Privacy Policy

1. Who we are, and how to reach us

1.1 Designstandard AG, Witikonerstrasse 80, 8032 Zurich, Switzerland (UID CHE-280.559.568), is the controller of the personal data described in this policy, for all three services.

1.2 For anything about your data, write to privacy@designstandard.ch. A named person is responsible for these requests and will answer you — see section 13.

1.3 Our representative in the European Union. Designstandard AG is established in Switzerland. Our representative in the European Union pursuant to Article 27 GDPR is [entity, address, email]. Data subjects in the EU may contact either us or our representative on all matters relating to the processing of their personal data.

1.4 Data protection officer. We have not appointed a data protection officer, because we are not required to. We assessed all three grounds in Article 37(1) — we are not a public authority; our core activities do not consist of regular and systematic monitoring of data subjects on a large scale; and they do not consist of large-scale processing of special categories of data or of personal data relating to criminal convictions and offences. Use privacy@designstandard.ch for anything you would send to a DPO.

1.5 This policy covers designheroes.com, designcatalogs.com and designfinder.com. The services differ in what they collect, and where a section applies to only some of them it says so.

2. What we collect

2.1 What you give us

• Account — Email address, password.

  Required: Required. Without them we cannot give you an account.

• Profile — Name, professional role, company.

  Required: Optional, except where needed for professional approval below.

• Professional verification — Evidence of professional practice, for designcatalogs.

  Required: Required for designcatalogs only. Access to that library is reviewed and approved by a person. Without it we cannot admit you.

• What you type — Search queries and assistant conversations.

  Required: Required in the sense that we cannot answer a question you do not ask.

• Project content — Comments, uploaded files, private messages — designfinder.

  Required: Optional; the workspace works only if you use it.

• Saved items — Products, catalogues and pages you favourite or bookmark.

  Required: Optional.

• Brand enquiries — The enquiry you write, and the display name it is sent under — plus your email address if you tick the box (6.1a).

  Required: Optional; only if you write to a brand.

• Brand comments — Comments posted by verified brand representatives — designcatalogs.

  Required: Optional, and only for brand representatives.

2.2 What we generate as you use the services

• Search history — what you searched for and when.
• Usage and device data — pages viewed, approximate location derived from IP address, browser and device type.
• Access and security logs — including IP address, for security and abuse prevention.
• Search indexes — mathematical representations (embeddings) derived from text, which make search work. These are still personal data where they derive from your text, and we treat them as such — including when you ask us to delete.

2.3 What we do not collect

• No date of birth and no age. See section 14.
• No payment data. There are no transactions on the services.
• No special categories of data are sought. Please help us keep it that way — see 5.3.
• No data bought from data brokers, and no enrichment of user profiles from third-party data sources.

3. Why we process it, and on what legal basis

• Create and run your account; authenticate you — Contract — Art. 6(1)(b).
• Provide search and the AI assistant, including sending your text to our AI providers — Contract — Art. 6(1)(b).
• Run project workspaces, comments, file storage and private messaging — Contract — Art. 6(1)(b).
• Save the items you favourite or bookmark, so they are there when you return — Contract — Art. 6(1)(b).
• Publish and attribute comments by verified brand representatives on designcatalogs — Contract — Art. 6(1)(b).
• Keep contributions in a shared workspace after a participant leaves, where the remaining participants still need them and the law permits — Legitimate interests — Art. 6(1)(f): preserving collaborative work rather than destroying other people's contributions when one person leaves.
• Keep a brand-representative comment after that person's account closes, while it remains relevant to the catalogue — Legitimate interests — Art. 6(1)(f): the comment was submitted on behalf of the brand, which is a different party from the individual whose account closed. A comment is usually a correction, and losing it because a representative changed jobs would let the catalogue revert to the wrong specification.
• Review and approve professional access to designcatalogs — Contract — Art. 6(1)(b).
• Send an enquiry you write to the brand you addressed it to, with your display name — Contract — Art. 6(1)(b): delivering the enquiry is the thing you asked us to do.
• Share your email address with that brand, if you tick the box — Consent — Art. 6(1)(a). Optional, not needed for the enquiry to reach them or for them to reply inside the Services, and you can withdraw it at any time for future enquiries.
• Security, abuse prevention, fraud prevention, service integrity — Legitimate interests — Art. 6(1)(f): keeping the service safe and available. We weighed this against your interests and use the minimum data for the shortest period.
• Debugging and keeping the service working — Legitimate interests — Art. 6(1)(f).
• Quality review of assistant answers, on a pseudonymised sample — Legitimate interests — Art. 6(1)(f): making the assistant more accurate. Pseudonymised, sampled, kept 90 days.
• Aggregate analytics about how the services are used — Legitimate interests — Art. 6(1)(f).
• Obtain confidential legal, accounting and other professional advice, and establish, exercise or defend legal claims — Legitimate interests — Art. 6(1)(f): managing our legal and business affairs and protecting our legal position.
• Complete a sale, restructuring or transfer of the business, under confidentiality and with the minimum data needed — Legitimate interests — Art. 6(1)(f): enabling a lawful corporate transaction. We do not give your personal data to a prospective buyer before a transaction completes. We would tell you if one happened (6.5).
• Complying with legal obligations — Legal obligation — Art. 6(1)(c).

