Eidari Beta

Privacy notice

Last updated: October 27, 2026

Who is responsible?

The controller for this website, the waitlist and the beta is:

This notice follows the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR).

The waitlist and the beta: what data, and what for?

When you sign up, we store your email address, your first name if you give it, the AIs you use, whether you joined the waitlist or signed up as a beta tester, the time and version of your consent, your browser language, and where you came from (for example a campaign tag in the link).

We use this data only to tell you about the launch and access to the beta, and to understand which AIs to support first. If you sign up as a beta tester, we will also email you as soon as you can try it early, and ask for your feedback. No selling, no sharing for advertising.

To prevent abuse, we keep a non-reversible check value (a salted hash) of your IP address for at most 24 hours, never the address itself.

The waitlist, accounts and the beta are for people aged 16 or older. If you are younger, please don’t sign up.

Your beta profile

If you create an account and sign in, you can keep a profile in Eidari: what you want the AIs you use to know about you. This part applies only to people with an account.

What data: your email address and account ID; the statements in your profile (written by you, imported from text you paste, a notes file you choose, a LinkedIn data export or profile PDF, or proposed by an AI you connected); the history of changes and the evidence an AI gave for them; your choices about which AI may read or write which part (private or work) and whether it may see entries you marked personal; the AIs you connected and when they used your profile (tool name, time, duration, number of statements, never the text); short check results; your setup progress; your answers to the in-app questionnaire and which interview questions you answered or skipped; the time and version of your consent; and the version of the terms of service you accepted, with the time you accepted them (to prove the contract, Art. 6(1)(b) GDPR).

Possibly sensitive data: a profile about your personality, values, goals, habits and relationships can reveal sensitive things about you. Eidari is built to refuse statements about health, religion or beliefs, politics, sexuality and finances, and checks every new statement for them, but no filter is perfect. We therefore ask for your explicit consent before your profile is created (current version: 2026-10-26-profile-v1).

What for: only to keep your profile, show it to you, and hand the parts you allow to the AIs you connect, so they understand you. And to run and improve the beta. No selling, no advertising, no training of AI models on your profile by us.

Legal basis: your explicit consent (Art. 6(1)(a) and Art. 9(2)(a) GDPR; Art. 6(6) and (7) FADP). You can withdraw it at any time by deleting your account. Withdrawal applies from then on.

Where it is stored: in a Supabase database in the EU (Stockholm, Sweden). The app runs on Vercel, which processes your requests in its data centers.

Encryption, honestly: the text of your statements, their evidence and history, your questionnaire answers, and your check comments are encrypted with AES-256-GCM before they are stored. The key is held on our server, so our server can decrypt it to show it to you and to the AIs you connect. That means it is not end-to-end encrypted and not encrypted on your device. Data is encrypted in transit (TLS) and at rest by our providers. Each account can only read its own rows: access is enforced in the database (row-level security).

Imports: if you import a LinkedIn data export, the file is read in your browser. Only your headline, summary, industry, positions, education, skills, languages, certifications and projects are turned into proposed work statements, and only those lines are sent to our server, where they wait for your review. Connections, messages, invitations and the rest of the export are not read. The file itself is not uploaded or stored, and this import does not use an AI model. A LinkedIn profile PDF is handled the same way: it is read in your browser, only the work details listed on the import page become proposed statements, your name, location and contact details are skipped, and the PDF is not uploaded. A Markdown or text file you choose is read in your browser and then handled like text you paste (see AI checks).

AI checks: to check new statements for sensitive topics and to turn text you paste (or a notes file you choose) into statements, the text is sent to Google’s Gemini model through the Vercel AI Gateway (Vercel Inc. and Google, USA). It is processed to answer that one request. Where data reaches the USA, we rely on the EU-U.S. and Swiss-U.S. Data Privacy Framework or Standard Contractual Clauses.

The AIs you connect: when you connect an AI such as Claude or ChatGPT, it reads the parts of your profile you allowed, and may propose changes. That AI’s provider handles what it receives under its own privacy policy. You can withdraw an AI’s access at any time under Connected AIs.

How long: until you delete your account, or until the beta ends and we delete beta accounts, whichever comes first. We will tell you before the beta ends so you can export your profile.

Your rights, self-service: under Account in the app you can export your profile as a JSON file (access and data portability) and delete your account and profile. Deleting removes your account, all statements, their history, checks, connections, your consent records and your waitlist entry right away. Short-lived server logs and provider backups are overwritten on their normal cycle. You can also correct any statement in the app, or write to us for anything else.

Feedback: when you use the Feedback button, answer a “Was this easy?” question or our one week-one email, we store what you send (your rating and text) with your account, the page address, the time and your browser type, so we can fix problems and improve Eidari during the beta. We never attach your profile. Only we can read it, and it is deleted with your account. Legal basis: our legitimate interest in improving the service (Art. 6(1)(f) GDPR).

Website analytics with Google Analytics

Only if you click Accept in the cookie banner, we use Google Analytics 4 to understand how people find and use this website. If you decline or do nothing, no Google Analytics code is loaded and no analytics cookies are set.

