Privacy policy

1. Who is responsible and how to make a request

This notice concerns the operator of Zuriq.ai. Use the contact form for privacy and personal-data requests; choose the privacy or account-closure topic. Messages are stored privately and reviewed by the site administrator. The operator’s legal name and postal address have not yet been supplied for publication; those identity details remain an outstanding disclosure.

Your privacy rights still apply. The analytics control below works without contacting us. Signing out or clearing browser storage does not delete server-side business/account records, and the site currently has no self-service account deletion flow.

2. Browsing and map searches

Our hosting and delivery providers receive connection information needed to serve requests, such as your IP address, browser/request headers, requested address and time. Operational and security logs may contain request URLs and error information. A search included in a URL can therefore appear in infrastructure logs even when it is excluded from analytics.

Searches and filters are sent to Zuriq’s APIs to return results. Optional Places “Search by meaning” processes your question, map viewport and, where applicable, a numerical search representation using our search infrastructure. Server-side embedding is available; this is not a private, device-only search promise. Do not put confidential or sensitive personal information in search fields. Map search text is temporary interface state and is not restored from a saved query URL on reload.

The map also requests tiles directly from OpenFreeMap. That provider receives your connection details and tile requests, which indicate the map area being displayed. See OpenFreeMap. Source websites receive their own requests when you open an external link.

3. Listed businesses and source material

We compile names, descriptions, categories, business addresses, coordinates, websites, logos and source references from public business websites, public datasets and editorial research. Signals use published source material and may use automated or AI-assisted summarization and classification. This source processing is separate from owner login and private drafts.

Business data can also identify individuals, for example a sole trader, a named contact or a business operated from a home address. Public availability does not remove privacy rights. A sourced listing can exist without an owner account; ending an account does not automatically remove the independently sourced listing.

4. Invited owner accounts and contributions

An administrator supplies an invitation email and assigns it to a business. Firebase Authentication processes the email, password credentials, verification/recovery actions and authentication/session information. Zuriq stores the account identifier, assigned email and business, access status and session-revocation information. Passwords are handled by Firebase; the Zuriq business database does not store your plaintext password.

We record the accepted contribution-terms version, assignment and acceptance time. We store profile drafts, links, uploaded images, publication versions, submitted business updates, review decisions and audit events identifying the action and account. We use them to provide editing, verify access, publish contributions, review changes, limit abuse and restore earlier versions. Authorized administrators can access these private records to perform those tasks.

Drafts and pending review material are not public. Published profile content, approved logos/identity changes and approved business updates are public and may be indexed, copied or cached by others. A public contact field or image can disclose personal information: only publish details you intend to make public. The assigned login email is not automatically a public contact field.

5. Providers and international processing

Vercel hosts the application and server requests. Google Firebase provides owner authentication, business-account metadata and public logo delivery; the owner Firestore database is configured in Zürich (europe-west6). Supabase holds catalog/editorial data and private owner image files. Google Analytics is optional, as explained below. External AI services may process public source text for the editorial pipeline; this does not mean private owner drafts are submitted to that pipeline.

A Swiss database region does not mean all processing stays in Switzerland. Provider authentication, delivery, support, logs and analytics may involve processing in other countries, including the United States. Applicable provider contracts and transfer arrangements need to be assessed for that processing; we do not claim that every provider has Swiss-only storage or that a particular transfer safeguard has been verified here.

Provider information: Vercel, Firebase, Supabase and Google.

6. Analytics and browser storage

When Google Analytics is configured, its tag loads only after you choose “Accept analytics” and only on eligible public pages: the homepage, Signals directory, story pages and these legal pages. The application’s analytics integration excludes the map, owner/business pages and admin pages. Declining does not prevent browsing or account use.

After acceptance, the application sends page views using the origin and path, without query strings or fragments. Its custom events cover brief selections, category filters, search submissions, pagination and source opens. These custom event parameters use categories, surfaces and directions; they do not include the entered search text, passwords or profile form values. Google’s tag may also collect device/browser, referral, cookie identifiers and usage information under its own configuration; these restrictions on our custom events are not a promise that all Google collection is anonymous.

Your analytics choice is stored as “accepted” or “declined” in this browser’s local storage until you change or clear it. Firebase uses browser persistence to keep owner sign-in active. Editorial administrators use a signed session cookie, normally lasting eight hours. These functional mechanisms are separate from optional analytics.

Withdrawing consent disables further collection through our analytics integration and prevents later tag loading unless you accept again. It does not delete information Google already received or automatically remove existing analytics cookies; those can be cleared in browser settings. Clearing site data may also sign you out and reset your choice.

7. Retention and deletion

Account and business records remain while needed to operate access and the profile. Publication revisions, review history, audit records and referenced images are retained for moderation, abuse prevention and rollback. There is currently no automatic age-based deletion schedule for these owner records. Unpublishing, hiding a profile, suspending editing and signing out are not deletion operations.

Requests to erase personal information need to be assessed separately from preserving nonpersonal business records, legal obligations, security evidence and source history. A public takedown does not erase copies already made by search engines or other visitors. Provider log and analytics retention depend on the relevant service configuration; we have not established a single verified retention period covering all providers and do not promise an invented deletion deadline.

Contact submissions store your name, reply email, topic, message, optional business name/page link, reference number, date and handling status in private Firestore records. We use these to handle your request and may reply manually to your email. A keyed digest of your connection address is stored with the message for safe retries and used in the submission-limit record; the contact database does not store the raw address. The daily limit record rotates on the next submission day. A message’s digest remains until that message is deleted. Messages are retained until the administrator deletes them; marking a message resolved does not delete it. There is no automatic confirmation email. Do not submit passwords, identity documents or sensitive personal information through the form.

8. Your rights and the purposes for processing

Depending on applicable law, you may request access to personal data, correction, deletion or restriction, object to certain processing, and request a portable copy where that right applies. You can withdraw optional analytics consent without affecting earlier lawful processing. Requests may require proportionate identity verification and may have lawful exceptions.

We process necessary account data to provide requested account services; source, publication and security data to operate and protect the directory and editorial service; optional analytics with your consent; and records required by law where applicable. Where the GDPR applies, the corresponding grounds are contract necessity, legitimate interests assessed against your rights, consent and legal obligations, as appropriate. This notice does not treat all browsing as consent to every processing activity.

You may raise concerns with the Swiss Federal Data Protection and Information Commissioner or another competent data protection authority. You can also make a request directly through our contact form.

9. Changes and related terms

We will date updates to this notice when the product or its data practices change. The Terms of service describe contribution permissions, review, third-party rights and account restrictions. They do not replace your privacy rights.