Last updated 28 October 2026

Privacy policy

This policy covers the hosted Suit at suit.humantech.ch. Suit matches people, so it holds data about two kinds of people: organizers, who have an account and run matchings, and the participants they match. We keep that data so Suit can work, and for nothing else. No ads, no tracking in Suit, no selling or sharing your data.

Who is responsible

For organizers' accounts: Massimo Brivio, trading as Humantech, Switzerland. The postal address is in the Impressum. For anything about your data, write to hey@humantech.ch.

For participants: the organizer who runs the matching decides what to ask and what to do with the answers, so they're responsible for that data. Humantech stores and processes it only on their behalf and on their instructions, as described here. If you're a participant, ask the organizer first: they can see, correct and delete your data. If you can't reach them, write to us and we'll pass your request on.

If someone runs Suit on their own server, they're responsible for the data there, and this policy doesn't apply.

What Suit stores about organizers

• Your account: your email address and your password, kept only as a one-way hash we can't turn back into the password. Also when you signed up and confirmed your address, and a new address while you're changing it.
• Your projects: their names and notes, the criteria you define, intake settings and texts, the rules you set, and the matchings Suit computes.
• Where you're signed in: for each sign-in, the IP address and the browser or device it came from, so you stay signed in. It's deleted when you sign out.
• Tokens you create for the command-line tool or agents: the name you give them, a hash of the token and when it was last used.

What Suit stores about participants

• What the organizer enters or imports, or what participants answer in an intake form: a name, optionally an email address, and an answer to each of the project's criteria. Depending on the project, that can be languages, skills, interests, an age, a level, a short text or an address.
• Consent: when a participant answered an intake form, the consent text they accepted and when, and when they confirmed their email address.
• Matchings: who was matched with whom, the scores, and the emails the organizer sent about it (to whom and when).

Organizers should ask only for what the matching needs. Suit isn't made for sensitive data such as health, religion or political views; please don't use it for that.

Intake forms and consent

An organizer can share a form where participants answer for themselves. The form shows the organizer's introduction and their privacy and consent text, which the participant must accept to send it. Suit then emails the participant a link to confirm their address; until they do, their answers aren't used in any matching. Answers that aren't confirmed within 7 days are deleted. Participants can't change their answers afterwards; they ask the organizer, who can.

Server logs and cookies

For each request, the server logs the IP address, the page asked for, the time and the browser. Passwords, email addresses, tokens and participants' answers are left out of the logs. Logs are used to keep Suit running and secure, and deleted after at most 30 days.

Suit sets two cookies, both needed for it to work: one that keeps organizers signed in, and one that remembers, for example, the page to return to after signing in. There are no analytics or advertising cookies, and no page loads anything from another company's servers: even the fonts come from Suit itself.

Why

Only to give organizers Suit: to sign you in, store your projects and participants, compute matchings, send the emails below, and keep the service secure. Your data and your participants' data aren't read by us, analysed for our own purposes, used to train AI, or shown to anyone else. We'd look at them only if you ask us to (for example to help with a problem) or if the law requires it.

Suit emails organizers only when needed: to confirm your address, to reset your password, and when your email address changes. It emails participants only to confirm an intake response, and with the messages the organizer writes and sends from a matching. No newsletters or marketing.

Where it's kept, and who processes it

• OVHcloud (OVH SAS, France) rents us the server Suit runs on, in a data centre in Germany. Everything Suit stores is on that server.
• Brevo (Sendinblue SAS, France) sends Suit's emails, to organizers and to participants. It receives the recipient's email address and the email itself, and records for us whether each email was delivered, opened, and its link clicked: an invisible image in the email tells it when it's opened, and the link passes through Brevo on its way to Suit.
• Mistral AI (Mistral AI SAS, France) turns texts into numbers so Suit can compare them by meaning. Only the answers to criteria compared by meaning are sent to it, as bare texts (a request can hold several), without the participant's name, email or other answers. Suit keeps the result (a list of numbers, not the text) so the same text isn't sent twice, and deletes it within a day or two once no participant's answer uses that text any more. Mistral doesn't use what it receives through its paid API to train its models, and keeps it for at most 30 days to detect abuse.
• OpenStreetMap Nominatim (OpenStreetMap Foundation, United Kingdom) finds addresses on the map, for criteria compared by distance. Only the address is sent, without the participant's name or any other answer. Suit keeps each address it looked up with its coordinates, without any link to a person or a project, so the same address isn't looked up twice, and deletes it within a day or two once no participant's answer uses it any more.
• Backups: OVHcloud makes a copy of the whole server every day, kept in the EU and deleted automatically after at most a week.

Germany, France, the United Kingdom and the EU are recognised by Switzerland as having adequate data protection. We don't send data to any other country.

If you use Suit through an agent or AI assistant with one of your tokens, what it reads from Suit, participants' data included, goes to that service, under its own terms. You choose that, and you can revoke the token any time in Settings.

How long we keep it

• Accounts and projects: as long as the account exists. Deleting a project deletes its participants, intake responses, matchings and share links at once; deleting an account deletes all its projects.
• Participants: until the organizer deletes them, their project or their account. Suit doesn't delete them on its own after a set time, so organizers should delete what they no longer need.
• Unconfirmed intake responses: deleted after 7 days.
• Uploaded spreadsheets: Suit reads the rows and keeps them only until the organizer finishes the import, and at most a day.
• Looked-up addresses and texts' numbers: deleted within a day or two once no participant's answer uses them.
• Backups: copies of deleted data are deleted as the backups age out, within a week.

Deleting your account

In Suit, open Projects → Settings → Delete account and enter your password. This deletes your account, your projects with everyone in them, and your tokens immediately, and can't be undone. If you can't sign in any more, write to hey@humantech.ch from the address of your account and we'll delete it for you.

Your rights

You can ask what data we hold about you, and have it corrected or deleted. Organizers can take their data with them: every matching exports to a spreadsheet, and Suit's API returns everything in your account as JSON, with a token from Settings. Participants ask the organizer, as above. Write to hey@humantech.ch; we answer within 30 days.

Suit follows the Swiss Federal Act on Data Protection (FADP). If you're in the EU, the GDPR applies too: we process organizers' data to provide the service they signed up for (Art. 6(1)(b)) and, for server logs and backups, because keeping Suit secure and the data safe is a legitimate interest (Art. 6(1)(f)). For participants' data, we're the organizer's processor (Art. 28), and the organizer decides on what basis they collect it, usually the consent their intake form asks for. If you think we handle your data wrongly, you can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, to the data protection authority where you live.

Security

Suit is only reachable over encrypted connections (HTTPS). Passwords and tokens are stored as hashes, each account sees only its own projects, and intake forms and shared results are reachable only by their secret links.

Changes

If this policy changes, the new version is published here with a new date. If a change matters to how your data is used, we'll email organizers before it applies.