Privacy policy

Supernova design & communication Sàrl, Carouge, Geneva, Switzerland, is the controller for the personal data described here. Write to hello@bysupernova.com with any question about your data, and we will answer.

Two kinds of information, and nothing else.

What you send us. When you write to us or brief a project, we receive what you choose to include: your name, email address, company, role, the content of your message, project details and any files you attach.

How the site is used. We measure visits so we know which work is being seen and where the site is failing people. That means a count of visits per page, the country a visit came from, the site or search engine that referred it, the browser and screen size, and which pages and links were used. Where you consent, we also record anonymised replays of page interaction — scrolling and clicking — to find layout problems. Text typed into form fields is masked and never recorded.

We do not build advertising profiles, we do not sell or share data with advertising networks, and we make no automated decisions about you.

We name our processors rather than describe them vaguely, because you are entitled to know where your data goes.

Infomaniak (Switzerland) hosts the website. Data stays in Switzerland. Umami Cloud measures visits. It uses no cookies and identifies no one. Microsoft Clarity records anonymised interaction replays and heatmaps. Only with your consent. Microsoft processes this outside Switzerland and the EU. Google Analytics reports audience and traffic sources. Only with your consent. IP addresses are shortened before storage. Google processes this outside Switzerland and the EU. Supabase and GitHub store the website’s own content and backups. These hold our project text and images, not visitor data.

Each is bound by a data processing agreement limiting them to the purpose above.

Under the Swiss Federal Act on Data Protection, and under the GDPR where it applies to visitors in the EU, we rely on: your consent for Clarity and Google Analytics, which you may withdraw at any time; the steps leading to a contract and performance of that contract when we answer an enquiry or run a project; our legal obligations for accounting and bookkeeping; and our legitimate interest in a secure website and basic, privacy-respecting visitor counts.

Microsoft and Google process data outside Switzerland and the European Economic Area, including in the United States. These transfers rely on the European Commission’s adequacy decision for the EU–US Data Privacy Framework and on standard contractual clauses. If you would rather this did not happen, decline consent and neither tool loads.

Enquiries and project correspondence: up to three years after our last contact, unless a project follows. Contracts, invoices and accounting records: ten years, as Swiss commercial law requires. Microsoft Clarity recordings: thirty days. Google Analytics data: fourteen months. Umami data: kept in aggregate, containing nothing that identifies you.

You may ask what data we hold about you, have it corrected or deleted, ask us to restrict or stop processing it, receive it in a portable form, and withdraw any consent you have given. Write to hello@bysupernova.com and we will respond within thirty days.

If you are not satisfied, you may complain to the Federal Data Protection and Information Commissioner (FDPIC) in Bern, or, in the EU, to your local supervisory authority.

The site is served over HTTPS. Administrative access is password-protected and session-limited. Content is backed up to separate systems so it can be restored. We apply reasonable technical and organisational measures, while acknowledging that no website or email system can be guaranteed completely secure.

We update this policy when our tools or obligations change. The date below marks the current version, and material changes are announced on the website.

Last updated: 7 October 2026