Privacy policy

Controller

The controller for data processing on atelo.ch is:

• Atelo Courses GmbH
• c/o Sandro Bachmann, Niederhofweg 12, 4617 Gunzgen, Switzerland
• support@atelo.ch

Principles

We collect as little data as possible. We do not sell data, do not build profiles, and do not make automated individual decisions. You can use most of Atelo without an account and without providing personal data.

Hosting and server logs

The website is served by Vercel Inc. (USA). When you visit the site, Vercel processes technical data such as IP address, browser type, and access time in server logs. This data is required for operating and securing the website and is retained only briefly.

We also use Vercel Analytics for anonymous performance measurement (load times, errors). Vercel Analytics sets no cookies and builds no visitor profiles.

Database

Our data (course data, accounts, requests and bookings, studio data, newsletter sign-ups) is stored with Supabase in an EU data centre (Frankfurt). Supabase processes the data only on our behalf.

Account and login

When you create an account, we store your email address and the times of your logins. Sign-in is passwordless via a code or link sent to you by email; we use Resend for delivery (sender login@atelo.ch).

If you set up two-step sign-in, we store the secret key of your authenticator app or the public key of your passkey. It may be mandatory for owners and managers of a studio.

While you are signed in, session cookies keep you logged in; these are technically necessary. Saved courses, saved searches, and your email settings are linked to your account.

You can delete your account at any time yourself on your account page, or have it deleted by writing to support@atelo.ch. We block it at once and delete or anonymize the linked data within 30 days, unless we need it for ongoing bookings or legal obligations.

Requests, bookings and class requests

When you send a booking request through Atelo, book a course instantly, or send a class request (another date, a private class, a team event), we process:

• your name, your email address, and optionally your phone number,
• the course, the date or preferred dates, the number of people, and your message,
• for class requests, the studio's offer and your answer,
• the history of your request or booking (for example confirmed, cancelled, refunded) and the emails we send about it.

We need these details to handle your request or booking. We pass them on to the studio you request or book with. The studio uses them under its own responsibility to run the course and may not use them for other purposes unless the law allows it. Within the studio, the people the studio has authorised in Atelo Studio see your details.

If a studio enters a booking for you itself in Atelo Studio (for example after a phone call or on site), we receive your name from the studio and, if given, your email address and phone number. We process them only for that booking, with the same retention and anonymization as other bookings. If the studio gave your email address, you receive the emails about the booking.

Emails about requests and bookings are sent via Resend (sender bookings@atelo.ch). The link in these emails shows your request or booking without an account. There you can cancel requests and unpaid bookings until the course starts, and paid bookings under the cancellation terms shown when you booked.

24 months after the course date we automatically anonymize your contact details, including in the related email logs; for class requests the proposed date counts, otherwise the latest preferred date or the day of the request. Anonymous counts and payment records without contact details remain. On request we anonymize earlier, unless we need the details for an ongoing booking or legal obligations.

Please do not put health data or other sensitive details in the message field unless necessary. Tell the studio about allergies or health limitations directly.

Paid bookings and payment data

If you pay for a booking on Atelo, Stripe processes the payment (Stripe Payments Europe, Ltd., Ireland, and Stripe, Inc., USA). The seller is the studio; Atelo collects the payment in its name. You enter your card or TWINT details directly with Stripe; Atelo never sees or stores full payment credentials.

Stripe processes payment data on our behalf and, as a separate controller, for its own purposes such as fraud prevention and regulatory obligations; Stripe's privacy policy applies to that.

For each payment we store the amount, currency, status, any refunds and chargebacks, and the Stripe references, linked to your booking. We need them to perform the contract, make refunds, and for bookkeeping. We keep these payment records for 10 years (Art. 958f CO); your contact details are anonymized independently of this, as described above.

The technical messages Stripe sends us about payments partly contain your email address and billing details. We keep them for 13 months.

Studios and studio members

If you use Atelo Studio for a studio, we process:

• your email address, your name, your role (owner, manager, or viewer), your invitations, and your email language,
• what you do in Atelo Studio, as far as needed for traceability and security (for example who changed an offer or confirmed a booking),
• the studio's details: profile and offers (public on atelo.ch), legal name, address, and any VAT number (guests see them as the seller on paid bookings), settings, and notifications,
• the acceptance of the provider agreement (version, time, and who accepted).

For payouts the studio opens an account with Stripe. Stripe verifies the identity and collects the necessary details (for example ID and bank account) under its own responsibility. Atelo only receives the account ID and status from Stripe, such as whether payments and payouts are possible and whether details are missing.

We process this data to perform the provider agreement, run Atelo Studio, and meet our bookkeeping obligations. We send related emails via Resend (sender studio@atelo.ch).

