Last updated: 6 October 2026
In short
- Slowio is run from Vaud, Switzerland. Contact: [email protected].
- To open an account we need an email address and a password. Nothing else is required.
- Your portfolios, watchlists and settings stay yours. We never sell personal data.
- Analytics and advertising cookies run only with your consent (in the EEA/UK) or until you switch them off (elsewhere). Manage them any time under Cookie settings.
- You can delete your account yourself on the account page. We keep a copy for at most 3 months (backups), then it is gone.
- Nothing on Slowio is financial advice. See the Disclaimer.
1. Who we are and what this notice covers
This Privacy Notice explains how Slowio ("we", "us", "our"), Vaud, Switzerland, handles personal data when you use www.slowio.ch (the "Site"), the Slowio iOS and Android apps (which display the Site inside an app shell), our emails, and any other service that links to this notice (together, the "Services"). We are the controller of this data.
It is written for the Swiss Federal Act on Data Protection (FADP), the EU and UK General Data Protection Regulations (GDPR) and, where they apply, other local privacy laws. If you do not agree with it, please do not use the Services. Questions: [email protected].
2. What we collect
Data you give us
- Account data: email address and password. The password is stored as a salted hash; we cannot read it. We do not ask for your name, phone number, address or payment card details.
- Sign in with Google or Apple: if you choose one of them, Google or Apple confirms to us the email address of that account (and that it is verified) — with Apple, possibly a private relay address that forwards to you. We use that address to open your existing account or to create one; we store no Google or Apple identifier and receive no access to your Google or Apple data. Their own privacy policies apply to their sign-in screens.
- Content you enter: portfolios, transactions and broker files you import, watchlists, alerts, screens, calculator inputs, questions you type into AI features, survey answers, notification and display settings.
- Payment data: if you buy a plan or a balance top-up, our payment provider Stripe collects your card or bank details on its own pages. We never see the card number. We receive a Stripe customer id, the plan, invoice amounts and their paid/failed status, and (if you entered one at checkout) a billing address.
- Messages: anything you write to us by email or through the contact form, including support requests.
Data collected automatically
- Server visit log: for each page view we record the date and time, the page, your IP address, an approximate location derived from it (city and country, see section 5), the device and browser type, whether you were logged in (and, if so, your username), the referring campaign tags in the link you used (utm parameters, Google
gclid, Metafbclid) and the first page you landed on. This keeps the Site secure, lets us count visitors, and tells us which advertising channel brought a sign-up. - Usage and error logs: which features you run and how often, including which company analyses you open (needed to apply the allowances of your plan, and — unless you switch “Recently opened companies” off — to choose which companies your weekly digest covers), and technical error reports.
- Email engagement: which of our emails were sent to you, whether you clicked a link in them (links in our emails go through our own redirect), and your unsubscribe choices.
- Free-page counter (visitors without an account): on the tool pages that are open without an account we count how many different pages you open in a month, in your session cookie and against a keyed one-way hash of your IP address (a pseudonym: the address itself is not stored). It only decides when to show the "create a free account" notice and is kept for 30 days.
- Cookies and browser storage: see section 7 and the Cookie Policy.
What we do not collect
No sensitive data (health, religion, biometrics, and so on), no precise device location (no GPS), no contacts or photos from your phone, no push notifications, no data bought from third parties. The mobile apps do not use advertising identifiers; the iOS home-screen widget only reads your own portfolio summary using your login session.
