Legal

Privacy policy (revDSG & GDPR)

Controller
Libers GmbH
c/o startup space AG, Neuhofstrasse 12, 6340 Baar, Switzerland
Email: privacy@libers.ai
Website: libers.ai

Scope
This privacy policy explains which personal data we process when you use our website, our SaaS platform Libers Suite, our browser extension, our Shopify app or related services, for which purposes we do so and which rights you have. It takes into account the Swiss Federal Act on Data Protection (revDSG/revFADP) and, where applicable, the EU General Data Protection Regulation (GDPR).

Terms
Personal data is any information relating to an identified or identifiable natural person. Processing is any handling of personal data, such as collecting, storing, using, disclosing or deleting it. Processors are service providers that process personal data on our behalf and according to our instructions.

1. Which data we process

  • Usage and connection data: IP address, date and time, requested address, browser and operating system, referrer, preferred language.
  • Account and contract data: name, company, position, email address, billing address, login data, chosen plan, contract and billing details.
  • Communication data: content of support requests, emails and forms, including attachments.
  • Payment data: payment method, transaction number, payment status. We do not receive or store full card details.
  • Content and configuration data: product and catalog data, website addresses, brand names, settings and logs created while you use Libers Suite.
  • Analysis and measurement data: results of our analyses and measurements, for example scores, Knowledge Packs and answers from AI assistants about your brand.
  • Search Console data: if you connect your Google Search Console, see section 9.

2. Purposes

  • Providing the website, the platform, the extension and the Shopify app.
  • Initiating, concluding and performing contracts, including the trial period.
  • Creating and managing accounts, login, roles and permissions.
  • Analyzing and optimizing your product data and measuring visibility in AI systems.
  • Billing and payment processing, compliance with statutory retention obligations.
  • Support and communication.
  • Security and stability, protection against abuse and fraud.
  • Improving our services based on anonymized or aggregated data. We do not create profiles for advertising purposes.
  • Establishing, exercising and defending legal claims.

3. Legal bases

Under the revDSG, we process personal data in accordance with the principles of the Act. Where a justification is required, we rely on the performance of a contract with you, on your consent or on our overriding interests.

Where the GDPR applies, we rely on:

  • Art. 6(1)(b) GDPR: contract and pre-contractual measures (registration, use, billing, support).
  • Art. 6(1)(c) GDPR: legal obligations (for example retention of accounting records).
  • Art. 6(1)(f) GDPR: legitimate interests (secure and stable operation, display of the website, prevention of abuse, improvement of our services).
  • Art. 6(1)(a) GDPR: consent (analytics cookies, map display, optional communication). You can withdraw your consent at any time with effect for the future.

4. Visiting the website

4.1 Server log files. When you access libers.ai and our subdomains, our server stores the usage and connection data from section 1 in log files. We need them to deliver the pages, find errors and fend off attacks. We delete the log files after 12 months at the latest.

4.2 Icons and scripts from third parties. Our website loads icons from Font Awesome (Fonticons, Inc., USA) and program libraries via jsDelivr (Volentio JSD Limited, United Kingdom). Your browser connects directly to these providers and transmits your IP address, the requested page and browser details to them. We have a legitimate interest in a consistent and working display. A transfer to the USA is possible (see section 13).

4.3 Map on the About page. On the «About» page we show our location with Google Maps (Google Cloud EMEA Limited, Ireland). The map only loads after you have consented in our cookie banner. Google then receives your IP address and information about your use of the map. The legal basis is your consent.

4.4 Cookies and consent. We set necessary cookies without consent, for example for login, security and storing your cookie choice. All other cookies and services, in particular Google Analytics and Google Maps, only load after your consent. We manage consent with Cookiebot (Usercentrics A/S, Denmark). Cookiebot stores your choice in the cookie «CookieConsent» for a maximum of 12 months. As proof of your consent, Cookiebot stores your truncated IP address, date and time, browser details, the requested address, a random consent ID and your choice. These records are deleted after 12 months. The legal basis is our obligation to be able to demonstrate consent, or our legitimate interest in doing so. You can change your choice at any time via «Cookie settings» in the website footer. Details are in our cookie policy.

4.5 Google Analytics. With your consent, we use Google Analytics 4 (Google Ireland Limited, Ireland) to understand how our website is used. Google Analytics sets cookies and records page views, clicks, device and browser details and approximate location. According to Google, Google Analytics 4 does not store IP addresses. A transfer to Google LLC in the USA is possible (see section 13). You can withdraw your consent at any time.

5. Account and login

To use Libers Suite, you create an account. For this we store the account and contract data from section 1. We only store passwords in encrypted (hashed) form.

Instead of a password, you can also log in with an account at Google, Microsoft or Shopify. We then receive your name, your email address and an identifier of your account from that provider. The provider learns that you are logging in to our service. Its privacy terms also apply.

