Data Protection

This Privacy Policy applies to ponito.com.

Personal data is any information that relates to an identified or identifiable person, such as your name or e-mail address. We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).

This policy explains what data we process, why we process it, and what rights you have. Processing means anything done with personal data: collecting, storing, using and deleting it.

Ponito is operated from Zurich, Switzerland. The operator's details are on the imprint page.

Why we process personal data

We process personal data only where we have a reason to: to run and secure the website, to provide an account or a service you asked for, to fulfil a contract, to comply with legal obligations, or because you have given your consent. We do not sell personal data.

What data is processed when you use the website

You can use ponito.com without providing any personal information. When you visit the site, our servers record each request in a log file. This includes:

• The IP address of the device making the request
• The date and time of the request
• The page or file requested
• The website the request came from (referrer)
• Any search queries you enter
• The operating system, browser and device type, as reported by your browser

We use this data to keep the site secure and stable, to analyse errors and performance, and for internal statistics. The IP address is also used to pick the default country and language of the site, and it can be analysed in the event of attacks or other misuse of the site. Log files are automatically deleted after 30 days at the latest.

Ponito links to many external websites. We are not responsible for how those websites handle your data.

Cookies

We only use cookies that are needed to run the site: they keep your session, protect forms against misuse, and keep you signed in if you have an account. We do not use advertising or cross-site tracking cookies. You can block or delete cookies in your browser settings; parts of the site that require signing in will then stop working.

Web analytics

We use Fathom Analytics to understand how the site is used. Fathom does not use cookies and does not build profiles of individual visitors. We only see aggregated statistics, such as which pages are visited, from which country, and on what type of device.

E-mails

We only send e-mails related to your account or to a request you made, for example to confirm a registration, an account deletion, or a shop claim. We do not send marketing e-mails and our e-mails contain no tracking pixels.

User accounts

You can use the site without an account. If you create one, we store your e-mail address, your display name if you provide one, your language, and your login credentials. Passwords are stored only in hashed form and passkeys never leave your device's secure storage in a usable form. We use this data to operate your account. You can delete your account at any time in your account settings; this removes your personal data, and we confirm the deletion by e-mail.

Affiliate networks

When you click through to a shop, the link may be routed through an affiliate network. We work with Adtraction, Awin, Tradedoubler, TradeTracker and Webgains. These networks store cookies on your device when you arrive at the shop, for the sole purpose of attributing a purchase to the link you clicked and billing it within the network. These cookies are set by the network, not by Ponito, and the network's own privacy policy applies to them.

Developer API and AI assistants

Our product catalogue can also be queried through the Ponito platform API and through AI assistants that connect to it (for example via the Model Context Protocol). We record every query made through these channels: the search text or product identifier, country, language, the number of results and technical metadata such as the response time. We use these records to operate and secure the service, to enforce usage limits, and to understand which products people are looking for so that we can improve our catalogue.

Queries made without an API key are stored without any personal identifiers — in particular, no IP address is stored with these records. If you create an account and use a personal API key, your queries are linked to your account so that we can apply your usage limits and show you your usage. When your account is deleted, or earlier on request, we remove the link between these records and your account; the remaining data is anonymous.

Where your data is processed

Our servers are located in the European Union. Some of our service providers may process data in other countries; where that happens, we make sure an adequate level of data protection is in place, as required by Swiss law.

Your rights

You have the following rights in relation to your personal data:

• You can request a copy of the personal data we have stored about you
• You can request that incorrect data be corrected or completed
• You can request that your data be deleted, and you can delete your account yourself
• You can object to a specific use of your data
• Where the GDPR applies, you can request your data in a portable format

To exercise these rights, contact us at the e-mail address shown on the imprint page. You can also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, with your local data protection authority.