. Customer confidentiality, access restrictions and applicable processing instructions continue to apply. A tool connection does not itself authorise a new use of customer information.

Treg retrieval and enrichment

Our company Treg account is connected to Codex. Treg routes authorised requests to the external APIs selected for a task. The relevant upstream provider, rather than the proxy itself, supplies contact research or enrichment results. The request, returned information and professional details can be processed by the proxy, upstream provider and their relevant infrastructure providers.

The hosted Treg service is operated by Superdesign Dev Pty Ltd. Its published policy identifies US hosting, including Render infrastructure in Oregon. Treg states that proxy request and response bodies are not stored, but this does not mean no data is retained: account details, usage and audit records, tool configurations and any separately saved content have their own retention arrangements. Upstream providers have separate practices. Information about the actual source and recipients of a record can be requested at info@cleverdist.com.

The data services called depend on the task and the authorised connection. A service being available through Treg does not mean that it supplied every contact record. We identify the relevant source when giving an individual notice about indirectly collected contact data. Use of these tools does not authorise extraction from a platform in breach of its terms.

Jev evaluation and lead scoring

Jev by TypeSafe evaluates information supplied to it against business criteria and returns structured assessments, scores or probabilities. In our lead research workflow, retrieved records can be assessed for relevance to our business, professional role, company fit and potential involvement in a purchasing decision. Jev evaluates the supplied information; the retrieval and enrichment functions are performed separately.

We create working lead files, check and complete the information internally, and use the reviewed records to map stakeholders and relevant professional contacts. AI-generated assessments support prioritisation and research. They do not establish that a person intends to buy, has consented to contact or holds a verified decision-making authority.

Profiling human review and limits

Automated evaluation of a person’s professional relevance or likely role can constitute profiling under GDPR even where a person subsequently reviews the result. Company-only assessments do not necessarily involve personal data, but named-contact assessments can.

Our team reviews the information and assessments internally before taking action or conducting outreach. The reviewer can correct, reject or change the result. These workflows do not make solely automated decisions producing legal or similarly significant effects concerning individuals. They are not intended for credit, employment, health, eligibility or other consequential decisions about individuals.

The research is limited to relevant professional and business information. We do not use these workflows to infer sensitive personal characteristics, such as health, political opinions, religion or sexual orientation. A score is a fallible assessment based on available information. You can request correction of inaccurate personal data and object to processing where the applicable conditions are met. Direct marketing objections also cover related profiling.

Model training and retention

We do not use personal data processed in these internal business workflows to train or fine-tune AI models and do not authorise such training through those workflows. We use our business account rather than a personal consumer ChatGPT account for this work.

OpenAI’s official documentation states that covered Business workspace data is not used for model training by default. TypeSafe states that Jev is not trained on customer inputs or outputs. Treg describes restrictions on training with connected-account data in its own policy. These service-specific commitments do not mean that all data is anonymous, that nothing is retained or that every upstream provider has identical terms.

Personal data can remain in source systems, prompts, conversations, retrieved responses, working files, saved answers or technical records. TypeSafe states that processing takes place in the United States and offers an optional zero-data-retention setting; this policy does not claim that every request uses that option. A no-training commitment is distinct from a retention or deletion commitment. Sections 9 and 10 explain international processing and our retention rules.

Official OpenAI information about business data and connected systems

HubSpot information about its ChatGPT connection

TypeSafe Privacy Policy

TypeSafe information about submitted data and retention

Treg Privacy Policy

AI assisted content production

We also use AI to assist with text, images and other business content. This activity does not require personal data about website visitors merely because they view that content. Where identifiable people or personal information are included in inputs, reference material or outputs, the relevant privacy, confidentiality and other rights requirements apply. Any legally required AI-content disclosure is provided with the relevant content or interaction; this policy is not a substitute for it.

8 Recipients and service providers

Relevant personal data is accessible to authorised Cleverdist personnel and service providers involved in the stated purposes. Providers include HubSpot for CRM and tracking; Google for Analytics and Tag Manager; LinkedIn for its advertising functions and professional services; OpenAI for ChatGPT Business and Codex; TypeSafe for Jev; Treg, operated as described in its policy by Superdesign Dev Pty Ltd; and the data services called through our authorised Treg workflows. Relevant hosting, communications and cloud providers, including Microsoft Azure where used for the relevant service, may also process data.

The recipient’s role depends on the particular operation. Providers may act under our instructions as processors or process certain information independently as controllers. A provider’s privacy policy does not by itself replace a required data processing agreement or transfer safeguard. We share only information necessary for the relevant purpose and subject to applicable legal and contractual restrictions.

Necessary information may also be disclosed to professional advisers, competent authorities or parties involved in a legal claim where lawful. A business restructuring or transaction may involve limited disclosure subject to appropriate safeguards and applicable information duties. Personal data is not made available to another customer for that customer’s marketing merely because we hold it in our CRM.

