Privacy Policy

1. Overview

This Privacy Policy explains how Durandal collects, uses, stores and shares personal data in connection with the Gainful website.

Gainful is a fictional company, part of a speculative design project. The website has no accounts, sign-ups, application forms or payments, and we do not ask you for your name, email address or any other contact details. The only personal data we process is the limited technical and usage data described below.

We process personal data in accordance with applicable Swiss data protection law and, where applicable, the EU General Data Protection Regulation ("GDPR"). This Privacy Policy does not apply to third-party websites or services that we do not operate, even if they are linked from our website.

2. Controller

The controller responsible for processing personal data under this Privacy Policy is Durandal. You can reach us about privacy matters through the channels listed on our Contact page.

3. Personal Data We Collect

We collect the following categories of personal data:

• Technical data: such as your IP address, browser type, device information, operating system, referring page, requested URLs and timestamps, which are generated automatically when your browser requests our pages.
• Usage data: such as page views, clicks and other interactions with the website, the approximate location derived from your IP address (such as your country or city) and the time of your visit.
• Diagnostics data: such as error and exception details and performance signals that help us keep the website working.
• Communications: if you contact us, the content of your message and the information associated with the account you send it from.

We do not collect special categories of personal data, and we do not combine the data above to identify you.

4. Why We Process Personal Data

We process personal data only where we have a valid legal basis, primarily our legitimate interest in operating a secure, reliable and useful website, and to comply with legal obligations. In particular, we use personal data to:

• deliver, operate and secure the website;
• understand, in aggregate, how visitors find and use the website;
• diagnose errors and improve reliability and performance;
• detect and prevent abuse of the website;
• respond to messages you send us; and
• comply with legal obligations.

5. Cookies and Similar Technologies

The website does not use cookies, and it does not use local storage, session storage or similar technologies to store information on your device or to recognise you when you return.

6. Website Analytics

We use PostHog, operated by PostHog Inc., as a website analytics and error-tracking provider. We use PostHog Cloud EU, with processing in the European Economic Area. Analytics requests from your browser are routed through our own domain before they reach PostHog.

PostHog is configured in cookieless mode. In this mode, it does not store identifiers in cookies or browser storage. To count unique visitors, PostHog briefly uses technical information such as your IP address and user agent on its servers to generate a hash that changes daily and is not stored in your browser, so your visits on different days are not linked. We do not use session replay.

If you object to analytics processing, you can block analytics requests with your browser's privacy settings or a content blocker without affecting the website, or contact us through our Contact page.

7. Disclosure of Personal Data

We share personal data only with the following categories of recipients:

• Vercel Inc., which hosts the website and processes technical data to deliver and secure it;
• PostHog Inc., which processes usage and diagnostics data on our behalf as a processor, using PostHog Cloud EU;
• X Corp., if you contact us on X, which processes your messages under its own privacy policy;
• professional advisers such as lawyers, auditors and accountants, where necessary;
• competent authorities, courts or regulators, where disclosure is required by law or reasonably necessary to protect rights, safety or the integrity of the website; and
• a purchaser, successor or affiliate in connection with a merger, acquisition, restructuring or sale of assets, subject to appropriate confidentiality measures.

We do not sell your personal data.

8. International Transfers

Our service providers may process personal data in countries outside Switzerland or the European Economic Area, including the United States. Where required, we take appropriate steps to ensure an adequate level of protection, for example by relying on contractual safeguards or another recognised transfer mechanism. Analytics processing through PostHog Cloud EU is carried out in the European Economic Area.

9. Data Security

We use reasonable technical and organisational measures designed to protect personal data against accidental or unlawful destruction, loss, alteration, unauthorised disclosure or unauthorised access, including encryption in transit. No system is completely secure, and we cannot guarantee absolute security.

10. Retention

We retain personal data only for as long as reasonably necessary for the purposes described in this Privacy Policy. Server logs are kept by our hosting provider for a short period needed for security and operations. Usage and diagnostics data are kept for a limited period needed to understand how the website is used, and messages are kept for as long as needed to respond to them.

11. Your Rights

Subject to applicable law, you may have the right to request access to your personal data, request correction of inaccurate data, request deletion, request restriction of processing, object to certain processing and request data portability.

To exercise these rights, contact us through our Contact page. Because we do not link usage data to individuals, we may be unable to identify data relating to you. We may request information necessary to verify your identity before responding. You may also have the right to lodge a complaint with the competent supervisory authority, including the Swiss Federal Data Protection and Information Commissioner where applicable.

12. Children

The website is not directed to children. We do not knowingly collect personal data from children.

13. Third-Party Links

The website may link to third-party websites, such as X. We are not responsible for the privacy practices or content of those third parties. We encourage you to review their privacy notices.

14. Changes to this Privacy Policy

We may update this Privacy Policy from time to time. If we make a material change, we will post the updated version on this page. The updated Privacy Policy will apply from its effective date, and we will provide additional notice where required by applicable law.

15. Related Terms

Your use of the website is also governed by our Terms of Service.