Last updated: 20 October 2026
The AI models we use, changes to them and to our AI-supported features, and our data-protection documents are listed on our Data Protection page.
Rflect AG (hereinafter also referred to as "Rflect", "we", "us") obtains and processes personal data concerning you or other persons (so-called "third parties"). We use the term "data" here synonymously with "personal data" or "personal information".
In this Data Protection Notice, we describe what we do with your data when you use https://www.rflect.ch or our applications (hereinafter "Website"), purchase our services or products, are otherwise in contact with us under a contract, communicate with us or otherwise deal with us. If applicable, we will provide you with timely written notice of additional processing activities not mentioned in this Notice. In addition, we may inform you separately about the processing of your data, e.g. in declarations of consent, contractual terms and conditions, additional data protection notices, forms and notices.
If you transmit or disclose data about other persons to us we assume that you are authorised to do so and that this data is correct. By transmitting data about third parties, you confirm this. Please also ensure that these third parties have been informed of this data protection notice.
This data protection notice is designed to meet the requirements of the EU General Data Protection Regulation ("GDPR") and the Swiss Federal Act on Data Protection ("FADP"). However, whether and to what extent these laws are applicable depends on the individual case.
Rflect AG, Zurich, is responsible under data protection law for the data processing by Rflect AG described in this data protection notice, unless otherwise communicated in individual cases, e.g. in further data protection notices, on forms or in contracts.
Where you use Rflect through a licensed institution (for example, your university), the institution is the controller of the data processed within the application on your behalf, and Rflect acts solely as a data processor on the institution's instructions, including for your private reflections. The roles described in this notice therefore depend on the context in which you use our services (see Section 4).
You can contact us regarding your data protection concerns and to exercise your rights in accordance with Section 11 as follows:
Rflect AG, c/o Jovanovic, Neunbrunnenstrasse 118, 8050 Zurich — info@rflect.ch
Our representative in the European Union pursuant to Art. 27 GDPR is: Priverion Deutschland GmbH, Schellingstr. 109a, 80798 Munich, Germany. If you are in the United Kingdom, our UK representative pursuant to Art. 27 UK GDPR is: Priverion UK Ltd., 167-169 Great Portland Street, 5th Floor, London W1W 5PF, United Kingdom.
We process various categories of data about you. The main categories are as follows:
Technical data: When you use our website or other electronic services, we collect the IP address of your end device and other technical data to ensure the functionality and security of these services. This data also includes logs that record the use of our systems. Application logs contain technical metadata only, never the content of reflections, and are retained for 90 days. To ensure the functionality of these services, we may also assign you or your end device a customised code (e.g. in the form of a cookie, see Section 12). The technical data itself does not allow any conclusions to be drawn about your identity. However, in the context of user accounts, registrations, access controls or the processing of contracts, they can be linked to other data categories (and thus possibly to your personal information).
Registration data: Certain offers and services can only be used with a user account or registration, which can be done directly with us or via our external login service providers. In doing so, you must provide us with certain data and we collect data on the use of the offer or service. Registration data is not collected separately for individuals who are enrolled through their organization. We retain registration data for as long as your account exists. It is deleted when you request deletion of your account or, where you use Rflect through an institution, when the institution asks us to or its contract ends.
Communication data: If you contact us via the contact form, by e-mail, telephone, letter or other means of communication, we collect the data exchanged between you and us, including your contact details and the ancillary data of the communication. We generally store this data for 12 months from the last exchange with you. This period may be longer if this is necessary for reasons of proof or to comply with legal or contractual requirements or for technical reasons. Emails in personal mailboxes and written correspondence are generally stored for 10 years (Art. 958f CO). Recordings of (video) conferences are generally retained for 24 months. Chats are generally retained for 2 years. Support requests you submit in the application, including conversations with our support assistant, are retained for 365 days from the last exchange and, where you use Rflect through an institution, deleted at the latest when its contract ends.
Master data: We define master data as the basic data that we require in addition to the contract data for the processing of our contractual and other business relationships or for marketing and advertising purposes, such as name, contact details and information, e.g. about your role and function, your date of birth, customer history, powers of attorney, signature authorisations and declarations of consent. As a rule, we store this data for 10 years from the last exchange with you, but at least from the end of the contract. In the case of pure marketing and advertising contacts, the period is normally much shorter, usually no more than 2 years from the last contact.
