Privacy notice.

Controller

“coprod” is the brand. The entity named above is the one that decides what happens to your data and that you can hold to this notice.

Reaching us about data

Write to contact@coprod.ch with “privacy” in the subject line. A human reads it. We are a small team, so we answer within 30 days at the outside, usually within a few working days.

We have not appointed a data protection officer. Under Art. 37 GDPR and Art. 10 revDSG we are not required to: we do not monitor people systematically and at scale, and we do not process special-category data.

Representative in the EU (Art. 27 GDPR): {{EU_REPRESENTATIVE}}

What it is

We wrote our own. It runs on our own servers, it talks to nobody else, and its entire output is a table of page views with timing on it. It exists so we can tell whether the pages we spend a week writing are read past the first screen. That is the whole ambition.

It is first-party: the beacon goes to coprod.co/api/measure and stops there. No third party is involved in collecting it, and no third party is sent it afterwards.

One exception, and it is not ours. Alongside the system described here, this site also runs Vercel Web Analytics, a product of our hosting provider. It is cookieless and stores nothing on your device, but it is a separate system with a wider appetite: it records page views, referrer, browser, operating system, device type, and an approximate location derived from your IP address that resolves to city level, not merely to country. Vercel Inc. is a US company and processes it as our processor, under its retention schedule rather than the 35 days described below. The switch at the top of this page does not turn it off; Do Not Track and Global Privacy Control do, and so does writing to us.

The same provider also runs Vercel Speed Insights on this site. It measures how fast the pages load rather than who reads them: for a sample of page views it records the page, the performance figures (Core Web Vitals), your browser and operating system string, device type and country. It is cookieless, stores nothing on your device and carries no identifier that survives the page view; Vercel processes it as our processor under its own retention schedule.

What it records

• The page path, and the domain that referred you: the domain, not the full URL.
• Campaign tags (utm_source and friends) if the link you followed carried them.
• Engaged time and total time on the page, in seconds.
• How far down you scrolled, to the nearest tenth of the page.
• Which sections were in the middle of your screen, and for how long.
• Named interactions: “turned the actuator viewer”, “opened the simulator”, “pressed pre-order”. The name of the thing, never where your cursor was.
• A device class (mobile, tablet or desktop) derived from the browser string.
• Your country, and the time.

What it never does

• No cookie is set or read. None.
• The measurement code writes nothing to local storage, session storage or IndexedDB, and reads exactly one thing from any of them: the opt-out key set by the switch on this page, which it has to read in order to obey it. Nothing else on your device is looked at, and that key is never transmitted. Section 08 names it.
• No fingerprinting signal is collected: no canvas or WebGL rendering, no font enumeration, no audio stack, no screen or window dimensions, no device memory, no CPU count, no battery, no timezone probe.
• No mouse positions, no click coordinates, no keystrokes, no form contents, no session recording or replay. We could not reconstruct your visit if we wanted to.
• No cross-site, cross-device or cross-session linking. There is nothing to link with.
• No advertising identifiers, no data broker, no enrichment, no selling, no sharing.

The two honest caveats

Your IP address does reach our server. It has to: it is the address the page is sent back to. It is never written to the measurement database, never used as a key to anything, and never leaves the request: our own code does not even hold it in memory, because the per-address rate limit counts a one-way digest that is discarded when the server process is recycled. The country stored on the row does not come from the address at all. Our hosting edge resolves it and hands us the two-letter code. Country, never city, never region.

Each page load gets a random number. It lives in the page's memory, it is thrown away when you close or leave the tab, and a reload mints a fresh one. It exists purely so that a page reporting “18 seconds” twice is not counted as 36. It is not a visitor id, it does not identify you, it does not survive anything, and it cannot be used to recognise you on your next visit, because there is no next-visit record to match it against.

Why we may do this without asking

The lawful basis is Art. 6(1)(f) GDPR, legitimate interest, and here is the actual interest rather than the word: we need to know which of our technical pages are read, and how far, so that we write fewer and better ones, and so that we can tell whether a launch landed without buying an analytics product that would learn far more about you than we want anyone to know.

We think that interest does not override your rights, because of what the system cannot do: it holds no identifier, so it cannot build a profile; it holds no IP or city, so it cannot locate you; it holds nothing that could be combined with another dataset to single you out; and it forgets the raw records in 35 days. The intrusion is close to the floor, and the alternative, a hosted analytics product with cookies and a US parent, would be a great deal worse for you. If you disagree, the box below is not decorative.

Signals we obey

If your browser sends Do Not Track (DNT: 1) or Global Privacy Control (Sec-GPC: 1), the measurement script does not run and does not send anything. Belt and braces: if a beacon reaches our server carrying either header anyway, the server discards it without writing a row.

GPC is a legally recognised opt-out signal in several jurisdictions and a plain statement of preference everywhere else. We treat both the same way, and we treat them as binding rather than advisory.

Automated traffic (crawlers, headless browsers, monitors) is filtered out. It is noise in the numbers, not a person to be respected.

What you are signing up to

The form at the bottom of most pages takes one thing: an email address. We store it with the time you submitted it. We do not ask for a name, we do not look up your company, and we do not append anything to it from anywhere else.

We use it for one purpose: to tell you when there is something real to see: a module shipping, a batch opening, a piece of the stack going public. It is not a newsletter with a schedule, and it is not sold, rented, swapped or shared with anyone.