Microsoft Privacy Statement

9 International processing

Our activities involve processing in Switzerland, the EEA and the United States. Relevant examples include US processing described by TypeSafe and Treg, and international processing by our other service providers. Depending on the service and its subprocessors, additional countries can be involved. The linked provider privacy information and subprocessor lists identify their published locations; information about the recipients and safeguards relevant to your data can also be requested from us.

Transfers must meet the applicable Swiss requirements and, where relevant, Chapter V GDPR. A transfer may rely on an applicable adequacy decision or appropriate safeguards, such as standard contractual clauses with Swiss adaptations where necessary, a required transfer assessment and supplementary measures. A US framework applies only to a participating entity and covered processing; the use of a recognised vendor is not itself a transfer mechanism.

We do not treat supplier terms, a business account or proxy routing as permission to bypass these requirements. You may contact info@cleverdist.com for information about relevant destination countries and to request access to the safeguards, subject to necessary redactions to protect legitimate confidentiality and security interests.

TypeSafe Trust Centre and subprocessor information

10 Retention

We keep personal data only for as long as needed for the purposes in this policy. The following periods apply to prospecting records; information required for a separate contractual, legal or claims purpose is assessed separately and is not used to continue marketing after an objection.

Prospects and active conversations

For prospects who have not engaged with us, we delete prospecting records no later than 12 months after our last attempt to contact them. If no contact attempt is made, we delete the prospecting record no later than 12 months after collection, subject to any earlier notice or deletion requirement. If we have an active conversation, we retain relevant records while that conversation continues and apply the same 12-month limit after it ends. We review relevance regularly, remove unnecessary records earlier and do not use repeated unsolicited messages merely to extend retention. These periods do not extend an earlier legal deadline for giving a privacy notice.

Customers, enquiries and legal records

We retain relevant customer records during the business relationship and afterwards for applicable legal retention periods or as necessary for legal claims. Enquiry records are retained while needed to address the enquiry and related follow-up, subject to the prospecting limit where applicable. Records subject to a legal hold are restricted to that purpose.

Analytics, AI working files and backups

GA4 user-level and event-level data is configured for 14-month retention, as explained in section 6. Cookie lifetimes and CRM retention are separate. HubSpot behavioural history associated with a prospect is subject to the applicable prospect-record retention rule. We apply deletion and access controls to AI working files and retained copies as well as the CRM; deleting a CRM record alone does not remove copies from other systems. Technical logs and backups follow the relevant system schedules and are not used to restart prospecting. Where deletion is subject to a backup cycle, the retained copy is protected from ordinary use and the deletion is reapplied if data is restored.

Accuracy and objections

Information from third parties may be outdated or incorrect. We correct or delete inaccurate details when identified, for example after an email bounce or a change of role. You can object to direct marketing, including associated profiling, at any time by replying to a message or contacting info@cleverdist.com. We then stop that processing and remove your details from prospecting lists. We retain only the minimum identifiers needed on a suppression list, such as the relevant email address or telephone number, solely to honour the objection. Other information is retained only where a separate lawful purpose requires it. We review records regularly and delete information that is no longer needed.

11 Your rights and choices

Subject to the applicable law and its conditions, you may request access to your personal data, correction, deletion, restriction of processing and a portable copy of data where that right applies. You may object to processing based on legitimate interests on grounds relating to your situation and withdraw consent at any time without affecting earlier lawful processing.

You may object to direct marketing at any time, including related profiling. We stop using your personal data for that purpose when that right is exercised. You may also ask about the source of indirectly obtained data, relevant recipients, inferences concerning you and applicable international safeguards.

Send requests to info@cleverdist.com or our postal address above. We may request proportionate verification of identity or information needed to locate the relevant records. Where GDPR applies, we normally respond within one month and explain any permitted extension within that initial period. Applicable Swiss procedures govern requests under Swiss law.

You may complain to the Swiss Federal Data Protection and Information Commissioner or, where GDPR applies, a competent supervisory authority in the EU or EEA, including one in the country of your habitual residence, workplace or an alleged infringement. You do not have to contact us before exercising a complaint right.

Swiss Federal Data Protection and Information Commissioner

EU and EEA supervisory authorities

12 Required information security and updates

Where information is needed to respond to an enquiry or provide a requested service, not providing it may prevent us from fulfilling that request. Optional tracking or promotional permission is separate from that necessary information.

Personal data must be protected through technical and organisational measures appropriate to the risks, including proportionate access restrictions and secure handling. No transmission or storage system can guarantee absolute security. This does not limit our duties regarding security, incident handling or legally required notifications.

We may update this policy when our processing or applicable requirements change. We publish the updated date and provide additional notice or obtain new consent where required. Publication of a revised policy does not itself authorise a new purpose, expand a customer’s instructions or override an objection.