Contract data: This is data that arises in connection with the conclusion or processing of a contract, such as information about contracts and the services to be provided or provided, as well as data from the run-up to the conclusion of a contract. We generally store this data for 10 years from the last contractual activity, but at least until the end of the contract.
Behavioural and preference data: We record how the application is used (for example which features are opened), linked to your account, to operate and support the service, and analyse this data in aggregated form to improve it. Page views on the website and in the application are measured without cookies and without identifying you (Section 12). We do not build marketing profiles and do not share usage data with third parties for their own purposes. We anonymise or delete this data when it is no longer relevant for the purposes pursued, which may be up to 24 months. We describe how tracking works on our website in Section 12.
Data collected and processed in our application including reflections: Through your interaction with our application, we collect data related to your (the student/learner's) interaction with personal growth activities. These include your personal reflections, results of assessment data, perceived quality of your reflections, actions you defined in relation to these activities and other data used in the current and following personal development activities. Where you use Rflect through a licensed institution, your institution is the controller of this data and Rflect processes it solely as a processor on the institution's instructions. Reflections submitted under a private visibility setting are never disclosed to your institution, lecturer or other students; if we receive a binding court order or regulatory demand to provide private content, we will, to the extent legally permissible, delete the affected private reflections rather than release them. For program reflections, your lecturer sets the visibility setting of each question and you see it before answering. Reflections submitted under a shared visibility setting are visible to the relevant educator or peer group. We may look at shared reflections only where this is necessary to investigate an issue you or your institution reported, to keep the service secure or to ensure and improve its proper functioning; we develop the service further only on anonymised or aggregated data. AI-supported features are described in Section 7: features that act on shared reflections are provided on your institution's instruction (this can include suggestions to your lecturer for feedback and assessment, which your lecturer reviews and decides on) (when your lecturer asks the Teaching Assistant to read an attributed answer, the tool may include your name or label and account ID; anonymous answer reads exclude stable author identifiers. Authorised member searches and student-analysis requests may also include your name, email address and account ID; you are informed of AI processing in the app), while AI processing of your private reflections (for example, Go Deeper, which uses reflection text without your name, email address or account ID) takes place only when you request it for that reflection; the first time, the app tells you clearly that each such request is your consent to that processing. Reflection content itself is never used to train AI models; only anonymous synthetic material may be used for this, as described in Section 7. All AI inference runs on EU-based endpoints.
Sensitive information in reflections: Rflect is a learning tool. It is not a medical, therapeutic or crisis service, and it is not designed to collect information about your health or other particularly sensitive information. Please do not enter such information in your reflections. If such content is entered in a shared reflection nonetheless, your lecturer can report it; we then remove the content from the application, delete any Teaching Assistant conversation of your lecturer that contained it, and inform you so that you can submit the reflection again without it. We do not analyse reflections to detect, score, flag or monitor your health, mental state or wellbeing. If you need support, please use the support services of your institution.
Affiliation: We collect data about your affiliation with institutions through which you use our service (e.g. University, or your employer).
Other data: We also collect data from you in other situations, e.g. in connection with official or court proceedings, for health protection purposes (e.g. pandemic), or photos, videos and audio recordings in which you may be identifiable. The retention period for this data depends on the purpose and is limited to what is necessary.
Note: The applicable scenario (e.g. university license or private use) determines how data is collected and processed across categories, and therefore whether Rflect acts as controller or as processor on your institution's behalf. Individuals enrolled through an organization do not need to provide separate registration data, and data sharing and visibility may differ depending on the license type. Users are informed of the relevant setup during onboarding.
We process your data for purposes related to communication with you, the establishment, administration and fulfilment of contractual relationships, and to maintain relationships. We do not disclose personal data to third parties for their marketing purposes and do not use students' data for marketing. Data will only be used to support communication around personal development, product improvement, and academic research, and always in accordance with user permissions and applicable law.
We continue to process your data for research, to improve our services and operations and for product development; product development takes place on anonymised or aggregated data only. We may also process your data for security purposes and for access control, to comply with laws ("compliance"), and as part of our risk management and prudent corporate governance.