3. Why we use it, and on which legal basis
| Purpose | Data used | Legal basis (GDPR art. 6) |
|---|---|---|
| Create and run your account, log you in, show your portfolios and settings | Account data, content you enter | Contract |
| Apply the allowances of your plan and bill subscriptions or top-ups | Usage logs, payment data | Contract; legal obligation (bookkeeping) |
| Send transactional emails (verification, password reset, receipts) | Email address, content you enter | Contract |
| Send stock, screening and portfolio alerts, feature tips, newsletters, product news and surveys | Email address, content you enter, engagement | Legitimate interest for existing users (Swiss FADP / GDPR); you can switch each category off on the account page or with the link in every email |
| Choose which companies your weekly digest covers, from the companies you hold, saved to a watchlist, or opened an analysis for in the last 30 days | Usage logs (which company pages you analysed, and when), portfolios and watchlists | Legitimate interest for existing users; you can switch “Recently opened companies” off on the account page or with the link in every email, and the digest then covers only your holdings and saved companies. When this was introduced, one announced edition looked back up to 180 days instead of 30; the email said so, and every edition since uses the 30-day window |
| Keep the Site secure, prevent abuse, debug errors | Visit log, usage and error logs | Legitimate interest |
| Count visitors and measure which ads bring sign-ups | Visit log; analytics and advertising cookies; for sign-ups that followed a Google ad click, the click identifier and sign-up time reported to Google Ads from our server (section 5) | Legitimate interest for our own server log and for the server-side click report; consent for analytics and advertising cookies |
| Answer your questions and complaints | Messages | Legitimate interest; contract |
| Comply with the law (tax, court orders) | Whatever is required | Legal obligation |
Where we rely on legitimate interest we have checked that it does not override your rights. You can object at any time (section 10).
4. AI features
Some features (for example the AI analyst, AI research notes and the macro outlook) send financial data about a company or market, together with the question you type, to large-language-model providers through the OpenRouter platform. Your account identity is not attached to these requests; the providers receive the market data and your text only. Some providers are outside Switzerland and the EU (mainly the USA) and may keep the text for a limited time for abuse monitoring under their own terms.
Please do not type personal data (yours or anyone else's) into AI prompts. AI output is generated automatically, can be wrong, and is provided for information and education only — it is never a recommendation and never a decision with legal effect on you.
5. Who we share data with
We share personal data only with the service providers below, who act on our instructions under a contract, and only for the purpose stated. We never sell personal data.
| Provider | What for | Where |
|---|---|---|
| Hetzner Online GmbH | Hosting of the Site and all stored data | Germany |
| Cloudflare, Inc. | Content delivery, DDoS protection and security in front of our server; determines your country from your IP for the cookie banner | Global network; EU/US |
| Stripe Payments Europe, Ltd. / Stripe, Inc. | Payments, subscriptions, invoices, billing portal | Ireland / USA |
| Infomaniak Network SA | Sending our emails | Switzerland |
| ipinfo.io (IPinfo Inc.) | Turns an IP address into an approximate city and country for the visit log and for showing prices in your currency | USA |
| OpenRouter, Inc. and the model providers it routes to | AI features (section 4) | USA |
| Apple Distribution International Ltd. / Apple Inc. | Sign in with Apple, if you choose it (section 2) | Ireland / USA |
| Google (Google Ireland Ltd. / Google LLC) | Sign in with Google, if you choose it (section 2). Google Analytics, Google Ads and Google Tag Manager — only with your consent. Separately, and without any cookie: when an account is created after a click on one of our Google ads, we report that click's identifier (the gclid Google itself added to the link) and the sign-up time back to Google Ads from our server, so we can see which ads lead to sign-ups. Google already holds that click; we send no name, email or other detail. Legal basis: legitimate interest (section 3). | Ireland / USA |
| Meta Platforms Ireland Ltd. | Meta pixel for measuring our Instagram/Facebook ads — only with your consent | Ireland / USA |
| AppLovin Corporation (Axon pixel) | Measuring our in-app advertising campaigns — only with your consent | USA |
| Microsoft Ireland Operations Ltd. (Microsoft Advertising) | Reporting on our own ad spend: we read aggregate campaign figures from them; we do not send them any personal data (no Microsoft pixel runs on the Site) | Ireland / USA |
| Apple Inc. / Google LLC (app stores) | Distribute the iOS and Android apps; their own privacy policies apply to the store itself | USA |
We may also disclose data if the law requires it, to defend our rights, or, in the event of a sale or merger of Slowio, to the successor under the same protections. Financial market data shown on the Site comes from third-party data vendors, but no personal data is sent to them.
