Privacy Policy
This policy explains what personal data Prospex processes, why, and what you can do about it. It is written under the Swiss Federal Act on Data Protection (FADP / revDSG). Where the GDPR applies — to visitors in the EU and to people in the EU who appear in the public register data we process — it applies in addition, and this policy is written to satisfy both.
Prospex is a business-to-business service. Almost all of the data it handles is about companies. Some of it is nonetheless personal data, because a company officer named in an official register is a person, and this policy is specific about that.
1. Who is responsible
The controller is:
Sidorenko Consulting
Semion Sidorenko
Chemin du Frêne 7
1004 Lausanne
Switzerland
For anything in this policy, write to hello@prospex.ch.
2. If you have a Prospex account
We hold the following about our customers:
- Account — your email address, which is also your username, a hashed password (never the password itself), the date you signed up and the date you last signed in.
- Preferences — the description of what you sell, and the sectors, company sizes, cantons and customer audiences you filter on, plus the job role you selected during onboarding.
- Use of the service — the leads you have marked as reviewed, the searches you have saved, the feedback you have given on individual leads, the companies you follow, and your email digest settings.
- Billing — your Stripe customer and subscription identifiers, your subscription status and the end of the current period. No card data ever reaches Prospex; payment details are entered on Stripe's own pages and stay with Stripe.
- HubSpot — if, and only if, you connect your HubSpot account, we store the access tokens for that connection and records of what we have written to your CRM.
- Server logs — ordinary web-server and application logs, including IP addresses, kept for operations and security.
The purpose is providing the service you signed up for, and the legal basis is the contract between us (GDPR art. 6(1)(b) / FADP art. 31(2)(a)). Billing records are also kept to meet Swiss accounting obligations.
3. Company and register data about other people
Prospex collects publicly available information about Swiss companies and turns it into sales signals for its customers. Where the Swiss commercial register publishes them, that information includes the names, functions and signing authority of company officers — directors, managing directors, partners, and authorised signatories. These names come from official public notices, and they can appear in the signal headlines we show to our customers, for example "New managing director appointed". The same notices state each person's commune of origin or nationality and their place of residence, and we keep both as published. Officers' names, and the notices themselves, also appear on the company's public page.
All of it comes from publicly accessible sources, of the following kinds: the Swiss commercial and intellectual-property registers and the official gazettes that publish their notices, both federal and cantonal; publicly advertised job vacancies; public company websites and the public pages and posts companies publish about themselves on social and professional networks; and public business directories and startup listings. We do not buy personal data from data brokers.
The legal basis is our legitimate interest, and our customers' legitimate interest, in commercial information about businesses (GDPR art. 6(1)(f) / FADP art. 31(1)). We have weighed that against the interests of the people concerned. In our assessment it prevails because: the data has already been published officially, by law, precisely so that the public can rely on it; we process it only in a person's professional capacity, as an officer of a company; we do not build behavioural profiles of individuals, infer anything about their private life, or process any special categories of data; and what we hold about any one person is what the register published about them: name, commune of origin or nationality, place of residence, function, signing authority and the dates of the entries, for each company they are registered with.
An entry taken unchanged from the Swiss commercial register, or from the official gazettes that publish its notices, stays visible, including after an objection. The law makes these entries public so that anyone can check who acts for a company and who has acted for it, and Prospex shows them, with their history, for the same purpose. We correct such an entry when it departs from the published notice.
We also use large language models to summarise and classify this material. They generate the wording of a signal; they do not make decisions with a legal or similarly significant effect on anyone.
4. Analytics
Every page of this site, including the public ones, loads PostHog (PostHog EU Cloud). Your browser sends this data to g.prospex.ch, a domain of ours that forwards it to PostHog's European infrastructure; the recipient is PostHog either way. It records page views and interactions, along with your IP address, and sets cookies in your browser. If you are signed in, we additionally send PostHog your user id, your email address and your username, so that product usage can be attributed to an account.
Our servers also send PostHog the steps of the signup and subscription process — that an account was created, that the subscription page was shown, that a checkout was started, and that a subscription started, renewed or changed status, with the amount invoiced. Your current subscription status is stored against your profile there. No card details ever reach PostHog; those are held only by Stripe (section 5).
PostHog also runs the support chat behind the Help button inside the product. It opens only when you click it, and it runs for signed-in customers whatever you chose for Analytics — it is a service you asked for rather than measurement of you. What it holds is the conversation itself, your user id, and one identifier for the chat, which is written to your browser's local storage as the product loads so that you find your own thread again. Nothing else about your visit is recorded when you have Analytics switched off.
We also load the tracking code of HubSpot, the CRM we keep our customer records in. It sets the cookies __hstc, __hssc, __hssrc and hubspotutk, and records the pages you view along with technical details of your browser that HubSpot uses to recognise a returning visitor. If you are signed in, it also receives your email address, so that those page views appear on your customer record. Your browser sends this data to prospex.ch, which forwards it to HubSpot's European infrastructure; the recipient is HubSpot.