6. Analysis, optimization and measurement of AI visibility

6.1 What we do. Libers Suite analyzes websites and product data, creates optimized content from them (Knowledge Packs) and regularly measures whether and how AI assistants mention your brand and your products. To do this, we ask these assistants test questions and evaluate the answers. The same applies to the free website report on our website: there we measure for the website entered whether AI assistants know the brand.

6.2 Which data the AI providers receive. We transmit brand names, website addresses, product names, product texts and the topic of the question. We do not transmit account data such as email addresses or payment data, and no data about your customers. If a brand name contains the name of a person, for example for sole proprietorships, this may be personal data.

6.3 Which AI providers we use.

  • Visibility measurement: OpenAI, Anthropic, Google (Gemini), Perplexity, xAI (Grok) and DeepSeek.
  • Creating and evaluating content: OpenAI and our own language model on our servers at Hetzner in Germany.
  • Preview images (Open Graph images) from product title and product description: Google Gemini via Google Cloud in the Europe region.

We use the paid programming interfaces (APIs) of these providers. According to their contract terms, OpenAI, Anthropic, Google, Perplexity and xAI do not use the transmitted data to train their models. For DeepSeek this is not excluded. The seat, contracting entity and safeguards of each provider are listed in our list of sub-processors.

6.4 DeepSeek. DeepSeek (Hangzhou DeepSeek Artificial Intelligence Co., Ltd.) has its seat in the People's Republic of China and stores data there. Neither Swiss nor EU law recognizes an adequate level of data protection for China, and DeepSeek does not offer contractual safeguards such as standard contractual clauses. We therefore only transmit the information from section 6.2 to DeepSeek, that is, information about brands and products, which as a rule is not personal data. Where personal data is exceptionally involved, we base the transfer on the fact that it is necessary to perform the contract concluded with you, namely measuring your visibility in widely used AI assistants (Art. 17(1)(b) revDSG, Art. 49(1)(b) GDPR). If you do not want us to use DeepSeek for your measurements, write to us at privacy@libers.ai.

6.5 Legal basis. Performance of the contract with you (Art. 6(1)(b) GDPR). For the free website report, our legitimate interest in delivering the evaluation you requested (Art. 6(1)(f) GDPR).

6.6 Free website report. You do not need an account for the report. You enter the address of a website. We retrieve up to 50 publicly accessible pages of that website, analyse them and ask AI assistants whether they know the brand (sections 6.1 to 6.4). Together with the report we store the page from which you came to our analyzer (address without parameters), the campaign details from the link (utm_source, utm_medium, utm_campaign) and whether the link came from a Google ad. We do not store your IP address for this. To prevent misuse, we limit the number of analyses per IP address. For this we keep an identifier derived from your IP address in a cache for no longer than one hour.

If you then answer questions about your website, for example type of business, shop system, number of products or goals, we store your answers with the report. For the full report you provide your email address and, optionally, your name. In the next step we create an account with this address with a free 7-day trial. You set your password yourself. We then send you a welcome email. If an account already exists for this address, we do not create a new one and do not link the report to the existing account.

The legal basis for the report is our legitimate interest in delivering the analysis you requested and in measuring our reach without cookies (Art. 6(1)(f) GDPR). For the account it is pre-contractual measures at your request (Art. 6(1)(b) GDPR).

7. Browser extension

Our extension for Google Chrome is optional and also works without a Libers account.

  • Transmission: Only when you click «Start analysis» in the extension does it send the address (URL) of the open tab to our server api.libers.ai. Our server retrieves the page and analyzes it. The extension does not transmit page content, screenshots, browsing history or form input.
  • Local storage: In your browser's storage, the extension keeps the result of the last analysis for five minutes, the number of your free analyses and the chosen language. This information does not leave your browser. It is deleted when you remove the extension.
  • Permissions: The extension only requests «activeTab» (access to the active tab after your click) and «storage» (local storage). It communicates exclusively with api.libers.ai.
  • With an account: If you are logged in, we store the analyzed URL and the result in your account.
  • No disclosure: We do not sell data from the extension and do not use it for advertising or for any purpose other than the analysis.

The legal basis is the performance of the function you requested (Art. 6(1)(b) GDPR).

8. Shopify app

When you install our app in your Shopify store, we receive via Shopify's interfaces:

  • Store data: store domain, session and access data of the app, and first name, last name and email address of the person using the app in the store.
  • Catalog data: products with titles, descriptions, images, prices and other product attributes.
  • Technical events, for example on uninstallation or a change of subscription.

The app only has access to products. It has no access to orders or customer data of your store. The app interface is delivered via Vercel (Vercel Inc., USA); the app's session data is stored in a database at Neon (Databricks, Inc., USA). After uninstallation, we delete your store and product data as soon as Shopify asks us to, unless we must retain individual details for legal reasons. The legal basis is the performance of the contract with you (Art. 6(1)(b) GDPR).

9. Google Search Console

If you connect your Search Console, Libers Suite only reads. We do not change anything in your Search Console. We load clicks, impressions, click-through rate and position per page and query, only for properties you assign to a shop or website.