3.1 We rely on consent for nothing that is needed to use the services. You do not consent your way into the product, and nothing you can withdraw will cost you access to it.

The one thing we do ask consent for is optional and additive: sharing your email address with a brand you have written to (section 6.1a). Decline it and your enquiry still reaches the brand and the brand can still reply to you inside the services. You can withdraw it at any time for future enquiries — though an address already sent to a brand is with that brand, and section 6.1a explains why. If we ever introduce anything else that needs consent — a newsletter, for example — it will be separate, optional, and withdrawable without losing anything else.

3.2 Training. Designstandard does not use your data to train AI models, and we do not permit our AI providers to use it to train general-purpose models.

3.3 No automated decision-making. We make no decisions about you by automated means that produce legal effects concerning you or similarly significantly affect you. We do not use profiling to make decisions about you or to personalise ranking.

4. AI-assisted search and guidance

4.1 Our search and assistant features use artificial intelligence. When you type into search or talk to the assistant, the text you enter is transmitted to AI providers outside Switzerland so that we can answer you.

4.1a Before you have an account — the three guest searches. On designheroes you may make three AI searches before registering. We still process personal data during those searches — a temporary session identifier, your IP address, the text you type, and the request metadata our providers receive.

Our basis is Art. 6(1)(b), contract. Precisely: using the assistant accepts our Terms of Use and forms a contract for the free service (Terms 1.3a), so the processing is performance of that contract — it is what delivers the search you asked for. Where you go on to register, the pre-contractual limb of Art. 6(1)(b) also covers the steps you asked us to take before that account existed, to the extent it applies.

What we do differently in the designheroes guest phase:

• A temporary session identifier, used to count your three searches. No profile, and no fingerprinting.
• No conversation history, and no link to any account — if you register afterwards, your guest searches are not attached to the new account unless you ask us to carry them over.
• Our own copy is discarded promptly — with one exception, stated so you are not surprised by it: a sampled, pseudonymised copy may be kept for up to 90 days for quality review, exactly as for account-holders (section 9). There is still no conversation history and no link to any account. What our AI providers retain is not ours to set — see 4.6, which applies to guest searches exactly as it applies to signed-in ones.

Once you register, the retention in section 9 applies and your conversations become account-linked, which is also what makes deletion and export straightforward.

There is no guest phase on designcatalogs, which is professional-only and where registration is reviewed and approved by a person.

4.2 Who receives it, and what for

• OpenAI — Your query text and conversation context.
  • What it does: Generates answers.
• Anthropic — Your query text and conversation context.
  • What it does: Generates answers.
• Cohere — Your query text.
  • What it does: Re-orders search results by relevance.
• Pinecone — Embeddings derived from text — not the raw text.
  • What it does: Stores the search index.

4.3 Section 6 sets out where these providers are and what protects the transfer.

4.4 AI answers can be wrong. They may be incomplete, outdated or incorrect, and they are not professional advice. This matters most for technical, regulatory and standards information — ingress protection ratings, fire classifications, referenced standards, code requirements. Verify independently before specifying or purchasing. Our Terms of Use say the same thing at greater length.

