Privacy Policy

Effective date: 28 August 2026

This is a non-commercial, independent project. Bay & Byte is not a registered business. This policy explains what data is collected when you visit bayandbyte.com or create an account, and how it's handled, in line with the Swiss Federal Act on Data Protection (revFADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

1. Who runs this site

Dr.-Ing. Christoph Schön
6300 Zug
Switzerland
Email: contact@bayandbyte.com

2. What data is collected

2.1 Account and profile data

Creating a Bay & Byte account stores the full name and email address you provide, and the role you sign up as (individual, garage, or vendor). If you set up a new garage or vendor company, we also store the company name, postcode, city, and country you provide; if you join an existing company instead, an existing member of that company must approve your access before it becomes active.

Depending on how you sign up, you either set a password or use a passwordless "magic link" sent to your email — that email, and the session cookie that keeps you signed in afterwards, are handled directly by our authentication provider, Supabase (see the table below, and Cookies below).

If someone shares their personal invite link with you and you sign up through it, we record which account referred you. This is used only for internal tracking and is never shown publicly.

You can view and edit your account details, or permanently delete your account, at any time from your account page.

2.2 Reviews

Submitting a review stores your ratings across four categories (ease of setup, value for money, customer support, reliability) and any free-text answers you provide. Reviews are not anonymous: your name is shown publicly next to your review as a first name and last initial (e.g. "Jane D."), and if your account is linked to a garage, that garage's name is shown as well. Please keep this in mind before writing a review — avoid including anything you wouldn't want to be public.

2.3 Vendor company and team data

Approved vendor accounts can edit their company's name, postcode, city, and country, and can create and edit their own tool listings. Every member of a vendor account — including anyone still awaiting approval — can see the full name and email address of every other member of that same company, so that existing members can review and approve colleagues asking to join.

2.4 Tool images

Vendor accounts can upload images (such as a hero image) for their own tool listings. Uploaded images are stored with Supabase (see the table below) and are publicly accessible, like the rest of a tool listing. Tool logos are handled separately and are never uploaded — they are fetched automatically from each tool's own website favicon.

2.5 Tool suggestions

If you submit a tool via the "Suggest a tool" form, we store the tool name, website, any note you provide, and your email address. Your email is stored in a separate, non-publicly-readable table and used only to follow up on your suggestion if needed (e.g. to ask a clarifying question before approval) — it is never displayed publicly or attached to the tool listing itself.

2.6 Site analytics

This site uses PostHog for analytics, running in cookieless mode: no persistent tracking cookie or cross-visit identifier is set. Each pageview and a small number of interaction events (e.g. which filters are used, which tool listings are opened) are recorded anonymously to understand how the site is used. Session recording is disabled.

You can stop this at any time — your choice is remembered on this device and takes effect immediately.

3. Cookies

Staying signed in requires one strictly necessary cookie, set by our authentication provider (Supabase), so your browser stays logged in between visits. This cookie is required for the site to work for signed-in users and is never used for tracking or advertising — it is separate from the analytics described above, which deliberately avoids cookies altogether. If you don't create an account, no such cookie is set.

4. Why data is processed

• Providing the service you sign up for: creating and running your account, letting you write reviews, and letting vendors manage their own tool listings
• Improving the site: understanding how visitors use it, to fix problems and improve the experience
• Reviewing submissions: evaluating tool suggestions and account sign-up requests before approving them
• Sending you service emails: for example sign-in links, password resets, or notifications when your account is approved

5. Legal basis

• Contract necessity (Art. 31 revFADP / Art. 6(1)(b) GDPR): for account, review, and vendor/tool data needed to provide the features you've signed up to use
• Legitimate interest (Art. 31 revFADP / Art. 6(1)(f) GDPR): for anonymous, cookieless analytics needed to understand and maintain the site, and for reviewing submissions before they're published. You can object to the analytics part at any time via the opt-out above.
• Note for EU visitors specifically: GDPR's stricter consent rules may apply to you individually depending on how analytics are configured; the opt-out above is available regardless.

6. Third-party services used

7. International data transfers

Some providers above may process data outside Switzerland/the EEA (Vercel and Resend are both US-based companies). Where this happens, we rely on the safeguards those providers offer, such as standard contractual clauses or equivalent frameworks.

8. Data retention

• Account data (profile, company details): retained for as long as your account exists; you can delete your account yourself at any time from your account page
• Reviews: retained for as long as the associated account or tool listing exists, since they're displayed publicly as part of that listing
• Vendor team membership: retained for as long as you remain part of that vendor account
• Tool suggestions (including the submitter's email address): retained until reviewed; rejected suggestions may be deleted, including the associated email
• Analytics data: retained per PostHog's platform default retention for this project; since events are cookieless and anonymous, they cannot be tied back to a specific visitor to delete individually

9. Your rights

Under Swiss and (where applicable) EU data protection law, you have the right to:

• Request a copy of data held about you
• Request correction of inaccurate data
• Request deletion of your data — or use the self-service delete option on your account page
• Object to processing based on legitimate interest
• Withdraw consent at any time, where consent is the basis for processing

To exercise any of these, contact contact@bayandbyte.com.

10. Right to complain

If you believe your data protection rights have been violated, you may lodge a complaint with:

Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1, 3003 Bern, Switzerland
https://www.edoeb.admin.ch/

11. Data security

• HTTPS encryption for all traffic
• Access controls on the underlying database (Row Level Security), governing who can read or write account, review, and vendor data
• Administrative access, used to moderate tool suggestions and account approvals, is restricted to the site operator
• No advertising trackers or data resale of any kind

12. Changes to this policy

This policy may be updated as the site evolves. Material changes will be reflected here with an updated effective date.

13. Content disclaimer, accuracy, and copyright

For information about content accuracy, trademark use, and the non-endorsement disclaimer, see the separate Legal Notice.

14. Contact

contact@bayandbyte.com

Last updated: 28 August 2026