Privacy & Data Protection

Last updated: 23 March 2026

1. Controller

The controller responsible for data processing is:

512M AG
Unter-Altstadt 28
6300 Zug, Switzerland
UID: CHE-498.206.366
Contact: info@256m.io

2. EU Representative

512M AG does not maintain an establishment in the European Union. Given that Switzerland is recognised as providing an adequate level of data protection by the European Commission (Adequacy Decision 2000/518/EC, reaffirmed), and the limited scope of our current data processing activities, we have not appointed an EU representative under GDPR Art. 27 at this time. EU data subjects may exercise their rights by contacting us at info@256m.io.

3. What We Collect and Why

Data Source Purpose Legal Basis
Name, email, interestsWaitlist formPre-launch notificationsConsent (form submission)
Name, email, risk profile fields*Quote widget / Telegram botProviding indicative quoteConsent (explicit submission)
Name, email from quote leadsQuote widget / Telegram botLead nurturing and follow-upLegitimate interest (Art. 6(1)(f) GDPR)
Telegram user ID, session stateTelegram botConversational flow managementLegitimate interest
Page views (anonymised, no PII)Plausible AnalyticsWebsite improvementLegitimate interest (cookieless)
Email engagement (opens, clicks)BrevoMarketing sequence deliveryConsent

* Risk profile fields: watch value, brand tier, recognizability, country, urban density, postcode risk, age group, wear frequency, claims history, storage security, GPS tracking, purchase recency, coverage type.

4. Data Processors

  • Supabase Inc. — Database hosting — EU (Stockholm, eu-north-1) — No international transfer
  • Brevo (Sendinblue) — Email delivery — EU-based (Paris) — No international transfer
  • Plausible Analytics — Web analytics — EU-based — No personal data processed
  • Telegram — Bot interaction — UAE/UK — See International Transfers
  • Netlify Inc. — Website hosting — US — See International Transfers

5. Retention Periods

  • Quote lead PII (name, email): Automatically stripped after 90 days; anonymised record retained for actuarial modelling
  • Waitlist data: Retained until product launch or deletion request
  • Telegram bot sessions: Automatically deleted after 24 hours
  • Plausible analytics: Aggregated only, no PII retained

6. Your Rights

Under GDPR Art. 15–22 and the Swiss Federal Act on Data Protection (nDSG) Art. 25–29, you have the right to:

  • Access your personal data
  • Rectify inaccurate data
  • Request erasure of your data
  • Data portability
  • Object to processing based on legitimate interest
  • Withdraw consent at any time

To exercise any of these rights, contact us at info@256m.io.

You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland or the relevant EU supervisory authority.

7. International Transfers

  • Netlify (US): Protected by EU Standard Contractual Clauses (SCCs)
  • Telegram (UAE/UK): Based on explicit consent (GDPR Art. 49(1)(a)). When you interact with our Telegram bot, you explicitly consent to the transfer of your Telegram user ID and session data to Telegram's servers in the UAE and UK. You may withdraw this consent at any time by ceasing to use the bot and requesting deletion of your data at info@256m.io.
  • All other processors: EU-based, no transfer required
  • Switzerland is recognised as providing an adequate level of data protection by the European Commission.

8. Cookies

We do not use cookies. Our analytics provider (Plausible) is fully cookieless. No cookie consent banner is required.

9. Changes to This Policy

We may update this policy. Where changes materially affect the processing of personal data collected under your consent, we will notify you by email before those changes take effect. For all other changes, the updated policy takes effect upon publication on this page.