4.5 We do not use AI to make decisions that produce legal effects concerning you.

4.6 Retention by our AI providers and search infrastructure — limits that are mostly not ours to set. Some of our AI providers retain copies of what is sent to them, for safety and misuse detection. Their retention practices differ, and each one is set out below. That is their process, not ours; we cannot reach into it to delete something early. We can stop sending, and we do.

• OpenAI — Abuse-monitoring logs up to 30 days, unless longer retention is required by law or is reasonably necessary to protect their services or a third party from harm.
• Anthropic — Inputs and outputs deleted within 30 days. But where content is flagged by automated trust-and-safety systems as violating the Usage Policy, inputs and outputs are kept for up to 2 years, and classification scores for up to 7 years.
• Cohere — [to state once the contract exists — §C.1].
• Pinecone — Holds the search index. We control this, and deletion reaches it — see 13.4.

We are telling you about the two-year and seven-year periods rather than only the thirty-day norm, because the norm is not the whole picture. They apply only where an automated system flags content as breaching the provider's usage rules — which ordinary design and specification questions should never do. It is one more reason for section 5: what you type travels further than you might expect, and further still if something about it is flagged.

See section 13.4, where this affects what deletion can achieve.

5. Please be careful what you type

5.1 Free-text boxes accept anything. Please do not enter special categories of personal data — information about health, racial or ethnic origin, political opinions, religious beliefs, trade union membership, genetic or biometric data, sex life or sexual orientation — into search or the assistant.

5.2 Equally, please do not enter confidential information, client data, or personal data about other people.

5.3 We do not want that data, we do not seek it, and we do not process the services' free text looking for it. But once it is typed it goes where section 4 says it goes. The assistant is restricted to design, architecture and specification topics, which makes it unlikely you would ever be prompted toward such information — this warning covers the case where it happens anyway.

6. Where your data goes

6.1 Recipients. We do not sell your personal data and we do not share it for anyone else's marketing. Third-party processors, who act only on our instructions:

• OpenAI — AI answers.
  • Where: Our contracting entity is OpenAI Ireland Ltd (EU); onward processing in the United States.
• Anthropic — AI answers.
  • Where: United States.
• Cohere — Search re-ranking.
  • Where: United States.
• Pinecone — Search index (embeddings).
  • Where: United States.
• Amazon Web Services — Hosting and storage.
  • Where: Switzerland (eu-central-2, Zurich).
• DigitalOcean — Hosting.
  • Where: [confirm region — §C.3].
• Self-hosted components. Using these does not itself disclose anything to their developers or to another software provider — they are software we run ourselves, on the hosting infrastructure identified above. Listed so you know what handles what:
• Keycloak (accounts) · Matrix/Synapse (messaging) · Directus (content) — Identity, messaging, content management.
  • Where: Self-hosted by us. These are not transfers to anyone.

6.1a Brand partners — separate controllers for enquiries. When you send an enquiry to a brand through the Services, that brand receives your enquiry and the display name on your account. It does not receive your email address or any other contact details unless you choose to share them (see below). A brand decides for itself how to handle your enquiry, so it acts as a separate controller and not on our instructions — its own privacy notice governs what it does next.

If you tick the box offering to share your email address, we also send that address to the brand. That is optional, it is not needed for the enquiry to reach them or for them to reply to you inside the Services, and you can decline it and still get an answer.

6.2 A deliberate design point, and what sits outside it. Private messages are not sent to any separate messaging provider — they stay in systems we operate, on the hosting infrastructure named above, and we send search and assistant content only to the providers identified above — their authorised onward processing and subprocessors are governed by the safeguards in 6.3. A separate disclosure you initiate: an enquiry you send to a brand goes to that brand, with your display name — and with your email address too, if you ticked the box to share it.

6.3 International transfers. Switzerland has an adequacy decision from the European Commission, so personal data moving from the EU to us in Switzerland needs no additional mechanism.

Brand partners outside Switzerland and the EU. Some brands are established outside Switzerland and the EU. An enquiry you send to such a brand is a transfer to a separate controller. Where the destination is not covered by an adequacy decision under the data-protection law applicable to that transfer, we use an appropriate transfer safeguard — normally the controller-to-controller standard contractual clauses, adapted for Swiss law where required.

