Privacy

What this shop knows about you, who else sees it, and how to get rid of it.

Who is responsible

Alexander Finger, Rathausgasse 21, 3280 Murten, Switzerland — af@syd.de. Address any question or request about your data to that address. There is no data protection officer; the seller handles these personally.

This declaration is written in English because the shop is offered only in English.

The short version

If you only read this website, the server records your IP address in a log file for fourteen days and nothing else. There are no cookies, no analytics and no tracking of any kind. If you buy something, the shop keeps your name, email address, appointment time and what you said you wanted to discuss, and passes what is necessary to Stripe for payment and to Microsoft for the calendar entry and the video call.

If you only visit the website

What is recorded: Your IP address, the date and time, the page requested, the HTTP status and response size, the referring page if your browser sent one, and your browser's user-agent string. This is the web server's standard access log.
Why: To operate the server, diagnose faults, and detect abuse.
How long: Fourteen days, after which the log file is deleted by rotation.
Cookies, analytics, embedded third-party content: None. No cookie is set, no analytics or tag manager is used, and no fonts, maps, scripts, images or social plugins are loaded from anyone else's servers. Everything the page needs, including its typefaces, is served from this domain. Nothing about your visit is transmitted to a third party.

If you order through the MCP server

This shop is bought from using an AI assistant rather than a web form, so the data reaches the shop through your assistant. What arrives is listed here in full.

What you provide, and what is required: Required to make a booking at all: your name, your email address, and the appointment slot you chose. The name and email are needed because the calendar invitation has to be addressed to you and because cancelling a booking requires proving it is yours.

Optional: what you want to discuss, what outcome you are hoping for, and your timezone. Your assistant is asked to put these questions to you. You may decline all three and the booking still works. They are used only so the seller can prepare, and they appear in the calendar invitation.
What the shop records by itself: An order number, the price and currency, the reservation and payment timestamps, the order status, a payment reference from Stripe, a refund reference if one is issued, and — once the meeting exists — the calendar entry identifier and the Teams joining link. Requests to the MCP server also appear in the same fourteen-day web server log described above, which records the IP address the request came from and the client identifier your assistant sends.
Why: To reserve the slot, take payment, create the meeting, send you the invitation, handle cancellations and refunds, and meet the seller's accounting and record-keeping obligations. There is no other use. Your data is not profiled, not used for marketing, not used to train anything, and not sold or shared for any purpose beyond those named below.
Where it is stored, and who can reach it: In a single database file on a server operated by the seller in France (OVH). The seller is the only person with access. It is not replicated elsewhere, and no employee, contractor or agency has access to it.
How long: Order records are kept for ten years from the end of the business year, as Swiss accounting law requires (Art. 958f OR), and then deleted. If you ask for deletion sooner, the fields not needed for that obligation — what you wanted to discuss, the outcome you wanted, the meeting link — are erased immediately, and the accounting record is reduced to the minimum the law requires.

Who else receives your data

Three recipients, and nothing beyond what each one needs.

Stripe — taking the payment: Receives your email address, the order number, the amount, and the date and time of the appointment. It does not receive what you said you wanted to discuss, or the outcome you were hoping for.

Your card or wallet details are entered on a page hosted by Stripe and never pass through this server, which is never able to see them and never stores them. This shop learns only that payment succeeded, plus a reference used to issue refunds. Controller: Stripe Payments Europe Ltd, Ireland, part of a group headquartered in the United States.
Microsoft — the calendar entry and the video call: Receives your name, your email address, the appointment time, the order number, the price paid, and anything you chose to say about your topic and desired outcome — because all of that is written into the calendar invitation that Microsoft sends you and that the seller reads to prepare. Microsoft also hosts the Teams call itself. Controller for the seller's tenant: Microsoft Ireland Operations Ltd.
Your own AI assistant — worth stating plainly: This shop has no checkout page, so you reach it through an AI assistant of your choosing. Everything you tell that assistant — your name, your email address and whatever you say about your topic — passes through its provider before it reaches this shop. That provider is selected by you, is not engaged by the seller, and handles your data under its own privacy policy rather than this one. The seller has no visibility of, and no control over, what it retains. If that matters to you, check your assistant's policy before you order.

No one else receives anything. There is no analytics provider, no CRM, no email marketing platform, no advertising network and no hosting company with access to the contents of the database.

Transfers abroad

The server is in France. Stripe and Microsoft process data in the European Economic Area and, within their groups, in the United States. Both are bound by standard contractual clauses and equivalent safeguards recognised under Swiss data protection law, and both are certified under the Swiss–U.S. Data Privacy Framework. Where your own AI assistant processes your data is determined by the provider you chose.

Automated decisions

None. Nothing about your booking is decided by automated individual decision-making within the meaning of Art. 21 DSG. Slots are allocated first come, first served.

Your rights

You may ask what personal data is held about you and receive a copy, have it corrected if it is wrong, have it deleted subject to the accounting retention above, obtain it in a portable form, and object to its processing. Write to af@syd.de. Quote your order number if you have one — it identifies your record on its own, so you need not send anything further to prove who you are.

These requests are genuinely easy to satisfy here: the shop holds one short record per order and nothing else about you. If you are not satisfied with the response, you may lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern.

Changes

If what the shop collects changes, this page changes with it. It describes the system as it actually is, not what it might one day do.