We also run the Reddit advertising pixel and report conversions to Reddit from our servers. The pixel loads on every page, sets a first-party _rdt_uuid cookie in your browser and reports that a page was viewed. Separately, our servers tell Reddit that an account was created, that a checkout was started, and that a subscription started — the last with the amount invoiced — together with a hashed (SHA-256) form of your email address, a hashed account identifier, your IP address, your browser's user agent, and the Reddit click id from the ad you arrived through. Reddit never receives your email address in readable form, and never receives card details.
We run the Google Ads tag on the same terms. It loads on every page, and sets first-party cookies beginning _gcl that record the click id of the ad you arrived through — which is what lets a signup weeks later be attributed to it. When you create an account, start a checkout or start a subscription, the tag reports that event to Google, the last with the amount invoiced, along with a hashed (SHA-256) form of your email address. As with Reddit, Google never receives your address in readable form, and never receives card details. Unlike Reddit, nothing here is sent from our servers: if you decline marketing cookies the event is held unreported.
We also run the OpenAI advertising pixel, which measures the ads we buy inside ChatGPT. It loads on every page, reports that a page was viewed and may set cookies in your browser. When you create an account, start a checkout or start a subscription, the pixel reports that event to OpenAI, the last with the amount invoiced. As with Google, nothing here is sent from our servers: if you decline marketing cookies the event is held unreported. No email address, hashed or otherwise, reaches OpenAI, and neither do card details.
Browser analytics and advertising cookies require your consent. CookieYes manages your choices worldwide. You can accept or decline Analytics (PostHog and HubSpot) and Advertisement cookies in the banner, and change your choices using the Cookies link. Necessary cookies for signing in and remembering your choices remain active. CookieYes stores your choice in the cookieyes-consent cookie for up to one year. We keep a copy of that choice in our own consent_mirror cookie for up to one year, so that it also applies when you come back from signing in with Google or from a payment page. Until you make a choice, browser analytics stay off. If you decline Analytics, PostHog measures visits and basic interactions without analytics cookies or stored visitor identifiers. It estimates visitor counts using a server-side hash that changes daily. Your IP address is not stored with these visits. Account identification and session recordings remain off in this mode. After you accept Analytics, we also set our own first_touch cookie. It remembers the first page visited with analytics enabled, its language, the referring domain and campaign parameters for 30 days, so we can understand which visits lead to an account. It contains no visitor identifier. Withdrawing analytics consent removes this cookie. . PostHog is also where our internal observability data about model calls is sent.
5. Who else processes the data
We use the following providers. They act on our instructions and are bound by data-processing terms.
| Provider | Purpose | Where |
|---|---|---|
| Cloudflare | DNS, CDN and web application firewall | Global |
| PostHog | Product analytics | EU |
| Stripe | Payments and subscription billing | EU / US |
| HubSpot | CRM sync — only if you connect it | EU / US |
| HubSpot | Customer records and website tracking | EU / US |
| Reddit (Reddit Ads) | Advertising measurement | US |
| Google (Google Ads) | Advertising measurement | US |
| OpenAI (OpenAI Ads) | Advertising measurement | US |
Our database, search index and job scheduler run on our own server; they are not third parties. We do not sell personal data, and we do not share it with anyone outside this list except where the law requires it.
6. Transfers outside Switzerland and the EU
PostHog keeps data in Europe. Stripe, HubSpot, Reddit, Google and OpenAI involve processing in the United States, and Cloudflare operates globally. Those transfers rely on the European Commission's Standard Contractual Clauses, on the Swiss–US Data Privacy Framework where the recipient is certified, and on the corresponding recognition under Swiss law.
7. How long we keep things
Account data is kept for as long as you have an account, and afterwards only where a legal retention period requires it — invoicing records, for instance, for ten years under Swiss commercial law. Close your account and write to us and we will delete the rest.
Data collected from the public sources in section 3 is kept for as long as Prospex operates, as the raw documents we fetched and the records extracted from them. The original documents are what let us correct a mistake later.
8. Your rights
You have the right to:
- ask what personal data we hold about you, and get a copy
- have inaccurate data corrected
- have data deleted where the law provides for it
- object to processing based on legitimate interest; commercial register entries stay visible (section 3)
- receive data you gave us in a portable form
- withdraw any consent you have given, without affecting what was done before
To exercise them, write to hello@prospex.ch.
If you are not satisfied, you can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC, Feldeggweg 1, 3003 Bern), or to the supervisory authority of your EU member state.
9. Security
All traffic to the site is served over TLS. The origin server sits behind Cloudflare and accepts web traffic only from it; the database listens on the local interface only and is not reachable from the internet. Passwords are stored as salted hashes and are never recoverable, by us or by anyone else. Administrative access is limited to the owner.
We do not claim that stored data is encrypted at rest. No system is perfectly secure, and we say what we actually do rather than what sounds reassuring.
10. Changes
We will update this policy when the service changes. The date at the top is the version in force. Material changes affecting customers are announced by email.