Insofar as we ask for your consent for certain processing, we will inform you separately about the corresponding purposes. You can revoke your consent at any time with effect for the future. Where we do not ask for your consent, we base the processing on the fact that it is necessary for the initiation or execution of a contract, or on a legitimate interest of ourselves or third parties. Our legitimate interests are in particular the secure and reliable operation of our services, the prevention of misuse, the management of our customer relationships, and research and product improvement on anonymised or aggregated data. Where you use Rflect through your institution, the legal basis for the processing of your application data is determined by your institution as controller; the optional AI processing of your private reflections takes place only on the basis of your express consent, which you give each time you request such a feature in the app (Art. 9(2)(a) GDPR / Art. 6(7) FADP); without a request, no such processing takes place. If we receive sensitive data, we may also process it on the basis of other legal grounds, e.g. for the enforcement or defence of legal claims.
We may automatically evaluate technical and usage data to detect misuse and security threats. AI-supported features (Section 7) analyse the text of your reflections to generate feedback or suggestions; this can constitute profiling within the meaning of data protection law. We ensure the proportionality and reliability of the results. If these processes could have legal consequences or significant disadvantages for you, we always provide for a manual review. Our AI-supported features do not take automated decisions with legal or similarly significant effect about you; where they support your lecturer with feedback or assessment, the lecturer reviews the suggestion and takes the decision. They do not profile your reflections for health or wellbeing.
In connection with our contracts, the website, our services and products, our legal obligations or otherwise to safeguard our legitimate interests, we also transfer your personal data to the following categories of recipients:
Service providers: We work with service providers in Switzerland and abroad who process data about you on our behalf. AI-supported features in Rflect are designed with trust in mind. Features that act on reflections submitted under a shared visibility setting are provided on your institution's instruction; AI processing of your private reflections takes place only when you request it in the app. AI inference is provided through Amazon Web Services (AWS Bedrock) on EU-based endpoints, using Anthropic Claude models that run on AWS infrastructure; Anthropic has no access to your data. To reduce latency and cost, a request prompt may be held in an ephemeral, encrypted cache within the EU inference environment for up to one hour and is then automatically deleted; apart from the Teaching Assistant's code sandbox at AWS, which holds working copies of the data it analyses for at most 30 minutes per session, no input or output is retained, and these providers never use your reflection content to train AI models. The AI models are fixed per feature; changes of model are tested before release and published on our Data Protection page at www.rflect.ch/privacy. Our central service providers in the IT area are Amazon Web Services (hosting, database, backups, email delivery, push notifications, speech-to-text for voice memos and AI inference; EU), Sentry (error and diagnostic logging; EU), Pipedrive (customer relationship management for lecturer and institution contacts: name, email address, program and sign-up events; no student reflections; EU - no data from students), Google Workspace (business email and support communication; only data contained in emails or in exports you or your institution request; EU Workspace data region, which covers stored data rather than every processing step), Apple and Google push notification services (the text of your notifications, including your own daily action reminder; USA, under standard contractual clauses) and Slack (our internal operations channel: email delivery alerts, which contain only a count and a message identifier; USA, under the EU-US Data Privacy Framework and standard contractual clauses). For information on the service providers used for the website, see Section 12.
Contractual partners including customers: This refers to customers (e.g. service recipients) and other contractual partners of ours. Where you use Rflect through a licensed institution, that institution is the controller of your application data and we act as its processor; we do not disclose your private reflections to it. Recipients also include contractual partners with whom we cooperate.
Authorities: We may disclose personal data to offices, courts and other authorities in Switzerland and abroad if we are legally obliged or authorised to do so or if this appears necessary to protect our interests.
Research, performance reporting, AI training and service improvement: We may use irreversibly anonymised or aggregated data derived from shared reflections for performance reporting to your institution, for academic research and for improving the Services, as permitted by our Data Processing Agreement with your institution. Unless your institution has excluded its data, this includes creating anonymous, synthetic material from reflections you share with your lecturer or class, which we use for research and to train and test AI models that we control ourselves and run only within Rflect. We never use it to train or adapt models of other AI companies, such as Anthropic or OpenAI. Your institution decides whether its data may be used for this and can exclude it at any time; the data protection information provided by your institution applies in addition. We remove names and other identifiers, replace or generalise any details that could identify you with fictional ones, and check that the material cannot be traced back to you. Your personal data stays in the EU throughout; only material verified as anonymous may be used to train our models on infrastructure outside the EU. If you delete a reflection, it is not used in future generation runs. To compare our own models with the AI models we use today, we may run such anonymous material through those models in the same way as your regular reflections, via our approved service providers (AWS Bedrock in the EU); neither the material nor the results are used to train them. Private reflections and reflections containing health, religious, political or other sensitive information are never used, the material is never passed to other AI companies to train their models, and no reflection text is disclosed to third parties in a form that could identify you. In no case will the data be used for marketing purposes.
