# Privacy Policy

> Last updated: October 12, 2026

Protecting your personal data is important to us. This privacy policy transparently explains which data we collect when you use **Acurio**, for what purposes we process it, to whom we disclose it and what rights you have. Processing is carried out in accordance with the revised Swiss Federal Act on Data Protection (revFADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

## 1. Data controller

TecMinds GmbH

Neustadtstrasse 8a

6003 Lucerne, Switzerland

Email: [info@tecminds.ch](mailto:info@tecminds.ch)

For data protection inquiries, access requests or to exercise your rights, please contact the email address above.

## 2. General information on processing

We process personal data solely for the purposes described below and only to the extent necessary to provide our service, fulfil contractual obligations or comply with legal requirements. All staff are bound by confidentiality and data protection obligations.

## 3. What data we process

### 3.1 Account data

When you register and sign in, we collect your email address and a unique user ID. Authentication is performed via a magic link sent to you by email. Session information is stored as a technical cookie in your browser.

### 3.2 Content data

To use the service you upload academic documents (DOCX, PDF, TeX) and source files (PDF, BibTeX, text). We process this content to provide the service. Where necessary for processing, for delivering your results, for avoiding unnecessary repeated processing, and for the security, stability and protection of our systems, document contents and data derived from them (such as detected citations and references) may be stored for a limited period. They are then deleted unless longer retention is required to provide the service (for example for analyses you have saved) or by law.

### 3.3 Analytics and log data

For operation, quality assurance and error handling we log technical information about citation analyses (for example timestamps, duration, number of citations processed, error codes). These logs are retained for up to 30 days and are then automatically deleted.

If you delete a citation check, we keep only a summary without its content: timestamps, language, plan and model used, the number of citations and sources, the distribution of ratings, technical error codes, our automated quality assessment, the number of your feedback votes (helpful/wrong) and your overall rating of the check. The document, file name, citations, sources, notes and the identifiers of individual citations are deleted. The summary is kept until you delete your account.

### 3.4 Payment data

For purchases we store customer, order and payment references, amount, currency, payment status and the associated credits. New credit packs are sold through Dodo Payments as reseller (Merchant of Record). We send your name, email address and order information to Dodo Payments for this purpose. Card and bank details are processed directly by the payment provider. Existing Stripe subscriptions and earlier Stripe payments continue to be managed through Stripe.

Dodo Payments acts as an independent data controller for payment processing, fraud prevention and tax handling. Further information, including international data transfers, is available in the [Dodo Payments Privacy Policy](https://dodopayments.com/privacy-policy).

### 3.5 Communication

If you contact us by email, we process the information provided in order to handle your request.

## 4. Purposes and legal bases

We process the above data for the following purposes:

- Provision and operation of the Acurio service (contract performance)
- Authentication and account security (contract performance, legitimate interest)
- AI-based analysis of citations against source documents (contract performance)
- Processing subscriptions and payments (contract performance, legal obligation)
- Error analysis, security and abuse prevention (legitimate interest)
- Communication with you, e.g. for support (contract performance, legitimate interest)
- Compliance with statutory retention and cooperation obligations

## 5. Recipients and processors

To provide our service we use carefully selected service providers that support us as processors. They may only process data on our behalf and in accordance with our instructions.

| Provider | Purpose | Location |
| --- | --- | --- |
| AI model providers | AI-based analysis of citations and source text | Zero Data Retention (no storage) |
| Dodo Payments | Sale of new credit packs, payment and tax handling | USA / UK / worldwide |
| Stripe Payments Europe | Existing subscriptions and earlier payments | EU / worldwide |
| MailerSend | Sending transactional email (magic link) | EU |
| Coolify (self-hosted) | Application and database hosting (PostgreSQL) | Germany and/or Switzerland |

**Hosting and server locations:** We self-host our application servers and PostgreSQL database (via Coolify) in **Germany and/or Switzerland**. The specific location may vary by environment. Processing remains **GDPR-compliant** in all cases and is aligned with the revised Swiss Federal Act on Data Protection (revFADP).

Disclosure to further third parties takes place only where this is necessary for contract performance or required by law.

## 6. Cross-border transfers

Content and analysis data from citation checks are sent to several language models. Providers do not store this content (Zero Data Retention) and do not use it for training. Individual supporting service providers (e.g. Stripe for payment processing) may also process data outside Switzerland and the EEA. Swiss and EU data protection law (GDPR) require an adequate level of protection for such transfers. We ensure this in particular by entering into Standard Contractual Clauses (EU SCC) and by additional technical and organisational measures. Content is transferred solely for processing purposes.

## 7. Retention periods

- **Uploaded documents and data derived from them:** as long as necessary for processing, delivering results and protecting our systems, generally for a short period; then deleted unless longer retention is required to provide the service or by law.
- **Analytics and log data:** up to 30 days, then automatically deleted.
- **Summaries of deleted citation checks (no content):** until you delete your account.
- **Account data:** until your account is deleted; then deleted without undue delay, unless statutory retention obligations apply.
- **Billing and contract data:** ten years under the Swiss Code of Obligations (Art. 958f CO).

## 8. Cookies and similar technologies

We use only strictly necessary cookies required to operate the service (in particular session cookies to maintain your login). We do not use tracking, advertising or analytics cookies. No profiling for marketing purposes takes place.

## 9. AI-based processing

For citation verification, text excerpts from your document and sources are sent to language models. Several models are used. Providers do not store the transmitted content (Zero Data Retention). The transmission is encrypted. Results are generated by AI and may be incorrect or incomplete; they are intended as decision support and do not constitute a final scientific or legal assessment.

## 10. Data security

We take appropriate technical and organisational measures to ensure the confidentiality, integrity, availability and resilience of our systems. Data transfers are encrypted (TLS). Access to personal data is restricted to authorised personnel.

## 11. Your rights

Subject to applicable law, you have in particular the following rights:

- Access to the data we process about you
- Rectification of inaccurate or incomplete data
- Erasure of your data, where no retention obligations apply
- Restriction of processing
- Data portability in a commonly used format
- Objection to processing based on legitimate interests
- Withdrawal of consent with effect for the future

To exercise these rights please contact us at [info@tecminds.ch](mailto:info@tecminds.ch). We may request appropriate proof to verify your identity.

## 12. Right to lodge a complaint

In Switzerland you may lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC). Within the EU you have the right to lodge a complaint with the competent data protection authority of your country of residence.

## 13. Changes to this privacy policy

We reserve the right to adapt this privacy policy to reflect current legal and technical developments. The version published at the time of use applies. We will communicate material changes in good time by email or within the service.


---

Source: https://acurio.ch/en/legal/datenschutz