Dieses Dokument liegt derzeit nur auf Englisch vor.
Last updated: 6 November 2026
This policy explains how Linard handles personal data, across the marketing site at linard.ai and the application at app.linard.ai.
1. Who is responsible
Linard is operated by Linard AG, Oberburg 14, 8158 Regensberg, Switzerland (UID CHE-337.479.236), which is the controller responsible for the personal data described in this policy.
Correspondence relating to this policy, including any data-subject request, should be sent to privacy@linard.ai.
2. Two different relationships, and which one applies to you
Linard is used in two ways, and the data protection roles differ between them. Which sections of this policy apply depends on how you came to use Linard.
2.1 Where you signed up directly
If you registered yourself using an invitation code, Linard is the controller of your personal data. This policy applies to you in full, and Linard decides the purposes and means of the processing described here.
2.2 Where your employer or another organization provides Linard to you
If you use Linard because an organization made it available to you, that organization is the controller and Linard acts as its processor. Linard processes your personal data on that organization's documented instructions, under a data processing agreement.
In that case:
- Your relationship on data protection is with that organization, and its own privacy notice governs
- Requests to access, correct or delete your data should go to that organization, which Linard will support
- The purposes of the processing are set by that organization, not by Linard
Who in your organization sees what
- Only you: conversation transcripts, analysis, individual feedback and the profile information you add, including your profile picture. Linard is designed so that managers, administrators and human resources cannot access them, and the product provides no way to share them.
- Managers and administrators: your name, how much you practiced each month and when you were last active. Administrators also see your email address and when you joined. They can add people to the organization and deactivate or reactivate accounts.
Sections 5, 6, 7, 8 and 11 of this policy, covering how information is used, sub-processors, transfers, retention and security, describe how Linard handles data in both cases and remain relevant. The rest describes Linard acting as controller.
Where a data processing agreement conflicts with this policy, the agreement governs.
3. What is collected
Account data
Name and email address. Where sign-in with Google or Microsoft is used, the basic profile information those providers return to confirm identity; Linard does not receive the password. Where email and password sign-in is used, an encrypted (hashed) version of the password, never stored in readable form. Any access code or invitation used to join.
Organization details
Where an organization provides Linard to you, Linard learns about the organization's structure and your place in it. Linard stores the email addresses the organization names as its contacts, to tell them about its usage and to reach them in case of incidents. If you try to join Linard but your organization has run out of seats, then administrators are informed about your registration attempts.
Conversation data
When a conversation runs:
- Microphone audio and video are captured by the browser and streamed in real time to conduct the conversation. They are used to produce the transcript and to generate the counterpart's replies.
- A transcript of the conversation is recorded and stored.
- What you enter before the conversation. The scenario you select and any briefing or preparation notes you write to set up the situation.
- The feedback Linard produces. The analysis of the conversation and the suggestions shown in the debrief afterwards.
- Session details. Which scenario and counterpart were used, when the session took place and how long it lasted.
Raw audio and video are not stored. They are processed only to conduct the live conversation and are not retained afterwards.
Voice and image are never used to identify a person. They are processed to conduct the conversation, not for biometric identification, and no voiceprints or facial templates are created or retained.
Profile information
You may add information about yourself to your profile. Adding it is optional, and you can change or remove it at any time. It is used only to provide Linard to you, is never used to identify you, and is kept with your account until you change or remove it or your account is deleted. Files you upload are processed by Linard itself and are not sent to an external AI service.
What you can add today:
- Assessment results. The results of a strengths, personality or similar assessment, so that Linard can suggest exercises that suit you and tailor its coaching and feedback to you. Where you upload the assessment report, only the results are taken from it; the report itself is discarded and not stored.
- A profile picture. A photo you upload is resized and stored with your account.
Practice times
You may plan one-off or recurring practice times in Linard. The respective calendar entries are stored in Linard, invitations are sent to your email address, and your responses to these invites are tracked. If you use a Google Calendar and opt in to share your calendar with Linard, then Linard can see when you are busy, but not the details of your calendar entries. This helps you to find free time for practice sessions. You can remove practice invitations and revoke calendar sharing at any time.
Technical and usage data
IP address, browser and device type, pages or screens viewed, and similar log data, collected automatically to keep the service running and secure.
Correspondence
If you email Linard, submit comments or suggestions through the product, or take part in a user interview, a record of that exchange is kept.
4. Why it is collected, and the legal basis
This section applies where Linard is the controller. Where an organization provides Linard to you, that organization determines the purposes and the legal basis.
| Purpose | Legal basis |
|---|---|
| To provide the service: create the account and deliver Linard's features | Performance of the agreement with the user |
| To run, secure, debug and improve the application | Legitimate interests in operating and developing the service |
| To stay in contact about the service | Legitimate interests, and consent where required |
| To meet legal, accounting and regulatory obligations | Legal obligation |
Where consent is the basis, it may be withdrawn at any time by email. Withdrawal does not affect anything done beforehand.
5. How information is used
Personal data is used only to provide and improve Linard and to stay in contact with users about it.
Linard does not, and will not:
- Sell personal data
- Share personal data with other businesses for their own marketing, sales or research
- Make conversations, transcripts or feedback visible to other users
On what the analysis does. Linard evaluates how a conversation was conducted: structure, argumentation, handling of objections and similar aspects of professional communication. It does not assess personality, emotional state, or characteristics unrelated to the conversation, and it does not infer them from voice or image.
On personalization. What you add to your profile and how your earlier sessions went are used to make exercises, coaching and feedback more personal.
