Privacy Policy
Data controller
Responsible for data processing within the meaning of the Swiss Federal Act on Data Protection (FADP) is Marco Gomez Bitolykou, operating under the trade name “Orvayo” (a sole proprietorship, not entered in the commercial register), Ringstrasse 2, 8107 Buchs ZH, Switzerland. Contact: business@orvayo.com — full details in the Legal Notice.
What data we collect
We collect information that you actively provide to us via the contact form, the Solution Finder or the order form for physical products — for example name, company, email address, phone number, your message and, with an order enquiry, the shipping address, the quantity and the destination an NFC or QR card should point to. That collection happens only with your explicit consent (checkbox in the respective form). ORVAYO AI does not work the same way: it stores what you write from your first message onwards, without a checkbox, because the assistant has to remember the subject across several questions. The section "What ORVAYO AI stores" says exactly what that means. If you send an enquiry, the details described under “Which link brought you here” are stored alongside it; those come from the link itself, not from you.
What we use this data for
Your contact details and your message exclusively to process your enquiry: they are reviewed internally and you are contacted personally. There is no automatic sending to you, no automatic contract processing, and no disclosure to third parties for advertising purposes.
So that your enquiry does not sit unnoticed, a short internal notification goes to our own mailbox: company name, your name, your e-mail address and the time — not the text of your message. Its only purpose is that someone knows an enquiry has arrived; it is read in our internal area, not in that e-mail. The only recipient is our own mailbox at our Swiss hosting provider.
The details from the link that brought you here (see below) serve a different, equally narrow purpose: they feed an aggregate view of which channel leads to enquiries. That view shows counts per channel — it is not used to show you advertising or to build a profile about you.
What ORVAYO AI stores
What you write to ORVAYO AI is stored on our server, so that the conversation holds together across several questions — it has to remember what the subject is. Stored are your first message, your answers to the questions it asks, and the classification derived from them (for example "online shop"). This happens from the first message onwards, not only once you agree to something.
What does not happen: no lasting profile is built about you, no cookie is set, and no connection is made to an earlier visit. The session hangs on a random identifier your browser holds for this one conversation.
An enquiry out of it — the handover to our CRM with your contact details — still only happens when you explicitly agree during the conversation. That is the same path as the ordinary contact form.
Conversation data is deleted 30 days after the last activity. An enquiry that came out of it is unaffected — it belongs to handling your request and follows the section "Retention and deletion".
Cookies and tracking
This website currently does not use any analytics or marketing cookies and no third-party tracking services.
What stays in your browser
For the website to work, it keeps a few things in your own browser. They do not leave your device on their own — they are only ever sent when you submit something, and then only as far as the description of that particular function says. These are all of them:
- Until you close the tab (sessionStorage): which link brought you here (
orvayo_attr), a partner referral code if you arrived with one (orvayo_ref), and the random identifier of your running conversation with ORVAYO AI (orvayo_ai_session_v2). - Beyond this visit (localStorage): the language you last chose (
orvayo-demo-lang) and — if this server accepts orders — the contents of your shopping cart (orvayo-cart-v1), so that it is not lost when you leave the page.
None of these is a visitor identifier, none of them makes it possible to recognise you across other websites, and none of them is passed to a third party. You can delete them yourself at any time by clearing this site's data in your browser.
Which link brought you here
If you reach us through a link we wrote ourselves — in a newsletter, a post, or a printed QR code — that link carries details of which campaign it belongs to (so-called utm parameters). Those details come from us, not from you. While you move around the site they stay solely in your browser (sessionStorage) and are deleted when you close the tab. Only when you submit the contact form are they sent along with your enquiry and stored by us. They answer one question for us: which channel leads to enquiries.
Stored alongside them are the name of the website you came from — the hostname only, for example “www.google.com”, never the full address and therefore never any search terms — and the page of our site you arrived on, likewise as a path without any appended parameters. Our server performs both reductions itself, as your enquiry arrives.
If a partner refers us, they may hand out a link carrying a referral code. It travels the same way and records who made the referral — not who you are.
None of this creates a cookie, a visitor identifier, or any value by which you could be recognised across websites. If you do not send an enquiry, none of it is stored by us.
Retention and deletion
We retain your information only for as long as necessary to process your enquiry. To request deletion of or information about stored data, please contact us using the contact details given on this page.
Server logs and abuse protection
When you open this website your IP address is processed so the request can be answered. It is used only transiently, in memory, to limit how many requests one sender may make (protection against abuse and overload). No persistent access log containing IP addresses is written to a database or file; the counters are lost on every restart.
No third parties on this website
This website loads nothing from third parties — no fonts, maps, videos, analytics or social media widgets. That is technically enforced: the Content Security Policy permits the browser to load content only from our own server. No connections to external providers arise, and so no data flows that we would otherwise have to disclose.
ORVAYO AI never leaves this server
ORVAYO AI on this website answers your input by fixed rules on this server. No language model is involved, and your input is not sent to an external AI provider — not to OpenAI, Google, Anthropic or any comparable service — so it is not used to train anyone else's models either. What you write in the conversation leaves this server only if you explicitly agree to leave a summary for personal review, and then it goes to us alone.
Disclosure abroad
Your personal data is not disclosed abroad. Should that change — for instance through a change of hosting provider — this policy will be updated beforehand.
No automated individual decisions
No automated individual decision within the meaning of Art. 21 FADP takes place. Enquiries are reviewed by a person; the system prepares and proposes, it does not decide.
Your rights
Under the Swiss Federal Act on Data Protection (FADP), you have the right to information about the data we process about you, as well as to correction, deletion or restriction of processing. To exercise these rights, an informal message using the contact details on this page is sufficient. You also have the right to receive or transfer your data in a common electronic format (Art. 28 FADP), and the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC).
Contact
If you have questions about data protection, you can reach us via the contact details on the homepage or in the Legal Notice.