Getting off it

Reply to any message we send, or write to contact@coprod.ch and say “remove me”. That is the whole procedure. We delete the address rather than flagging it as unsubscribed, unless we need to keep a suppression record to make sure we do not add you back by accident, in which case that record is the address and nothing else.

Withdrawing consent does not make what we sent before unlawful; it stops anything further.

The form is Google's

The “Apply” buttons on the careers page open a Google Form. That means your application reaches Google before it reaches us, and Google processes it on its own infrastructure under its own terms, which we did not write. We use it because it works and we are small; we are telling you because you should be able to decide with that in front of you rather than behind you.

If you would rather not use it, write to contact@coprod.ch instead. An application by email is not a lesser application, and it does not go through Google's form.

What happens to it

Your application is read by the founders and by whoever would work with you. It is not scored by a machine, ranked by a model, or fed to anything that makes a decision. We do not run background checks and we do not search your private accounts.

We keep it for {{APPLICATION_RETENTION}} after we decide, so that we can answer questions about the process and defend a decision if we have to. Then it is deleted. If we would like to keep your application on file beyond that in case something better fits later, we will ask you, and you can say no with no consequence.

It is a different site

Pre-order links on the products page take you to shop.coprod.co, which is a Shopify storefront. It is ours, but it is not this site: it runs on Shopify's platform, it sets its own cookies for your cart and checkout, and it has its own privacy and refund policies, which govern what happens once you are there.

Read them at shop.coprod.co/policies/privacy-policy. Nothing on this page overrides them, and the cookieless claims above are about coprod.co, not about the shop.

What an order involves

To ship you a module we need a name, a delivery address, an email, and sometimes a phone number for the carrier. Billing details go to the payment provider; we see that a payment succeeded, not your card number.

Order records that count as accounting documents are kept for ten years under Art. 958f of the Swiss Code of Obligations. That is not our choice and we cannot delete them early, even on request, a point worth knowing before you order rather than after.

Transfers outside Switzerland and the EEA

Several of the providers above are US companies, so some data can be accessed from the United States even where it is stored in Europe. Those transfers rest on the EU–U.S. and Swiss–U.S. Data Privacy Frameworks where the recipient is certified under them, and otherwise on the European Commission's standard contractual clauses together with the Swiss addendum required by the FDPIC.

We will not pretend that paperwork makes US surveillance law disappear. What we can do is keep the amount of data that ends up in that position as close to nothing as possible, which is most of what this notice is about.

Nobody else

We do not sell, rent, trade or share personal data. There is no ad network, no data broker, no “marketing partner”, no affiliate tracking and no analytics reseller in this stack.

We would disclose data to a court or authority if we were legally compelled to, and where the law allows us to say so, we would tell you.

If the company is ever sold or merged, personal data could pass to the acquirer as part of the business. If that happens we will say so here before it takes effect.

How to exercise them

One email to contact@coprod.ch. No form, no portal, no account required. We answer within one month, and if a request is genuinely complicated we will tell you inside that month rather than going quiet.

If we cannot tell who is asking, we may need to ask a question or two to be sure. We would rather be slightly annoying than hand your data to somebody pretending to be you. We will not demand ID as a matter of routine.

One thing we genuinely cannot do

We cannot give you access to “your” measurement records, or delete them, because we cannot find them. They contain no identifier: no cookie, no IP, no account, nothing that connects a row to a person. There is no query we could run that would return your visits rather than somebody else's.

That is Art. 11 GDPR: where a controller cannot identify a data subject, the access and erasure rights do not apply to that data. We are not using it as a shield; it is the direct consequence of a choice made in your favour. Everything else we hold (an email address, an application, an order) is fully reachable, and those requests we can and do answer.

In Switzerland

In the EU or EEA

You can complain to the supervisory authority of the country you live or work in, or where you think something went wrong. You do not have to come to Switzerland to do it.

The current list of national authorities, with contact details, is published by the European Data Protection Board: edpb.europa.eu · members.

You also have the right to a judicial remedy under Art. 79 GDPR, and in Switzerland to bring a civil action under the revDSG.

What we actually do

• Everything is served over HTTPS; there is no unencrypted route to this site.
• A strict Content-Security-Policy stops the pages loading scripts, styles, fonts or images from anywhere but our own origin, which is also why no third-party tracker could be injected without the page breaking loudly.
• Referrer policy is set so other sites are told the domain you came from, not the page.
• Camera, microphone, geolocation and payment APIs are switched off at the browser level for this site.
• Measurement rows and subscriber email addresses live in separate databases with separate credentials, so the two cannot be joined even by us, even by mistake.
• Access to the stores is limited to the founders, and the beacon endpoint accepts nothing but the small fixed set of fields described in section 03.

What we do not claim

No system is perfectly secure, and a company of our size that told you otherwise would be selling something. If a breach ever affects your data, we will notify the FDPIC and, where the risk to you warrants it, the relevant EU authority, and we will tell you directly, in plain language, rather than by quietly editing this page.

Found a hole? contact@coprod.ch. We will thank you properly and we will not send a lawyer.

Children

This site sells industrial robotics modules and hires engineers. It is not directed at children, and we do not knowingly collect data from them. The measurement system cannot tell anyone's age, because it cannot tell anything about anyone. If you believe a child has sent us personal data, write to contact@coprod.ch and we will delete it.

Changes

We will update this page when what we do changes, and the rule we are setting ourselves is that the page changes before the system does, not after.

The version and date are at the top. For a material change (a new purpose, a new processor, anything touching your device) we will do more than bump the date: we will say what changed and why, and where the change would need your consent, we will ask for it instead of announcing it.