Privacy policy

Updated: 5 October 2026

Data controller: JUNGO one · VABOA, Galgenwaldstrasse 4, 3952 Susten, Switzerland, Stephan Jungo. Contact: info@vaboa.ch · +41 79 208 25 27.

Scope and responsibility

This notice covers the public VABOA website, contact enquiries, appointment organisation and our own user accounts in VABOA Analytics. VABOA is a business presentation of JUNGO one. Stephan Jungo, proprietor of the sole proprietorship JUNGO one, is the controller. Responsibility for business or guest data that customers have processed in VABOA Analytics for their own purposes also depends on the specific engagement and contractual privacy arrangements. This notice does not replace a required data processing agreement.

Purposes and legal grounds

We observe the Swiss Federal Act on Data Protection (FADP). We process data to provide and secure services, respond to enquiries, organise appointments, perform contracts and meet legal obligations. Where the EU GDPR applies to the particular processing, relevant grounds may include Article 6(1)(b) (contracts and pre-contractual steps), (c) (legal obligations), (f) (legitimate interests in secure operation and communication) and (a) (consent for optional processing). Consent can be withdrawn; making an enquiry does not subscribe you to a newsletter.

Hosting, technical data and security

The website and its data processing are provided through Replit. IP addresses, timestamps, requested URLs, browser and device information, and technical error or security logs may be processed for delivery, troubleshooting and abuse prevention. Replit is a US provider; exclusive storage in Switzerland is not promised. Font files on public pages are served from our own website. Administrative access is restricted and communications use HTTPS. Protective measures cannot guarantee absolute security on the internet.

Cookies and local storage

Cookies and similar browser storage serve different purposes. The protected application uses session data for sign-in. Your cookie choice and appearance preference may be saved in localStorage; dismissing an announcement is saved in sessionStorage. These settings do not contain form messages. Local preferences remain until changed or deleted; session storage ends with the browser session. You can delete or block cookies and local data in browser settings, which may affect sign-in and convenience features.

Google tag and analytics in the application

The application includes a Google tag for Google Analytics. It may process usage events, visited pages, approximate region, and browser or device information. analytics_storage defaults to denied and changes to granted on acceptance. However, the tag is loaded on opening the application: technical communication data or cookieless signals may reach Google without consent to analytics cookies. Rejecting analytics cookies therefore does not block every Google connection. The exclusively server-rendered public pages do not themselves include this analytics tag. Google data may be processed in Ireland and the United States. The settings below let you reject or reset the saved choice; application tabs already open must then be reloaded.

Contact and native appointment booking

We store your contact details, message and, where relevant, requested appointment, meeting type and processing status in our protected administration. Business, location and other optional details help us understand your enquiry. Confirmations and organisational messages are sent through Resend. Our server checks busy periods in the connected Google Calendar; personal calendar events are not shown to you. Confirmed appointments are sent to Google Calendar with the necessary contact and appointment details. Video meetings may use Google Meet. You can cancel through your personal management link. We use these details to handle your enquiry and organise the conversation, without automatically subscribing you to a newsletter. Contact us for access to or deletion of your data.

Appointment messages may also reach our business mailbox for internal handling. The calendar invitation contains the time, meeting type, any video link and necessary enquiry details. Your email and calendar providers also process these data when you import it. Keep your personal management link confidential. You can contact us by ordinary email or telephone instead; contact details and conversation content are processed for communication and, where relevant, contract performance.

AI-assisted website check

The public website check is currently paused. The following information concerns use where the service is offered and processing of previously requested checks.

If you request a website check, we fetch the public page you provide and up to nine linked pages. Where content requires JavaScript, we load the page in a separate, short-lived browser on our server. Only approved public resources on the same domain are fetched; external embeds and private networks remain blocked. The checked website receives technical connection data from our server. We do not sign in, submit forms or copy cookies from your browser. The browser session is then discarded. We check technical signals and send publicly visible page content and your selected industry to our AI provider for an initial content review. Your email address is not sent to the AI; it is used only to send the requested report via Resend. Results are held temporarily for delivery; technical data such as your IP address is used temporarily to prevent abuse. This does not subscribe you to a newsletter. The analysis is not a complete audit and may contain errors.

This check uses the OpenAI API through Replit. Public page content can contain personal data, which may therefore reach the AI provider. The email address entered separately for report delivery is not part of the AI input package. Do not submit confidential content or private access links. The assessment is indicative and does not decide your statutory rights or eligibility for funding.

Recipients and services

Depending on the function used, the following providers may receive data. Internal authorised personnel, appointed technical providers and, where necessary, authorities or legal advisers may also receive data for their duties or legal requirements. We do not sell your contact enquiries. Provider notices give additional information on their own processing and subprocessors:

Accounts, VABOA Analytics and payments

Our own accounts may involve names, email addresses, sign-in information, account assignment and security data. Paid services also involve contractual, invoice and payment-status data. Where Stripe handles payment, it receives the necessary payment information; card details are processed by the payment provider. Connected business data, such as occupancy, reservations or revenue, serve the commissioned analysis. Purposes, permissions, recipients and retention for personal data from customer systems must be determined in the relevant contract. This website notice does not authorise unrestricted reuse of hotel guest data.

AI features in the application may send inputs, selected metrics and the contents of processed documents to OpenAI or Anthropic through Replit. This is separate from the public website check. Only provide content that you are authorised to have processed for the relevant service. Necessary permissions and data protection agreements for data from customer systems must be ensured separately.

WhatsApp, maps, external links and live references

WhatsApp and maps open through external links. WhatsApp Ireland Limited and Meta companies in the United States may process WhatsApp data; Google's notices apply to Google Maps. A live preview of a customer website loads only after you activate it. Visiting or loading these services may transmit IP addresses, browser information and any cookies to their operators and providers. We do not fully control their processing. You can use our ordinary email address or telephone number instead.

WhatsApp · Privacy

International disclosures

The named services may process data particularly in the United States and Ireland; their subprocessors may also operate abroad. The specific service, delivery region and provider agreements are relevant. Articles 16 and 17 FADP govern disclosures from Switzerland. Where protection is not adequate, a valid transfer ground is required, such as recognised standard contractual clauses with the necessary additions. The Swiss-U.S. Data Privacy Framework applies only to validly certified recipients and covered processing. Where the GDPR applies, Articles 44 onwards must also be observed. You can request information on specific recipients, additional recipient countries and agreed safeguards from us. This notice alone does not establish a transfer safeguard.

Retention

Retention depends on the purpose, statutory obligations and the need to establish or defend claims. Enquiries and appointments are kept for handling, follow-up and necessary evidence; this notice does not promise automatic deletion after a fixed period. Commercial records subject to retention requirements may need to be kept for ten years. Technical abuse-prevention data are used only for the necessary security purpose. Website-check intermediate results have a 20-minute validity window; expired records are removed in subsequent cleanups. This does not promise physical deletion from all backups at the exact expiry minute. Backups and provider logs may follow different retention cycles.

Your rights and privacy contact

Subject to applicable law, you may request access, correction, deletion or cessation of processing and, where applicable, data delivery or portability. Where the GDPR applies, restriction and objection may also be available. Consent can be withdrawn for the future without affecting the lawfulness of earlier processing. Legal retention obligations and third-party rights may limit complete deletion. We may require proportionate proof of identity and handle requests within statutory deadlines. Your contact is Stephan Jungo using the details above. You may complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or a competent European supervisory authority.

FDPIC

Changes

We update this notice when services or legal requirements change. The date identifies the version of the text. This notice does not waive mandatory privacy or consumer rights.