For onward transfers:

• OpenAI — our contract is with OpenAI Ireland Ltd. Ireland is on the Swiss adequacy list, so the Switzerland-to-Ireland leg needs no transfer mechanism. OpenAI's data processing addendum governs that onward processing to the United States and the transfer safeguards that apply to it.
• Anthropic — Standard Contractual Clauses (Modules 2 and 3), incorporated into its commercial terms.
• Pinecone — Standard Contractual Clauses (Modules 2 and 3), a UK addendum, and Swiss FADP clauses.
• Cohere — [Cohere transfer safeguard]

6.4 You may ask us for a copy of the safeguards that apply to any of these transfers.

6.5 Others we may disclose to. Authorities where we are legally required; professional advisers under confidentiality; and an acquirer, successor or group company in connection with a completed sale, restructuring or transfer of the business — in which case we will tell you.

7. Private messaging

7.1 designfinder includes private messaging inside project workspaces. We run the messaging server ourselves; messages are not sent to a third-party messaging provider.

7.2 What is stored. Message content, who sent it and when, and any files shared.

7.3 Who can read it. The participants in the conversation. We do not read your private messages, except where we must to comply with a legal obligation or to investigate a report of illegal content made under our Terms of Use.

7.4 How long. For as long as the project exists. You may delete your own messages at any time and, if you control the project, delete the project — subject to the limits in section 13.4.

8. Ranking, and the personalisation we do not do

8.1 We do not personalise ranking. We do not rank search results on your individual behaviour, your past activity or a behavioural profile. An AI answer may use the conversation context it needs to reply coherently — but no behavioural profile influences what we retrieve, how we order it, or commercial ranking. We do not build a behavioural profile for ranking or personalisation, and we have no plans to.

8.2 What decides the order: how well something matches your query, availability, and whether the brand is a paying partner. On designheroes, a commercial relationship can influence both which products we retrieve and the order in which results appear. On designcatalogs it influences the order.

8.2a Editorial qualification cannot be bought — we alone decide which brands meet the criteria for current-product coverage, and no payment affects that. But on designheroes, a qualifying brand's current products are published as part of the commercial relationship, so payment is a condition of their publication. Vintage, pre-owned, sold and archived objects are selected separately on editorial grounds and are not subject to the commercial condition that applies to new and currently produced products. Galleries and auction houses do not pay us for inclusion or verification of vintage and pre-owned objects — not a listing fee, not a commission.

On designcatalogs, whether a catalogue is in the library is our editorial decision and is not a purchase.

8.3 The full explanation is on the How our results are selected and ordered page for designheroes and designcatalogs, linked from the results.

8.4 Your search history is kept for 90 days for security, abuse prevention and aggregate analytics — not to personalise anything.

9. How long we keep things

• Account and profile data — For the life of your account, then 90 days, then deleted. The 90 days exist so an account closed by mistake or in dispute can be restored, and so we can answer a question about a closure after the fact; the basis for that period is our legitimate interest in being able to undo an irreversible action, not the contract, which has ended. Accounts dormant for 36 months are deleted, after we email you 30 days beforehand.
• Search history — 90 days.
• AI assistant conversations — signed in — Visible to you for the life of your account and deletable by you at any time. A separate pseudonymised copy for quality review: 90 days.
• AI searches — guest, before registration — Not retained as conversation history and not linked to an account. The session identifier lasts for the session; our own copy is discarded promptly — except a sampled, pseudonymised copy which may be kept up to 90 days for quality review, exactly as in §4.1a. Provider retention (4.6) applies regardless.
• Project chat messages — For as long as the project exists. You can delete your own messages at any time, subject to the limits and legal exceptions in §13.4.
• Uploaded files — Same — for as long as the project exists, deletable by you at any time.
• Saved items — For the life of your account, and deletable by you at any time.
• Brand enquiries — For as long as your account exists, so you keep your own correspondence. What the brand does with its copy is governed by that brand's own privacy notice (6.1a).
• Brand comments — For as long as the catalogue they relate to is in the library, unless withdrawn earlier under the brand's relationship with us.
• The name of the representative who wrote a brand comment — Until they close their account, or until we are informed or otherwise become aware that they no longer represent the brand — whichever happens first. We then remove their name and attribute the comment to the brand. The comment itself may remain (11.4).
• Professional-verification evidence — Kept until the decision is made and for 12 months afterwards, so we can explain or review an access decision, then deleted. The review itself is under contract; the 12 months afterwards rest on our legitimate interest in being able to document and revisit that decision.
• Usage and device data — 90 days, then aggregated so it no longer identifies you.
• Search indexes (embeddings) — Tied to the record they derive from — deleted when that record is deleted, and reached by an erasure request (13.4).
• Access and security logs — 90 days, extended only for a documented active security incident.
• Debug and application logs — 30 days.
• Consent records — currently the optional sharing of your email address with a brand (3.1, 6.1a), and any marketing consent if we ever collect one — For the duration of the consent, then 3 years after withdrawal, so we can show it was given. The record of a withdrawn consent is kept on our legitimate interest in being able to demonstrate compliance and defend a claim — not on the consent itself, which has ended.
• Backups — A rolling 35-day cycle. Deletion from live systems is immediate; backup copies expire with the cycle.

