Privacy policy

This website is a static website. It contains no contact form, sets no cookies, embeds no third-party analytics or advertising services (page views are counted by my own server, section "Visitor statistics") and loads no content from third-party servers. The fonts used are served by this website itself and not loaded from a third party. The only exception is the chat window at the bottom right: it transmits data only once you open it and send a message or start a voice conversation (section "Chat window"). The WhatsApp link on this website opens WhatsApp on your device; what happens to your data there is described in the section "WhatsApp". If you call the number given there, the section "Phone calls" applies.

Controller

Strainovic IT, Goran Strainovic, Bahnstrasse 9b, 9323 Steinach, Switzerland.
Email: info@strainovic-it.ch

The Swiss Federal Act on Data Protection applies. Where the General Data Protection Regulation of the European Union is applicable, it applies in addition.

Server logs

The website is delivered via Netlify. When a page is requested, technical connection data is generated that is needed for delivery and for defending against attacks:

shortened or full IP address
date and time of the request
requested address and amount of data transferred
browser identification and operating system
referring page, if the browser sends it

This data is not combined with other sources and not analysed to recognise individual persons. The legal basis is the legitimate interest in the secure and uninterrupted operation of the website.

Netlify is based in the United States and delivers the site through a worldwide network. Netlify processes the connection data as a processor on my behalf.

Visitor statistics

So that I can see which pages are read and where visitors come from, Netlify reports every page view to my own server at Infomaniak in Switzerland. This also applies to kmu-plugins.ch, ki-flows.ch and cv.strainovic-it.ch. The following is stored:

the website and the page requested
the domain of the referring page (such as google.com), without the rest of the address
the country that Netlify derives from the IP address
date and time
an identifier that stays the same only on the same day and on the same website; it is calculated from the IP address and browser identification together with a random value that changes daily and is not stored anywhere

The IP address and browser identification themselves are not stored. The IP address cannot be recovered from the identifier, and it cannot be used to follow a visitor across several days. No cookies are set and no third-party analytics services are embedded. The entries are deleted after 14 months. The legal basis is the legitimate interest in improving the website.

Contact by email

If you write to me, I process your message and the sender address to answer the enquiry and to handle any business relationship that may follow. I do not pass this information on to third parties unless this is necessary for processing or required by law.

Retention

I keep enquiries for as long as needed to handle them and to meet statutory retention obligations. After that they are deleted. Server logs are kept briefly and overwritten continuously.

bexio Sync

The service “bexio Sync by Strainovic IT” connects HubSpot with bexio. I process the data from HubSpot and bexio only on behalf of the customer, in order to provide the agreed service (processing on behalf of a controller under Art. 9 of the Swiss Federal Act on Data Protection). The customer is the controller of this data. HubSpot and bexio are the customer’s systems; data protection there is governed by the customer’s contracts with these providers.

Stored are the access tokens for HubSpot and bexio, the number of the HubSpot portal and of the bexio company, the settings, the mapping of deals, companies and contacts in HubSpot to documents and contacts in bexio (numbers only), and a log of transfers with deal number, result, document number, amount and, in case of an error, the error message. If contact sync is enabled, I store per field a fingerprint of the last synced content, a non-reversible check value, not the content itself. The contents of deals and contacts (names, addresses, email, phone, line items) are read for the transfer and not stored permanently.

Access to bexio goes through my intermediary service connect.strainovic-it.ch on the same server. The data is stored at Infomaniak in Switzerland and backed up daily; backups are deleted after 30 days. The service’s server logs contain the method, the path without parameters and the status of requests as well as, per transfer, the portal, deal and result, never tokens, codes or signatures.

After the contract ends, I delete the customer’s data within 30 days. The customer can disconnect at any time (uninstall the app in HubSpot, remove the connection in bexio).

Licence and invoices are handled by connect.strainovic-it.ch. Which data is stored for this and when it is deleted is described in the section “UID check, form enquiries, bexio Sync and shop connectors”.

QR-bill for HubSpot

The app “QR-bill for HubSpot” by Strainovic IT adds a Swiss QR code with payment part to invoices in HubSpot and records incoming payments from the bank’s credit notification (camt.054) as a payment on the invoice. I process the data from HubSpot and from uploaded files only on behalf of the customer, in order to provide the agreed service (processing on behalf of a controller under Art. 9 of the Swiss Federal Act on Data Protection). The customer is the controller of this data. HubSpot is the customer’s system; data protection there is governed by the customer’s contract with HubSpot.

For every open invoice in CHF, the app reads the number, amount, currency, language and comment as well as the name and address of the company or person that owes payment. From this it creates the QR code and the payment part as a PDF. It uploads both to the file manager of the customer’s HubSpot portal and links to them in the invoice comment; they never leave the portal. Per invoice I keep only the number, reference, amount, currency and the result of processing, not the name or address of the payer.

Uploaded camt.054 files are read during matching and not stored. For every recorded payment I keep the bank’s booking number together with the number of the invoice and of the payment in HubSpot, so that nothing is recorded twice. The payment in HubSpot receives the amount, date, reference, booking number and the payer’s name from the file.

I also store the access token for HubSpot, the portal number, the payee details (name, address, IBAN), the language, the customer’s billing address and email address for the subscription, the subscription invoices (number, amount, due date, payment date), and a log with portal, invoice number and result. The subscription invoice is sent to the email address given.