Where Linard acts as controller, it treats this analysis as high-risk profiling under the revised Federal Act on Data Protection and applies the stricter requirements, even though the classification is arguable. Where an organization provides Linard to you, the classification is that organization's to make.
On improving Linard. Handling incidents, assuring quality and improving the product require analyzing conversations held with Linard. To protect users' privacy, Linard performs such analysis on a copy in which identifying details, such as the names of people and organizations and addresses, have been replaced with invented ones (pseudonyms). To find these details, Linard uses the same AI provider as for debriefs. The original and the copy are stored separately, both in Switzerland. The copy is still personal data, so this policy applies to it. Only where a specific problem cannot be investigated on the copy do named members of the team open the original, and this is logged.
On anonymized and aggregated data. Linard may create data that can no longer be linked to any individual, and use it to improve current and future products, to build benchmarks and for research, including after personal data has been deleted.
On AI model providers. Linard's agreements with its model providers prohibit training on data processed for Linard.
6. Sub-processors
Linard relies on a small number of providers to operate the application. They act on instruction, under data processing terms, and may use the data only to provide their service.
| Function | Jurisdiction | Data handling | Transfer basis |
|---|---|---|---|
| Application and data storage | Switzerland | Persistent, encrypted | No transfer |
| Observability | EU | Persistent metrics and logs | Adequate jurisdiction |
| Avatar rendering | Norway (EEA) | Transient, not stored | Adequate jurisdiction |
| Voice, reasoning and analysis models | United States | Transient, not stored. No training on the data | EU Standard Contractual Clauses with Swiss adaptation |
| Call setup | United States | Transient, not stored | Swiss-US Data Privacy Framework, with EU Standard Contractual Clauses as fallback |
| Authentication | United States | Identity confirmation only | Swiss-US Data Privacy Framework or Standard Contractual Clauses |
| Email and calendar invitations | United States | Email addresses, messages and practice times | Swiss-US Data Privacy Framework or Standard Contractual Clauses |
| Office and development tools | EU and United States | Correspondence and documents. Pseudonymized data for development, under plans that exclude training | Adequacy or Standard Contractual Clauses |
The full list of named sub-processors with their jurisdictions is available on request to privacy@linard.ai, and forms part of the data processing agreement for organizational customers.
Personal data may also be disclosed where the law requires it, or where strictly necessary to protect legal rights.
7. International data transfers
Linard is a Swiss company and operates under the revised Federal Act on Data Protection (revFADP). The revFADP permits processing outside Switzerland where adequate protection exists, either because the jurisdiction appears on the Federal Council's adequacy list, or because contractual safeguards apply. Linard uses both routes, as set out in the table above.
Linard prefers to keep data in Switzerland wherever possible. Account data, conversation transcripts and the analysis derived from them are stored in Switzerland, and so are their backups. Providers in the United States are used for transient processing during a live conversation and for the analysis that follows it, and do not retain that data afterwards.
Sign-in, email delivery and calendar invitations can involve services in the United States, depending on how you sign in and what you use in Linard. No conversation details pass through these services.
8. How long it is kept
Session history, including practice times, is part of what makes Linard useful, so account and session data is kept for as long as the account is active.
Users may ask for their data to be deleted at any time by emailing privacy@linard.ai, and it will be removed, subject to limited legal exceptions. When an account is closed, its data is deleted or anonymized within a reasonable period afterwards.
Raw audio and video are not stored.
Where Linard acts as a processor, retention is determined by the controller and set out in the data processing agreement. An account its organization has deactivated is kept, unable to sign in, until the organization asks for it to be deleted or the agreement requires it. A record of someone who could not join because the organization's places were taken is deleted after 30 days.
9. Your rights
Under the revised Federal Act on Data Protection, the GDPR where it applies, and equivalent laws, you have the right to access, correct, delete, restrict or object to the processing of your personal data, to port it to another service, and to withdraw consent where it is the basis for processing.
Where Linard is the controller, email privacy@linard.ai. Requests are answered within one month.
Where an organization provides Linard to you, address your request to that organization as controller. Linard will support them in responding.
If you believe personal data is being mishandled, you may complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch, or, where the GDPR applies, your local supervisory authority. A chance to put things right first would be appreciated.
10. Automated decisions
Linard produces feedback and analysis. It does not make automated decisions that have legal effects or similarly significant effects on a person.
Where an organization provides Linard to you, Linard's design keeps individual analysis with the user rather than with management, so that employment decisions are not based on it. How that is applied is set out in the agreement with that organization.
11. Security
Linard's practices are aligned with ISO 27001, the international standard for information security management, which is a common framework for meeting the data security obligations under Swiss data protection law. Alignment covers access control, encryption in transit and at rest, secure development, logging and incident response, and vendor and sub-processor risk management.
Linard is not yet certified. As a young company, certification is a step ahead of us rather than behind.
No system is perfectly secure. If a breach affecting personal data comes to light, affected individuals and the relevant authority will be notified where the law requires, and where Linard acts as a processor, the controller will be informed without undue delay.
12. Cookies
The Linard sites use a small number of cookies and similar technologies that are essential for the service to work, for example to keep a user signed in. No third-party advertising or cross-site tracking cookies are used. Analytics, where used, are cookieless. If non-essential cookies are added in future, this policy will be updated and consent obtained where required.
13. Children
Linard is a professional tool and is not directed at children. Data is not knowingly collected from anyone under the age of 18.
14. Changes to this policy
This policy may be updated from time to time. The "Last updated" date shows the most recent version. Material changes, including changes to how data is used or to the categories of sub-processors, will be flagged and, where appropriate, communicated directly.