9.0a Legal obligations and claims. The periods above are our normal retention periods. Where specific data must be kept longer to comply with a legal obligation, or is necessary to establish, exercise or defend a legal claim, we keep only the data needed for that purpose and only for as long as that purpose requires. Section 13.4 explains the corresponding limit on erasure.

9.1 Where a period is expressed as a criterion — "for as long as the project exists" — that is because the purpose lasts exactly as long as the workspace does.

9.2 Section 4.6 sets out the retention practices of our AI providers and our search infrastructure — some of which we control and some of which we do not, and it says which is which.

10. Cookies and storage on your device

10.1 We use only what is strictly necessary to make the services work: keeping you signed in, remembering your preferences, and security.

10.2 We use no advertising cookies, no third-party analytics, no tracking pixels and no fingerprinting. Our analytics are self-hosted, the reports are aggregate, and we use analytics for neither advertising nor cross-site tracking.

10.3 Because everything we store on your device is strictly necessary, we do not ask for consent and we do not show a consent banner — there is nothing to consent to. This notice is the disclosure.

10.4 The full list of what we store, what each item does and how long it lasts is at [URL].

11. Personal data in the material we publish

11.1 We publish brand catalogues, spec sheets and editorial content. That material sometimes contains personal data — most often the name of the architect or designer who authored a product, occasionally a named contact inside a brand, and the name of a verified brand representative where a designcatalogs comment is attributed to them.

11.2 Why we publish it. Attributed authorship is the point of the services: on designheroes, a product only appears at all if it has a named architect or designer. For the first two categories — design authorship, and a named contact inside a brand — our basis is legitimate interests, and the interest differs between them. For an architect or designer, it is publishing an accurate professional record of design authorship. For a named contact inside a brand, it is keeping the source information about a product accurate and traceable — which is why that name is kept only while it is current (11.2b).

• For the third category — a verified representative's attribution on a designcatalogs comment — the purpose, legal basis and retention are set out in sections 3 and 9.

11.2a Where it comes from. This material reaches us from manufacturers' own catalogues, spec sheets and websites; material supplied to us by brand partners; galleries and auction houses; and public archive and auction records. A designcatalogs brand comment is different: the representative's name and the comment reach us directly from that person, through their own verified account.

11.2b How long we keep it — and it depends on which kind of name it is.

• Authorship — the architect or designer who created a product. Kept for as long as it remains part of the design-historical record, which is indefinite by design: a record of who designed what does not stop being accurate, and removing it would make the record wrong rather than private.

A named contact inside a brand. In our own structured records, kept only while it is current and relevant, and removed when it is not. Where such a name appears inside a historical document we preserve — a catalogue page as it was published — it stays as part of that document, because the record is the page. Tell us under 11.4 and we will review it.

Either way, we review a name on request under 11.4, and we correct or remove where the request is well founded.

11.3 Where we did not collect it from you directly, contacting every named person individually would involve disproportionate effort given the volume of published material. We make this information publicly available as an appropriate transparency measure in that situation, together with your rights in section 13.

11.4 If you are named in material we publish and you want it corrected or removed, write to privacy@designstandard.ch and we will deal with it properly. You do not need an account to ask. That includes a brand comment you wrote as a representative — and there the rule is already settled: once you no longer represent the brand, your name does not belong on it. When you close your account, or when we are informed or otherwise become aware that you have left, we remove your name and attribute the comment to the brand. The comment itself may remain, because its continued publication is governed by the brand's relationship with us and by applicable law.