We may disclose data to organisations that are not only located in Switzerland; your data may therefore be processed in the EEA and, for the push-notification services of Apple and Google and for our internal Slack workspace described in Section 7, in the United States. We do not currently transfer your data to any other countries; if that changes, we will update this notice and, where required, our sub-processor list. If a recipient is located in a country without adequate statutory data protection, we contractually oblige the recipient to comply with the applicable data protection standards (we use the revised standard contractual clauses of the European Commission with the adaptations for Swiss law recognised by the FDPIC where applicable), unless an exception applies. Where a US recipient is certified under the EU-US and Swiss-US Data Privacy Framework, we may rely on that certification (adequacy decisions of the European Commission of 10 July 2023 and of the Swiss Federal Council in force since 15 September 2024). AI inference for our AI-supported features runs on EU-based endpoints (AWS Bedrock in the EU) and is not transferred to the United States for that purpose. Please note that data exchanged via the Internet is often routed via third countries.
We process your data for as long as necessary to fulfil our processing purposes, to comply with statutory retention periods, to meet our legitimate interests, or if storage is technically required. Further information on the respective periods can be found under the individual data categories in Section 3. Where you use Rflect through a licensed institution, deletion of application data is governed by our Data Processing Agreement with that institution. You can request deletion of your data; where we remove or de-provision an account, we hold deletion of that user's authored data for thirty (30) days so the data can be exported, after which it is deleted. Private reflections are deleted (or, at your option, returned to you and then deleted) and are never handed to the institution. Our backup-restore process re-applies deletions so that data deleted on request is not re-introduced by a restore. Data that you have shared with your institution may be subject to separate retention periods defined by that institution as controller. Feedback generated by AI features is stored with the reflection it belongs to; conversations between a lecturer and the Teaching Assistant are stored in our database in the EU and deleted when the lecturer's account is deleted or on the institution's request.
We take appropriate technical and organisational security measures to protect the confidentiality, integrity and availability of your personal data, safeguarding it against unauthorised or unlawful processing and mitigating the risks of loss, unintentional modification, unwanted disclosure, or unauthorised access. These measures are described in our Technical and Organisational Measures (TOM).
Depending on the applicable data protection law, you have the right to request information about the data we process, to have incorrect data corrected, to request deletion or restriction of processing, to object to processing based on legitimate interests, to obtain your data in a commonly used electronic format or have it transmitted to another controller, to withdraw consent, and to object to automated individual decisions. To exercise these rights, please contact us using the details in Section 2; to prevent misuse we must confirm your identity.
Where Rflect acts as a processor for your institution, we will forward requests that must be handled by the institution as controller, or assist the institution in responding to them. If you are located in the EEA, the United Kingdom or Switzerland, you also have the right to lodge a complaint with the data protection supervisory authority in your country (in Switzerland: the Federal Data Protection and Information Commissioner, FDPIC).
We use necessary cookies and browser storage to provide the website and applications, including sign-in and user preferences. There are no optional-cookie settings in the application. Our first-party operational monitoring uses pseudonymous session and account identifiers to correlate errors, performance and requests; it does not record reflection content or session recordings. Third-party services opened through links, such as Google Docs, have their own Data Protection notices.
We may operate pages and other online presences on social networks and other platforms operated by third parties. We currently operate a LinkedIn page (https://www.linkedin.com/company/rflect-ch); for the data collected to create Page Insights we are joint controllers with LinkedIn Ireland and only receive anonymous, summarised data. For further information on the processing by the platform operators, please refer to the platforms' data protection notices.
This data protection notice is not part of a contract with you. We may amend this data protection notice at any time. The version published on our website is the current version. Users of the application are informed of material changes with an in-app notice at their next login.
Last updated: 20 October 2026