Newsletter, saved-search alerts and reminders

When you subscribe to the newsletter, we store your email address and the page on which you subscribed. You confirm the subscription via a link sent by email. We use the address only to send you news and course tips from Atelo.

With an account you can also receive saved-search alerts (emails about new dates for a search), reminders about saved courses, and a weekly overview. For this we store your search criteria and saved courses with your account.

You can unsubscribe at any time via the link in each of these emails or by writing to support@atelo.ch.

Contact

If you write to us by email or via the linked contact form (Google Forms), we use your details only to handle your request. Google's privacy policy additionally applies to the form.

Visit and click statistics

When you open a provider profile or a workshop page, or click through to a provider's website, we record this ourselves, without cookies. We store:

• the provider and workshop, and the time
• a coarse category of where you came from: search engine, AI assistant, social media, email, direct, Atelo, or other
• the label of the promotion link, if you arrived through a provider's own link (for example "instagram")
• for click-throughs, also the Atelo page you clicked from, the address of the page that brought you to Atelo, and your browser type
• a hash of your IP address and browser, combined with a secret key and the date. It changes every day, cannot identify you, and cannot link your visits across days. We use it only to count distinct visitors per day. We do not store your IP address itself.

Automated traffic (bots, crawlers) is filtered out. Providers see aggregate numbers only, never individual visits.

Google Analytics

Only if you consent in the cookie banner do we use Google Analytics 4 to understand which pages are visited and how visitors find us. The provider is Google LLC (USA); transfers rely on the EU-US Data Privacy Framework.

If you decline, nothing is collected and no analytics cookies are set. You can withdraw your consent at any time; see the cookie policy.

Maps

Course and studio pages show a map from Google Maps (Google LLC, USA). It loads as soon as you scroll near it. Google then receives your IP address and technical details about your browser and may set cookies; Google's privacy policy applies.

The map in search loads map tiles from MapTiler AG (Switzerland); the map data comes from OpenStreetMap. MapTiler then receives your IP address; MapTiler's privacy policy applies.

Abuse prevention

To prevent abuse (rate limiting), we process your IP address briefly in memory. It is never stored in a database in plain text. For login and booking requests we keep short-lived counters under a cryptographic hash from which the IP or email address cannot be recovered.

Recipients and processors

We share personal data with service providers that process it on our behalf:

• Vercel Inc. (USA): hosting and performance measurement
• Supabase Inc. (USA, data centre in the EU, Frankfurt): database
• Resend (USA): delivery of login, booking, studio, and system emails
• Stripe (Ireland/USA): payment processing, partly as a separate controller (see above)
• Google LLC (USA): maps on course and studio pages, analytics (only with consent), contact form
• MapTiler AG (Switzerland): the map in search

In addition, the studio you request or book with receives your details as a separate controller (see above).

We do not sell data and do not pass it on for advertising purposes.

Transfers abroad

Some service providers process data outside Switzerland, namely in the EU (Germany, Ireland) and the USA. According to the Federal Council, the EU states provide an adequate level of data protection. We transfer data to the USA only to companies certified under the Swiss-U.S. Data Privacy Framework, or on the basis of standard contractual clauses recognised by the FDPIC.

Retention

We keep personal data only as long as needed for the respective purpose:

• account: until you delete it; we then delete or anonymize the data within 30 days
• newsletter address: until you unsubscribe, then deleted within 30 days; unconfirmed sign-ups after 30 days
• contact details in requests, bookings, and class requests and the related email logs: until 24 months after the course date, then anonymized
• other email logs (for example studio emails, invitations, newsletter confirmations, saved-search alerts, reminders): 12 months
• reports of undeliverable emails: 90 days
• payment records without contact details: 10 years (Art. 958f CO)
• technical payment messages from Stripe: 13 months
• studio data and the provider agreement: for the duration of the collaboration, contract and accounting records 10 years after that
• log of activity in Atelo Studio: duration of the collaboration plus 2 years
• server logs: briefly, as set by Vercel

Data security

We protect personal data with appropriate technical and organisational measures, for example role-based access, encrypted transmission, two-step sign-in for studio owners and managers, and logging of changes. If a data security breach poses a high risk to you, we inform the FDPIC and, where necessary, you.

Your rights

Under the Swiss Data Protection Act (and, where applicable, the GDPR) you have the right to:

• request information about which personal data we process about you,
• have inaccurate data corrected,
• request the deletion of your data,
• object to processing and withdraw any consent you have given at any time,
• receive a copy of your data in a common format.

To exercise these rights, write to support@atelo.ch. We may ask for proof of identity before we give information or delete data. You can also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC).

Changes

We update this privacy policy when our data processing changes. The version published here applies; the date of the last update is shown above.