• We depend on being told — we cannot see from our side that someone has changed jobs, and the brand is required under its contract with us to tell us promptly. If you have left the brand you do not have to wait for that: write to privacy@designstandard.ch and we will remove your name.

12. Security

12.1 Encryption in transit and at rest; access limited to those who need it; identity, messaging and content systems run by us on hosting infrastructure we control.

12.2 No service is perfectly secure. If personal data is breached, we notify the competent authorities and the people affected where, and within the time limits, applicable law requires — including the GDPR's 72-hour deadline for notifying a supervisory authority where that applies.

13. Your rights

13.1 You may ask us to: give you access to your data · correct it · delete it · restrict how we use it · give you a copy in a portable format · and you may object to processing based on legitimate interests, including on grounds relating to your particular situation.

13.2 How to exercise them. Write to privacy@designstandard.ch. You may also contact our EU representative (section 1.3). We do not charge for answering. Where a request is manifestly unfounded or excessive we may decline it, as the law allows, and we will tell you why.

13.3 How long we take. We respond within one month. Where a request is complex or you have made several, we may extend by a further two months — and if we do, we will tell you within the first month and say why.

13.4 What deletion reaches — stated honestly, because two limits are real.

• Where the right to erasure applies, and subject to the exceptions the law allows — for example where we must keep something to comply with a legal obligation, or to establish, exercise or defend a legal claim — we delete your personal data from our databases, our search index including the embeddings derived from your text, our logs, and our backups as they expire on the 35-day cycle. Article 17 is not an unconditional right to deletion, and we would rather say so than imply otherwise.

Two limits on what deletion reaches in practice:

• Copies held by our AI providers for misuse detection (section 4.6). We stop sending; we cannot pull back what is already inside their window — for the periods set out in section 4.6.
• Content you contributed to another person's project workspace. It may remain visible to that project's participants where applicable law permits us to keep it — for example where an Article 17 exception applies, or where the data is still necessary for a continuing lawful purpose that is not overridden by your rights. Where neither applies, we remove or anonymise the personal data in it, whether or not you deleted it before closing your account.

13.5 What a data export contains — and does not. You may have a copy of the data you provided: your account and profile, professional-verification information you provided, your projects, your saved items, files you uploaded, brand enquiries and any comments you submitted, your own assistant conversations, your search history and your own messages, in a machine-readable format.

A copy is not control: a comment you submitted on behalf of a brand can be exported by you, but whether it continues to be published is decided under the brand's relationship with us (see the Terms, clause 10.5).

• It does not include data we derived rather than received — the search embeddings, for example — or data we hold on a legitimate-interests basis such as security logs. They are outside the PORTABILITY right. Access and erasure are separate rights, assessed under their own conditions and exceptions — so being outside an export is not the same as being beyond reach. If you ask what we hold, we answer for that data too.

13.6 Complaints. If you think we have handled your data badly, please tell us first — we would rather fix it. You also have the right to complain to a supervisory authority:

• In Switzerland: the Federal Data Protection and Information Commissioner (FDPIC), Bern.
• In the EU or EEA: because we have no establishment in the EU, there is no single "lead" authority. You may complain to a supervisory authority, in particular in the Member State of your habitual residence, your place of work, or the place of the alleged infringement.
• You may also contact our EU representative (section 1.3).

14. Children

14.1 The services are not intended for anyone under 13 and are not directed to children.

14.2 We do not ask for your date of birth or your age. If we learn that someone under 13 is using the services, we take reasonable steps, including closing any account, and handle the personal data in accordance with this Policy. If you believe a child has given us personal data, write to privacy@designstandard.ch.

15. Changes to this policy

15.1 This policy is version 1.0, effective [effective date]. The version and date at the top are how you know which one you are reading.

15.2 We keep superseded versions at stable URLs at [policy archive URL], so you can see what applied when.

15.3 For any change that materially affects you, we give at least 15 days' notice before it takes effect and say what changed. If you have an account, we notify you by email. If you use the services without one, we display the notice prominently in the service before you continue. Minor corrections we publish with a new version number and date.

Companion to our Terms of Use. Questions to privacy@designstandard.ch.