Privacy

1. Scope

This policy applies to the website and protected workspace. Swiss data-protection law applies; EU GDPR requirements are also considered where relevant.

2. Data processed

• Account and profile data such as language, canton and settings.
• Selected documents and information they contain, including names, amounts and deadlines.
• Notes, due-date tasks, checklists, reply drafts, links to cases, and attached photos and PDF files in the protected workspace.
• Technical usage and security data, case and analysis results, and voluntarily archived PDF, JPG or PNG originals in the protected user account.

3. Purpose and operation

Data is used to organise and explain documents, detect deadlines and amounts, prepare drafts, keep notes, tasks, checklists and attachments in your workspace, secure accounts and fix errors. Notes and their attachments remain stored until you delete the note or your account. They are not sent for AI analysis unless you start it separately and explicitly agree to the transfer. Cases, results and archived originals are linked to the signed-in account, synced across devices and served only after server-side ownership checks. Each original is limited to 10 MB and each case to 20 files. A stored original is not sent to AI again unless you explicitly start an analysis. Optional subscription emails are sent through Resend only with your consent. We store your email address, preference, language and the time and version of consent or withdrawal. Change your preference under My plan; it is not used for advertising.

4. Services and international processing

OpenAI services may be used for sign-in and hosting, and for an AI analysis that you start yourself and explicitly authorise. If you start voice input, Swiss-Büro uses your device or browser's speech-recognition service; audio processing follows that provider's settings and privacy terms. Contact requests are processed through Resend for email delivery. Technical providers process only the data needed for their service. Statutory safeguards are used when data is processed outside Switzerland.

5. Retention, security and rights

Cases remain stored until you delete the individual case or your Swiss-Büro account. For originals you can select 30 days, 90 days, one year or storage until manual deletion. After expiry files are no longer accessible and are automatically removed from file storage. Deleting a file, case or account removes the associated originals on every device. Notes and attached files remain in your protected workspace until you delete the note or your account. Other data is retained only as long as required for its purpose, security or legal duties. You may request access, correction, portability or deletion and object to processing. You may also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC).

6. No automated decisions

Swiss-Büro makes no binding tax or legal decisions and sends nothing automatically. AI results are guidance and drafts that you must review.

7. Google Analytics

Swiss-Büro uses Google Analytics 4 provided by Google Ireland Limited only after you consent through the banner. Usage data such as page views and interactions, along with technical browser and device information, may be processed. Your consent choice applies to www.swiss-buero.ch and app.swiss-buero.ch and is stored locally in your browser and can be changed or withdrawn at any time using “Analytics settings”. Page views from protected areas such as the workspace, account, analysis and onboarding are not sent to Analytics. With separate Analytics consent, sign_up (successful registration) and generate_lead (saved contact/project enquiry) are also sent without names, email addresses, enquiry text or private page content. More information about Google's data processing is available at policies.google.com/technologies/partner-sites. You may separately opt into Google Ads purchase measurement. Google advertising click identifiers may also be processed. After successful registration or a saved contact/project enquiry, a pseudonymous event ID is sent. Only after server verification of a live payment, Google receives a pseudonymous transaction ID, the actual amount paid and CHF. Test payments, documents, names and private page content are not sent. No personalised advertising. Withdraw through Analytics settings; existing Analytics consent does not automatically enable Google Ads.