Last updated: 26 September 2026

Privacy policy

AI-Karma is built on the principle of data minimisation: the safest way to protect your data is not to collect it. This page describes what happens, including our uses of artificial intelligence.

The essentials in four points

• Your assessments stay in your browser (local storage). We keep neither a user database nor accounts, and we keep no copy of your answers, except the report you choose to send us (the “AI-Karma may contact me” box).
• No cookies, no advertising trackers, no advertising, no resale of data. The only measurement: cookie-free visit statistics, of which we only see the totals (details below).
• Three functions send data to our server, only when you click: AI report writing, website pre-analysis and sending the report by e-mail (details below).
• Controller: Jaurès Adjamonsi, sole proprietorship, Le Cosson 9, 1326 Juriens (VD), Switzerland, UID CHE-287.137.926. Contact: contact@ai-karma.ch.

What happens in your browser

Your questionnaire answers, your assessments, your draft, your register of AI systems, your incident log and your workspaces are saved in your browser's local storage, on your device. They are never transmitted to us automatically. You can delete them at any time (the “Delete” button, or clearing site data in your browser). Deletion is immediate and final, because we have no copy. You can also refuse this storage by blocking local storage in your browser; the tool then cannot keep your assessments.

Audience measurement

To know which pages are viewed, we use Vercel Web Analytics. It sets no cookies and writes nothing to your browser's storage. The script, served from our domain, sends Vercel the address of the page viewed and, if you arrive from another site, the referring page; Vercel derives from it an approximate location (country, region or city) and the device and browser type. According to Vercel's documentation, visits are deduplicated using a fingerprint renewed every day, with no tracking from one site to another. We only see totals. Besides page views, a single action is sent: the click on the “Book a debrief” button, without any of your answers. The content of your assessments is never sent. You can refuse this measurement by blocking the script with a content blocker; the site works the same way.

Technical logs

Like any host, Vercel records for each request the IP address, the time, the address of the page requested and the browser, to run and protect the site. We only consult them in the event of an incident. The lines our own code adds contain neither your IP address nor your e-mail address in the clear. The retention period of these logs is set by Vercel.

Our uses of AI and server-side processing

Two functions, triggered only by a click on your part, send data to our server (hosted by Vercel), which passes it to the Claude API (Anthropic) for processing:

• KarmaWriter report: the company name, sector, headcount and your answers are transmitted for as long as it takes to write the report. We keep no copy of them.
• Website pre-analysis: our server reads the home page of the website you enter and at most two of its legal pages, then sends their text to Anthropic. This text may contain personal data published on that website, for example a manager's name. We keep neither the website address nor the content after the response.

According to Anthropic's commercial terms and documentation, data sent through the API is not used to train its models, and Anthropic deletes it no later than 30 days after receipt, except content flagged for breaching its usage rules, which is kept for up to two years, and except where the law requires it to be kept. This processing involves a disclosure of data abroad (see processors below). If you want no transfer at all, do not use these buttons: the assessment works without them, with a report generated from a template.

Processors

Sending the report by e-mail: your address is used for that send alone. We keep no list and send no newsletter. If you tick the optional box “AI-Karma may contact me”, a copy of the report is sent to contact@ai-karma.ch and we write to you about it at most once; you can withdraw this consent at any time by writing to contact@ai-karma.ch, and we then delete the copy received. Without that box, no copy reaches our inbox and your address is added to no list. Your address and the content of the message do, however, pass through Resend, our sending provider, which keeps the delivery log. As account holders we have access to it, and we use it only for the technical monitoring of sends.

Basis for these disclosures abroad (art. 16 FADP): Vercel states in its privacy notice that it is certified under the Swiss-U.S. Data Privacy Framework, which the Federal Council has recognised as providing adequate protection since 15 September 2024 (art. 16 para. 1 FADP, annex 1 DPO). Anthropic Ireland is established in Ireland, a State the Federal Council recognises as providing adequate protection (art. 16 para. 1 FADP); the onward transfer to Anthropic, PBC in the United States is covered by the standard contractual clauses of its data processing addendum, which includes a supplement for Switzerland. Resend: standard contractual clauses recognised by the FDPIC, with the adaptations to Swiss law provided for in its data processing addendum (art. 16 para. 2 let. d FADP). Upstash states in its privacy policy that it adheres to the Swiss-U.S. Data Privacy Framework (art. 16 para. 1 FADP); its data processing addendum provides for the standard contractual clauses as a fallback. We keep none of this data on our side. We are looking into hosting in Switzerland (see our “Our own score” page).

Your rights (FADP)

You can request access to your data (art. 25 FADP) and its rectification (art. 32 para. 1 FADP), object to processing or request erasure (art. 30 para. 2 let. b and art. 32 para. 2 FADP), and obtain the data you have provided to us (art. 28 FADP). Since your assessment data never leaves your browser, you delete it yourself. For everything else, for example an e-mail you sent us or a report sent and recorded in Resend's log, write to contact@ai-karma.ch. We answer an access request within the 30-day period set by law (art. 25 para. 7 FADP). You may also contact the Federal Data Protection and Information Commissioner (FDPIC).

Complaints and reporting

If content produced by our AI functions seems wrong or problematic to you (an inaccurate pre-analysis suggestion, the wording of a report), report it to contact@ai-karma.ch with the screenshot or export concerned: a human review is carried out and a reasoned reply is given to you within 30 days. As a reminder: no AI-Karma function takes a decision in your place — AI suggestions are always subject to your validation.

Security and changes

The server functions are protected by rate limiting, strict input validation and, for website pre-analysis, an anti-SSRF guard that resolves the host name and refuses any private or reserved address before opening the connection — protections verified by automated tests replayed at every evolution of the engine. Any change to this policy will be dated at the top of the page; substantial changes will be flagged on the home page.