Provider: Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland, and its parent company Google LLC, 1600 Amphitheatre Parkway, Mountain View, CA 94043, USA.

What is collected: pseudonymous usage data such as the pages you view and for how long, the page or campaign that brought you here, clicks, your device type, operating system, browser and screen size, your language, and your approximate location (country and region) derived from your IP address. According to Google, Google Analytics 4 does not log or store IP addresses. We have turned off Google signals, ad personalization and advertising features. We do not send Google your name, your email address or your waitlist details.

Cookies: _ga and _ga_<ID> tell visits apart with a random ID. We set them to expire after about 13 months. Google keeps the analytics data for at most 14 months and then deletes it.

Legal basis: your consent (Art. 6(1)(a) GDPR, and, for storing and reading cookies on your device, Art. 5(3) of the ePrivacy Directive as implemented in your country).

Transfer to the USA: Google LLC may process the data in the USA. Google LLC is certified under the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework, which the European Commission and the Swiss Federal Council recognize as providing an adequate level of protection. Google also offers Standard Contractual Clauses.

Withdrawing your consent: at any time, as easily as you gave it. Open Cookie settings (also at the bottom of every public page) and click Decline. We then stop Google Analytics and delete its cookies. You can also delete cookies in your browser. Withdrawal applies from then on and does not affect earlier processing. More in Google’s privacy policy.

Cookieless page statistics with Vercel Web Analytics

To count page views, we also use Vercel Web Analytics by our hosting provider Vercel Inc. It sets no cookies and stores nothing on your device. It records the page, the referring website, your country, browser, operating system and device type. Visitors are told apart only by a hash that is recalculated every day and cannot be used to identify you or follow you across websites. Legal basis: our legitimate interest in understanding how the website is used (Art. 6(1)(f) GDPR).

Signing in with Google

If you choose Continue with Google, Google (Google Ireland Limited / Google LLC) confirms your identity to us. We ask Google only for your email address, your name and your profile picture link (scopes openid, email and profile), and we use only the email address to create and sign in to your account. We get no access to your Gmail, contacts or other Google data. Google learns that you signed in to Eidari, under Google's own privacy policy. Legal basis: performing our contract with you (Art. 6(1)(b) GDPR). You can always sign in with an email link instead.

Bot protection with Cloudflare Turnstile

To keep bots from abusing our sign-in emails, the sign-in forms use Cloudflare Turnstile by Cloudflare, Inc. (USA). It runs a short check in your browser, usually without any puzzle. For this, Cloudflare processes your IP address and technical browser and device data. Turnstile sets no advertising cookies and is not used to track you across websites. Legal basis: our legitimate interest in protecting the service from abuse (Art. 6(1)(f) GDPR).

Legal basis for the waitlist

Your consent (Art. 6(1)(a) GDPR). You can withdraw it at any time. Withdrawal applies from then on and does not affect earlier processing. For the short-lived abuse check of your IP address, our legitimate interest in keeping the form free of spam (Art. 6(1)(f) GDPR).

Who processes data for us, and where?

• Supabase (Supabase, Inc., USA) stores the waitlist, beta accounts and beta profiles in a database in the EU (data center in Stockholm, Sweden), and sends sign-in emails.
• Vercel (Vercel Inc., USA) serves the website and processes the connection data this technically requires, such as your IP address, in short-lived server logs.
• Resend (Resend, Inc., USA) sends our emails, such as sign-in links and earlier beta invites. It receives your email address and the email content.
• Vercel AI Gateway and Google Gemini check new profile statements and turn pasted text into statements, as described above. Only for beta profiles.
• Google Analytics (Google Ireland Limited / Google LLC), only with your consent, as described above.
• Vercel Web Analytics (Vercel Inc.), cookieless page statistics, as described above.
• Google Sign-In (Google Ireland Limited / Google LLC), only if you choose Continue with Google, as described above.
• Cloudflare Turnstile (Cloudflare, Inc., USA), bot protection on the sign-in forms, as described above.

They act on our behalf under data processing agreements. Where data may reach the USA in the process, we rely on the EU-U.S. and Swiss-U.S. Data Privacy Framework or the European Commission’s Standard Contractual Clauses.

For how long?

Waitlist and beta details: until you unsubscribe, or at the latest 12 months after the public launch, when the waitlist is no longer needed. Then we delete them. The IP check value: at most 24 hours. Analytics data: see above. Your cookie choice: 6 months.

Unsubscribing and your rights

You can unsubscribe at any time: send a short email to info@virtue-compliance.ch. Every email we send will also contain an unsubscribe link. You have the right to access, correct and delete your data, to restrict or object to processing, and to data portability. If you think we are not handling your data properly, you can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or to a data protection authority in the EU, for example where you live.

Cookies and local storage

We set no advertising cookies. Analytics cookies are only set after you click Accept (see above). Your choice itself is saved in a small first-party cookie, eidari_consent, and in your browser’s local storage for 6 months, so the banner doesn’t ask you again on every page. When you sign in to the app, a technically necessary sign-in cookie is set.

Changes

If we change how we handle your data, we update this notice and the date at the top. For significant changes that affect you, we will ask for your consent again where the law requires it.