Privacy policy
How Distil processes personal data.
Version: 16 October 2026
Who is responsible
7 a Second SA, Via Nocc 20, 6925 Gentilino, Switzerland, operates Distil (app.distil.ch and the organisations' own addresses, for example app.e-mentor.ch) and is the controller for the data described here. Contact: privacy@distil.ch.
When an organisation (for example a coach training school) uses Distil for its coaches, that organisation decides how its sessions are used; for that data we act on its behalf.
This policy follows the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).
What we process
| Data | Purpose | Legal basis |
|---|---|---|
| Account: name, email address, password (stored as a hash), organisation and role, second factor (for mentors and administrators) | Provide the account and secure sign-in | Contract |
| Session recordings (audio or video) | Transcribe and anonymise the session | Contract; the client's consent, confirmed by the coach or the organisation |
| Anonymised transcripts and evaluations | Provide the evaluation | Contract |
| Emails we send (address, language, delivery status) | Verify the address, reset the password | Contract |
| Technical logs (with email addresses removed) and metrics | Run, secure and fix the service | Legitimate interest |
| Page views and usage events (no cookies, no personal identifiers) | Improve the product | Legitimate interest |
Session recordings may contain sensitive personal data about the coaching client. We process them only to provide the service and only when consent is in place; see Consent and retention.
Where data is processed and who receives it
- Hosting: our servers at Hetzner Online GmbH in Germany (EU). The application, database, files, logs and analytics run there.
- Transcription and anonymisation: on our own servers. Recordings and names are not sent to third parties.
- Evaluation: uses only the anonymised text. Where an external language model is used, it is a provider in Switzerland or the EU without data retention.
- Email: Brevo (Sendinblue SAS, France) sends our account emails.
- Social sign-in: if you choose to sign in with Google, GitHub, Facebook or LinkedIn, that provider receives the sign-in request and may process data in the USA under its own policy.
We do not sell personal data and do not use it for advertising or to train AI models.
Cookies
We use only cookies that are needed: the session cookie that keeps you signed in, and a cookie that remembers the language you chose. There are no advertising or tracking cookies, so there is no consent banner.
Analytics
We use Umami, self-hosted on our servers. It does not set cookies, does not store IP addresses and counts page views and a few product events.
Retention
| Data | Kept for |
|---|---|
| Account | Until you delete it, or until your organisation removes you |
| Raw recordings | Deleted once processing succeeds (planned behaviour during the beta) |
| Anonymised transcripts and evaluations | Until they are deleted |
| Email delivery status | 7 days |
| Technical logs | 30 days |
| Metrics | 90 days |
Your rights
You can ask for access to your data, correction, deletion, a copy in a portable format, restriction, or object to processing, and withdraw consent at any time. Write to privacy@distil.ch; we answer within 30 days. You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, to your data protection authority.
Security
All connections use HTTPS. The database and file storage are not reachable from the internet. Mentors and administrators sign in with a second factor. Access to production is restricted to the operator.
Age and automated decisions
Distil is for professional users aged 18 or older. Evaluations are suggestions for the coach and their mentor; no decision with legal effect is made automatically.
Changes
We update this policy when the processing changes and show the version date above. Registered users are informed of material changes by email.