Privacy Policy

1. Who we are and how to reach us

The controller is Small Talk, Switzerland. For any privacy question, or to exercise any of the rights below, contact hello@smltlk.ch.

Small Talk is early-stage and is not yet registered as a company. Once a legal entity exists, its name and registered address will be added here and to our imprint. Until then, email reaches us directly and we answer every message.

2. What we collect

Waitlist (before launch): your name, email address, whether you're signing up as a creator or a brand, and a record of your consent — when you gave it, in which language, and which version of the consent wording you saw.

Account: email address, a hash of your password (never the password itself), account type and status.

Creator profile: display name, first and last name, and optionally gender, date of birth, phone number, bio, address, country, niches, languages and collaboration types. For invoicing, additionally: legal name, VAT number and payment details such as an IBAN.

Brand profile: company name, description, website, country, niches.

Collaboration data: briefs, applications and invites, agreed terms and compensation, dates, submitted deliverables, reviews, and the messages you write in a workspace.

Invoices: invoice number, amount, currency, dates, and a copy of the billing details (name, address, VAT number, payment details) frozen at the moment the invoice was sent.

Connected social accounts: see section 12.

Technical data: for each signed-in session we store the IP address and the browser/device identifier (user agent), so you can see your own sessions and so we can detect abuse. Our server logs contain IP addresses and requested paths. To limit sign-in attempts we hold IP addresses briefly in memory.

3. Why, and on what legal basis

• Contract (Art. 6(1)(b) GDPR; Art. 31(2)(a) revFADP): running your account, hosting your profile, matching and running collaborations, delivering messages, producing invoices.
• Consent (Art. 6(1)(a) GDPR; Art. 6(6) revFADP): update emails to the waitlist, including the message announcing launch, and — if enabled — audience measurement. You can withdraw consent at any time (section 7).
• Legitimate interests (Art. 6(1)(f) GDPR): security, rate limiting, fraud and abuse prevention, keeping the service running.
• Legal obligation (Art. 6(1)(c) GDPR): retaining business records and accounting vouchers under Art. 958f of the Swiss Code of Obligations.

4. How long we keep it

We keep your account and profile data for as long as your account exists. Delete it and that data is deleted or anonymised (section 7).

There is one exception we have to spell out, because it limits your right to erasure: invoices and payment records are kept for ten years, because Art. 958f of the Swiss Code of Obligations requires it. That duty overrides a deletion request (Art. 17(3)(b) GDPR) — but the records are separated from your name and contact details.

Everything technical — signed-in sessions, password reset links, notifications and server logs — is kept only as long as it serves its purpose and then removed automatically. Sessions and reset links expire on their own; notifications and logs are cleared out on a rolling basis.

If you unsubscribe from marketing email we keep a minimal record of that indefinitely — it is the only way we can be sure you never receive another one.

Deleted data can persist for a while in backups until those are overwritten in the normal rotation. We don't search backups to remove individual records; doing so would be disproportionate.

5. Who else sees your data

We do not sell personal data. We use the following service providers:

• Google (Google Forms and Google Sheets), USA — currently collects and stores waitlist sign-ups. Under the Google terms that apply to this form, Google may also process what you submit for its own purposes. We are working to move the waitlist onto our own systems. If you'd rather not use it, just email us instead of the form — we'll add you to the list that way too.
• Infomaniak Network SA, Switzerland — runs the server this website, the application and the database live on, which makes them the technical recipient of everything you send us.
• Our email delivery provider — sends our email and therefore sees the recipient address.
• YouTube, TikTok, Instagram, Pinterest — only if you connect an account (section 12).

We disclose data to authorities only where we are legally required to.

6. Transfers outside Switzerland and the EEA

Our servers are in Switzerland. The only transfer abroad is to Google, which hosts the waitlist form. Google is certified under the Swiss–U.S. and EU–U.S. Data Privacy Framework. The Swiss Federal Council recognised on 14 August 2024 that certified US companies provide adequate protection, and the EU has an equivalent adequacy decision; that transfer relies on that basis.

7. Your rights, and where to use them

You have the right of access, rectification, erasure, restriction of processing and data portability, the right to object to processing, and the right to withdraw consent at any time. Most of it you can do yourself, without asking us:

• Access and a copy of your data: Settings → Your data → Download my data, which gives you a complete JSON file.
• Rectification: edit your profile directly.
• Erasure: Settings → Your data → Delete my account. Note the ten-year invoice retention in section 4 — those records are anonymised, while your profile and personal details are deleted.
• Marketing email: the unsubscribe link in any such email. One click, no sign-in, no reply needed.
• Audience measurement: via the cookie notice; the setting lives in your browser and you can clear it there.
• Anything else: email us. We respond within one month (Art. 12(3) GDPR).

8. Complaints

You can complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC), in Bern. If you are in the EU or EEA, you may also complain to the data protection authority of the country where you live.

9. Cookies and storage on your device

We use no advertising or tracking cookies. The cookies we do set exist only for signing in: they keep you logged in and protect the exchange when you connect a social media account. Sign-in doesn't work without them, which is why they are not subject to consent. They expire with your session, or later if you chose to stay signed in.

Your browser also remembers a few small preferences so the site behaves correctly: the language you picked, your answer to the analytics question, and display choices such as a collapsed sidebar. These stay on your device, are never sent to us, and don't identify you. You can clear them in your browser settings at any time.

If we enable audience measurement we will use a cookieless tool that stores nothing on your device and is not loaded at all unless you agree. None is active at present.

10. Your public creator profile

Once your creator profile is approved, it can be viewed from a link without signing in. Publicly visible: display name, bio, city and country, niches, languages, platforms with verification status and audience size, the number of completed collaborations, an outcome measure for them, and a list of completed collaborations showing the type and date. Brand names are not shown. Your contact details, address, phone number, date of birth and payment details are never public.

11. Automated decisions and minimum age

We do not make automated decisions with legal effect and we do not carry out profiling in the sense of Art. 22 GDPR. Creator search ranks results; it does not decide anything about a person.

Small Talk is for people aged 16 and over.

12. Connected social platform data

Creators may connect their social media accounts (YouTube, TikTok, Instagram, or Pinterest) to Small Talk using each platform's official OAuth sign-in. We request the minimum read-only permissions needed to (a) confirm you own the account and (b) read public metrics such as your follower count. We use this data solely to verify creators and to show brands accurate reach — we do not post on your behalf, and we never receive or store your platform password.

We store your OAuth tokens encrypted at rest and a cache of the retrieved metrics. Tokens are kept only while the account remains connected. You can disconnect at any time from your profile, which immediately deletes the stored tokens and cached metrics; deleting your account removes all of it. Disconnecting removes the connection on our side — it does not additionally revoke the app's access inside your platform account, which you can do there yourself. See our Data Deletion page for details.

13. Security

Connections to Small Talk are encrypted with TLS throughout, with HSTS enabled. Passwords are stored only as bcrypt hashes. Your payment details and OAuth tokens are encrypted at rest. Administrative access is additionally restricted by network address. No system is perfectly secure, and we keep these measures under review.

In the event of a data breach involving high risk, we notify the FDPIC as soon as possible under Art. 24 revFADP and, where the GDPR applies, the competent supervisory authority within 72 hours, along with the people affected.

14. Other websites, and changes to this policy

Our website may contain links to third party sites that are not governed by this policy. We are not responsible for their privacy practices, so we suggest reading theirs.

We update this policy when our processing changes. The version and date are at the top of this page.