You see this raw data in your account. The Hub has no view of your raw data.

We compute anonymous evaluations from the data, for example how clicks develop after an optimization compared with unchanged pages. They contain no URLs, no queries and no details that identify you. Groups are only shown from a minimum number of participants.

If you disconnect or delete your account, we revoke access at Google and delete the raw data. The anonymous evaluations remain. Retrieval runs through Google's Search Console API.

10. Payments

We process payments via Stripe (Stripe Payments Europe, Limited, Ireland). Stripe receives name, email address, billing address, amount and the payment details you enter directly at Stripe. From Stripe we only receive payment method, transaction number and payment status. If you pay via the Shopify app, billing runs through Shopify. The legal basis is the performance of the contract (Art. 6(1)(b) GDPR).

11. Support and email

When you write to us or use the support form, we process your name, your email address and the content of your request in order to answer it. Our mailboxes are hosted by cyon AG in Switzerland. We send automated platform emails, such as confirmations, reports and notices, via Resend (Plus Five Five, Inc., USA). For this, Resend receives your email address, the subject and the content of the message. The legal basis is the performance of the contract or our legitimate interest in answering requests (Art. 6(1)(b) and (f) GDPR).

12. Recipients and processors

We only disclose personal data insofar as this is necessary for the purposes set out in this policy. Recipients are mainly carefully selected service providers for hosting, storage, email, payments, AI processing, consent management and web analytics. Insofar as they process data on our behalf, they are contractually bound to our instructions, to confidentiality and to appropriate data security. Some providers, such as Google, Microsoft or Shopify at login, also process data under their own responsibility.

The complete and current list with the seat and safeguards of each provider is available at libers.ai/subprocessors. Beyond that, we only disclose data if we are legally or officially obliged to do so or if it is necessary to protect our rights.

13. Disclosure abroad

Our servers are located in Germany (Hetzner) and Switzerland (Exoscale). Some providers also process data in other countries, in particular in EU member states, the United Kingdom, the USA and, for DeepSeek, China.

  • EU, EEA and United Kingdom: Under Swiss law, these countries provide an adequate level of data protection.
  • USA: We transfer data to providers certified under the EU-US Data Privacy Framework or the Swiss-US Data Privacy Framework, or we agree with them on the European Commission's standard contractual clauses with the adjustments required for Switzerland.
  • China: See section 6.4.

Which safeguard applies to which provider is shown in the list at libers.ai/subprocessors. You can request a copy of the standard contractual clauses at privacy@libers.ai.

14. Retention

We only process personal data as long as necessary for the respective purpose or required by law. After that we delete or anonymize it.

  • Active account: As long as your contract runs, we keep your account, content and measurement data.
  • End of the trial without a paid plan: We deactivate your account, block the API and stop automated processes such as measurements. For 30 days we keep your data unchanged so that you can reactivate your account. After that we anonymize Knowledge Packs, analyses and crawl data; they can no longer be attributed to a person and are only used for statistics. After 90 days we delete or fully anonymize the remaining account data.
  • End of a paid contract: The same periods apply as after the end of a trial, counted from the end of the contract. During the first 30 days you can export your data (GTC section 6).
  • Deleting your account: You can request the deletion of your account at any time at privacy@libers.ai. We then delete all data we are not required to keep.
  • Website report without an account: If no account is created from the report, we delete your email address, name and answers after 90 days. We then keep the website analysis and your answer on the type of business without personal data for statistical purposes.
  • Accounting records and invoices: 10 years, because the law requires it (Art. 958f Swiss Code of Obligations). After that we anonymize them and remove the references to the payment provider.
  • Server log files and security logs: 12 months at most.
  • Support requests: as long as necessary for handling them and for any follow-up questions, at most until your account is deleted, unless they are business records subject to retention.

15. Mandatory information

We need certain information for registration and the contract. Without it, we cannot create an account or provide our services.

16. No automated individual decisions

We do not make automated individual decisions that have legal effects for you or significantly affect you. We do not create profiles for advertising purposes.

17. Data security

We protect personal data with appropriate technical and organizational measures, in particular encrypted transmission (TLS), access restrictions based on the principle of least privilege, role management, logging, backups and regular security reviews.

18. Minors

Our offer is aimed at businesses. We do not knowingly process data of minors.

19. Your rights

Under applicable law, you have the right to access, rectification, erasure, restriction of processing, data portability and to object to processing based on legitimate interests. You can withdraw consent at any time with effect for the future. To do so, write to us at privacy@libers.ai. We may ask for proof of your identity.

You can lodge a complaint with a supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC). In the EU and EEA, it is the supervisory authority at your place of residence, place of work or the place of the alleged infringement.

20. Changes

We adapt this policy when our services, providers or the legal situation change. The version published on libers.ai applies.

21. Language versions

This policy is available in German and English. In case of discrepancies, the German version prevails.

Effective: 27.09.2026 · Version 1.3