Privacy policy

Overview

This policy covers the website screenlink.ch, the ScreenLink cloud service at app.screenlink.ch (Studio and player), and the ScreenLink TV apps for Android TV, Google TV, Fire TV, Apple TV, LG webOS and Samsung Tizen. It follows the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR). If the German version differs, the German version applies.

Who is responsible

Privacy questions and requests: info@screenlink.ch

Our role

We are the controller for customer accounts, billing, support and this website. For the content and personal data that customers manage in Studio, such as staff photos on a welcome screen or the users of their team, the customer organisation is the controller and we process that data on its behalf and under its instructions, as set out in our data processing agreement (German). If this concerns you as a data subject, please contact the organisation that uses ScreenLink first; we will support them.

This website

When you open screenlink.ch, your browser sends technically necessary information to our server: IP address, date and time, the address requested and the browser identifier. We use it only to deliver the pages and protect the server against abuse. We keep no access logs for the website.

The website sets no cookies and uses no analytics, tracking, advertising networks or social media plugins. Fonts and all other files come from our own server.

Legal basis under the GDPR: our legitimate interest in a secure, working website (Art. 6(1)(f) GDPR).

Account and Studio

• Account data: organisation name, users' names and e-mail addresses, roles and permissions. Passwords are stored only as a cryptographic hash, never in plain text.
• Session data: a sign-in cookie, the time of sign-in and the session's browser identifier.
• Abuse protection: failed sign-in and sign-up attempts are counted per IP address for a short time in memory to slow down automated attacks. This is not stored permanently.
• Invitations and links: one-time links for invitations (valid 7 days), e-mail confirmation (7 days) and password resets (24 hours).
• Plan and usage: the plan, number of screens, start and end of the trial.
• Contract terms: which version of the terms and of the data processing agreement was accepted for your organisation, when and by whom (name and e-mail address), which version of this privacy policy was shown, and when we told your organisation about changes. This is our record of the contract.

Legal basis: performance of the contract with your organisation (Art. 6(1)(b) GDPR) and our legitimate interest in a secure service (Art. 6(1)(f) GDPR).

Screens, player and TV apps

So that a screen shows the right content and you can see its state, we process for each device:

• a random device identifier and the pairing code; on Android devices, the Android device ID;
• device model, screen resolution, browser or app version;
• the IP address of the last connection, online status and outages (for monitoring);
• which content is currently playing (for the live preview in Studio).

The ScreenLink TV apps show the player full screen and talk only to the ScreenLink server. They need internet access and may start when the device is switched on. The version from Google Play and the Amazon Appstore does this through kiosk mode (the app as home screen). Only the version installed directly from Studio uses an accessibility service on newer Android devices, which is active only when you turn on autostart; it brings the app to the front after a restart and reads no screen content and no input. The apps request no location, camera, microphone or contacts permission, contain no ads, analytics or tracking SDKs, and share no data with third parties.

Your content

We store images, videos, web page addresses, canvas designs, playlists, channels and schedules so that your screens can play them. We don't look at or analyse your content unless you ask us to in a support request, or it is needed to stop abuse or required by law. For this content we act as your organisation's processor.

E-mails

We send e-mails that belong to the service: e-mail confirmation, invitations, password links, notices about the end of the trial and failed payments, notices about changes to the terms, the data processing agreement and this privacy policy, and monitoring alerts if you set them up. No newsletters, no advertising. E-mail is sent through Hostpoint's mail servers in Switzerland.

Payments

Paid plans are paid through Stripe. You enter payment details on Stripe's pages; card numbers never reach our servers. Stripe gives us a customer number, the subscription status, the number of paid screens, invoices and the billing address. Stripe processes payment data as an independent controller under the Stripe privacy policy.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and our legal obligation to keep accounting records (Art. 6(1)(c) GDPR).

Contact and support

When you write to us, we process your e-mail address, name and message to answer you. The mailboxes are hosted by Hostpoint in Switzerland.

Cookies and browser storage

• Website: no cookies, no local storage.
• Studio: one strictly necessary sign-in cookie (HttpOnly, valid for 30 days or until you sign out). It serves no other purpose.
• Player: the player keeps the device identifier, the screen's access token and the last loaded content in the browser's storage, so it keeps playing after a restart or an outage.

Recipients and service providers

Beyond that, we share data only when you ask us to or when the law requires it.

Transfers abroad

The website, Studio, database, content and backups are in Switzerland. Data leaves Switzerland only for payment processing by Stripe: to the EU, which Switzerland recognises as providing adequate protection, and to the USA. Stripe, Inc. is certified under the Swiss-U.S. and EU-U.S. Data Privacy Framework; the European Commission's standard contractual clauses apply in addition.

Retention and deletion

• Account and content: as long as the account exists; removed within 30 days after the account is deleted.
• Backups: nightly, kept for 14 days. Deleted data disappears from backups by then at the latest.
• Sessions: 30 days or until you sign out.
• Accounting: invoices and payment records for ten years, as Swiss law requires.
• Support requests: until resolved and then at most two years, unless the law requires longer.

Security

All connections are encrypted with TLS. Passwords are stored as scrypt hashes. Each organisation's data is separated from all others in the database by row level security. Only a few authorised people have server access; the admin portal requires two-factor sign-in and logs every action.

Your rights

You can ask for access to your personal data, correction, deletion, restriction of processing, objection to processing based on legitimate interest, and a copy of your data in a common electronic format. Write to info@screenlink.ch; we answer within 30 days and may ask you to confirm your identity. You can also complain to a supervisory authority: in Switzerland the Federal Data Protection and Information Commissioner (FDPIC), in the EU the authority where you live or work.

We make no automated individual decisions and create no profiles.

Children

ScreenLink is a service for businesses and organisations. It is not directed at children, and we don't knowingly collect data from children.

Changes

We update this policy when the service or the law changes. The version published here applies. We inform customers of material changes by e-mail.