Privacy policy
Last updated: 13 October 2026
This policy covers the website www.tahirolabs.com and emails to us. It follows the Swiss Federal Act on Data Protection (FADP) and, where they apply, the GDPR and the UK GDPR.
1. Who is responsible
Mirza Tahirovic
Hagenholzstrasse 81, 8050 Zurich, Switzerland
kontakt@tahirolabs.com
2. Apps
Each app has its own privacy policy. It says which data the app processes and who receives it.
3. This website
The website uses no cookies and no analytics or tracking services. It loads no fonts, scripts or images from other servers. The website is hosted by Vercel Inc. (USA) and delivered through its global server network. When you visit, Vercel writes server logs for technical reasons; they include your IP address, the page requested, the time, browser details and the status code. We do not analyse them.
Do Not Track: The website sets no cookies and does not track you across other websites. No third parties collect such data through this website either. A Do Not Track signal from your browser therefore changes nothing.
We use the Vercel Pro plan. For the website data, Vercel acts as our processor under Vercel's data processing addendum (vercel.com/legal/dpa). For its own operational and security data, Vercel is a controller under that addendum (vercel.com/legal/privacy-policy).
Transfers to the USA: Vercel Inc. is certified under the EU-US Data Privacy Framework and the Swiss-US Data Privacy Framework, and also under the UK Extension for transfers from the United Kingdom. The European Commission, the Swiss Federal Council and the UK government have found that companies certified this way ensure adequate protection. In addition, the data processing addendum contains the European Commission's 2021 Standard Contractual Clauses, which also cover transfers from Switzerland. You can find the certification at dataprivacyframework.gov/list and the Standard Contractual Clauses in the addendum at vercel.com/legal/dpa.
For transfers from Singapore, we make sure under the PDPA that recipients are bound by legally enforceable obligations, in particular the contracts and standard contractual clauses named above, to give a standard of protection comparable to the PDPA.
4. Email
When you write to us, we use your email address and the content only to answer your request. The mailbox is hosted by Hostpoint AG in Switzerland, which runs it on our behalf.
If you commission a project from us, we process the data needed for it: name, company, contact and billing address, project communication, quotes, contracts and invoices. We use them to prepare and perform the contract, to invoice and to meet statutory retention duties.
5. Legal bases
- Website server logs: legitimate interest in secure operation (Art. 6(1)(f) GDPR).
- Emails: legitimate interest in answering or, where a contract is concerned, the contract (Art. 6(1)(f) or (b) GDPR).
- Projects, quotes and invoices: the contract and pre-contractual steps (Art. 6(1)(b) GDPR). For contact persons of a business customer who are not a party to the contract themselves: legitimate interest in carrying out the project with the customer (Art. 6(1)(f) GDPR).
- Keeping accounting records: legitimate interest in meeting the Swiss retention duty (Art. 6(1)(f) GDPR, Art. 958f Swiss Code of Obligations).
In the United Kingdom the corresponding provisions of the UK GDPR apply.
6. How long data is kept
- Email enquiries that do not lead to an assignment: 12 months after the case is closed, then deleted.
- Contracts, invoices and correspondence that serves as an accounting record: 10 years from the end of the financial year (Art. 958f Swiss Code of Obligations), then deleted.
- Other project communication: until warranty and limitation periods have expired, at most 10 years after the project ends, then deleted.
- Server logs at Vercel: on our plan the request logs are kept for one day and are then no longer available to us. We do not forward or store them ourselves. Vercel keeps its own operational and security data as long as it needs it for operation, security and legal obligations.
7. Your rights
Where the applicable law provides for it, you have the right to:
- access your data;
- have incorrect data corrected;
- erasure;
- restriction of processing;
- data portability, that is, receive your data in a common format where we process it automatically based on your consent or a contract;
- object to processing based on legitimate interest;
- withdraw consent, effective for the future.
Write to us at the email address below.
You can complain to a supervisory authority: in Switzerland to the Federal Data Protection and Information Commissioner (FDPIC), in the EU to the supervisory authority of your place of residence, in other countries to the data protection authority there. If you live in another country, you also have the rights under that country's data protection law.
If you live in the United Kingdom, the UK GDPR also applies. You can complain to us first (kontakt@tahirolabs.com). We acknowledge your complaint within 30 days, look into it and tell you the outcome without undue delay. You can also complain to the Information Commissioner's Office (ICO): ico.org.uk.
If you live in Singapore, the Personal Data Protection Act 2012 (PDPA) also applies. You can ask for access to the personal data we hold about you and to information about how we used or disclosed it in the past year, and you can ask us to correct it. You can withdraw your consent at any time; we will tell you what that means for your use of the app. We reply within 30 days, or tell you within that time when we will be able to reply. You can complain to the Personal Data Protection Commission (PDPC, pdpc.gov.sg).
8. Contact
Data Protection Officer under Singapore's PDPA: Mirza Tahirovic, kontakt@tahirolabs.com
9. Changes to this policy
If we change this policy, we publish the new version on this page and update the "Last updated" date. We also point out material changes at the top of this page for at least 30 days.