6. International transfers
Your data is stored in Germany. Some providers above process data in the USA. For those we rely on the Swiss–US and EU–US Data Privacy Frameworks where the provider is certified, and otherwise on the standard contractual clauses recognised by the Swiss FDPIC and the European Commission.
7. Cookies and similar technologies
Essential cookies (login session, security token, your consent choice, Cloudflare protection) are always on. Analytics and advertising cookies are set only after you accept them, if you are in the EEA or UK; elsewhere they run until you switch them off. Change your choice any time under Cookie settings. The full list is in the Cookie Policy.
We honour the Global Privacy Control browser signal: when it is present we treat it as a refusal of non-essential cookies until you say otherwise. There is no accepted standard for the older "Do Not Track" setting, so we do not act on it.
8. How long we keep data
- Account data and your content: while your account exists. When you delete your account (account page → delete) or ask us to, it is removed at once from the live system and disappears from backups within 3 months.
- Payment and grant records: 10 years, as Swiss bookkeeping law requires. Stripe keeps its own records under its policy.
- Server visit log, email engagement and consent records: at most 24 months, then deleted or reduced to anonymous counts.
- Free-page counter: 30 days.
- Support emails: up to 24 months after the last message.
9. Security
All traffic is encrypted (HTTPS), passwords are hashed, the server only accepts traffic through Cloudflare, and only the operator of Slowio has access to stored data. No system is perfectly secure, so we cannot promise that unauthorised access will never happen; if it does and your rights are at risk, we will tell you and the competent authority as the law requires.
10. Your rights
Under the Swiss FADP and the GDPR you can ask us to:
- access the personal data we hold about you and receive a copy;
- correct inaccurate data (most account data you can edit yourself);
- delete your data (use "delete account" on the account page, or ask us);
- restrict or object to processing based on legitimate interest, including direct marketing;
- receive the data you gave us in a portable format;
- withdraw consent at any time (cookie settings, email switches) without affecting what was done before;
- not be subject to a decision based solely on automated processing that has legal effects on you — we make no such decisions.
Write to [email protected] from the email address of your account (or tell us how to verify it is you). We answer within 30 days, free of charge. We will not treat you differently for exercising these rights.
If you are unhappy with our answer you can complain to the Swiss Federal Data Protection and Information Commissioner (edoeb.admin.ch), to the data-protection authority of your EEA country, or, in the UK, to the Information Commissioner's Office (ico.org.uk).
11. Marketing emails
Stock alerts, screening alerts, portfolio alerts (break-even and risk warnings on your holdings), feature tips, newsletters, product news and surveys each have their own switch on your account page (Notifications), and every such email carries a one-click unsubscribe link. Transactional emails — verification, password reset, receipts — are part of the service and continue while your account exists.
12. Residents of the United States
We do not sell or "share" personal data for cross-context advertising as US state privacy laws define it, and we do not use it for profiling with legal effects. The rights in section 10 (know, access, correct, delete, portability, non-discrimination, appeal) apply to you; to use them or to appeal a decision, email [email protected]. Under California's "Shine the Light" law you may ask once a year which personal data, if any, we disclosed to third parties for their direct marketing — the answer is none.
13. Children
The Services are for adults (18 or older). We do not knowingly collect data from minors; if we learn we have, we delete the account. Tell us at [email protected] if you believe a minor has registered.
14. YouTube API Services
Slowio uses YouTube API Services to publish Slowio's own videos to Slowio's own YouTube channel. By using this website, you also agree to the YouTube Terms of Service. Google's handling of data is described in the Google Privacy Policy.
Slowio does not access, collect, store, or share any YouTube user data belonging to visitors or account holders. The only Google account connected to the YouTube API is Slowio's own channel account, used solely to upload and manage Slowio's own content. No YouTube API data is shared with third parties, and no advertising use is made of any API data. Anyone who has granted Slowio access to a Google account (currently only Slowio's own operators) can revoke that access at any time via the Google security settings page.
15. Changes to this notice
We update this notice when our practices or the law change; the date at the top tells you when. For material changes we will show a notice on the Site or email account holders.
16. Contact
Slowio, Vaud, Switzerland — [email protected].