The data is stored at Infomaniak in Switzerland and backed up daily; backups are deleted after 30 days at the latest. The setup page sets no cookies; access is by signed link. The service’s server logs contain the method, path and status of requests as well as, per invoice, the portal, number and result, never tokens, codes or signatures.

I do not pass data on to third parties; data goes only to HubSpot, into the customer’s portal. If a partner referred the customer, the partner receives the company name and the amount paid, for the settlement of the partner’s share.

After the contract ends, I delete the customer’s data within 30 days. Subscription invoices with the billing address are the exception: I keep them for ten years as accounting records (Art. 958f of the Swiss Code of Obligations). QR codes, payment parts and payments that the app created in the HubSpot portal remain there; the customer controls them. The customer can uninstall the app in HubSpot at any time; this ends access to the portal.

UID check, form enquiries, bexio Sync and shop connectors

For the WordPress plugins “UID Check for bexio” and “Form Inquiries for bexio”, the “bexio Sync” service (bexio ↔ HubSpot), the KLARA shop connector (WooCommerce and Shopware) and the AbaNinja shop connector, licence and invoices are handled by my intermediary service connect.strainovic-it.ch. The bexio plugins and bexio Sync connect to bexio through it; the trial lasts 30 days per bexio company or shop and per product.

Stored per installation are the address of the website or shop, the administrator’s email address, the product and the language, and for the bexio plugins and bexio Sync also the number and name of the bexio company. Per company or shop and per product, the trial start, trial end and “paid until” date are added, as well as the billing address with the email address for invoices and the annual invoices with number, reference, amount, due date and payment date. The access tokens for bexio are held only briefly in memory until the plugin or bexio Sync collects them, never in this service’s database. The plugins write contacts and notes directly to bexio; data from orders and forms does not pass through the service.

For the bexio plugins and bexio Sync, the service suggests the billing address from the company profile in bexio on the first connection; the customer checks and confirms it in the form. For the shop connectors, the customer enters it via a personal link. I match incoming payments by the reference in the bank’s credit notification (camt.054) or record them by hand.

The data is stored at Infomaniak in Switzerland and backed up daily; backups are deleted after 30 days at the latest. The service’s server logs contain the method, the path without parameters and the status of requests, never tokens, codes or signatures. I do not pass data on to third parties.

If the contract ends because no payment is received or invoicing is stopped, the service deletes the billing address and the administrator’s email address within 30 days. The trial start and payment status remain, so that a reinstallation does not start a new free trial. I keep the annual invoices for ten years as accounting records (Art. 958f of the Swiss Code of Obligations).

Chat window

At the bottom right of every page, a button opens a chat window. An AI assistant answers questions about the plugins and services there. The window only transmits data once you open it and send a message or start a voice conversation.

The following is processed: your messages, voice recordings, attached images and PDFs, your IP address and a random session identifier. Your browser keeps the session identifier in this website’s site data, not in a cookie; you delete it by clearing this website’s site data in your browser.

The purpose is to answer your questions. If you give your email address or phone number in the chat, I will contact you personally about your request; providing it is voluntary. The IP address is used only to protect against misuse.

Requests go to my server at Infomaniak in Switzerland. The answers are generated by Mistral AI SAS in France (EU), which also reads attached PDFs and converts voice recordings to text; for this, Mistral receives the content of your messages and attachments. Mistral does not use your data to train its models. I delete the conversation history from my server at Infomaniak in Switzerland 30 days after the last message; attached images, PDFs and voice recordings with their transcript 30 days after receipt. This lets me check requests, find errors of the speech recognition and improve it.

I also receive the conversations by email at info@strainovic-it.ch (mailbox at Infomaniak in Switzerland): immediately if you give an email address or phone number, otherwise in a daily summary. This is how I answer requests and improve the assistant. I keep these emails as long as needed to handle your request; if it leads to a quote or an order, the statutory retention obligations apply.

The handset button in the header of the chat window also lets you talk to the assistant. The conversation only starts once you press the button and allow your browser to use the microphone; at the start, the assistant tells you that it is an AI and that the conversation is recorded. Your voice goes directly from your browser to my server at Infomaniak in Switzerland. Mistral AI SAS in France (EU) converts it to text and generates the answer, as in the chat. The text of the assistant’s answer, not your voice, is sent to ElevenLabs, Inc. in the United States, which produces the spoken answer from it; ElevenLabs is certified under the Swiss-U.S. Data Privacy Framework.

I record the conversation, your voice and the assistant’s, and delete the recording and transcript from my server at Infomaniak in Switzerland 30 days after the conversation. This lets me check requests, find errors of the speech recognition and improve it. In addition, the total conversation time per day is stored, linked to a check value of your IP address, to protect against misuse; I delete this entry the following day. I receive the summary and transcript of the conversation by email like the other conversations (previous paragraph).

The answers may contain errors; only quotes sent by email to info@strainovic-it.ch are binding.

Do not enter confidential data in the chat window, such as passwords, login details or information about third parties; for such matters, write to me by email.

You can reach me on WhatsApp at +41 71 539 30 77. The same AI assistant as in the chat window answers there; it tells you so in its first reply. The assistant never writes to you first; I reply to you personally if you wish.

The following is processed: your text messages, voice messages, PDFs, images and other files as well as your WhatsApp number. The assistant does not evaluate images or other files; it only replies to them with a notice. I do not use your WhatsApp profile name.

The purpose is to answer your questions. If you give your email address or a phone number, I will contact you personally about your request; providing it is voluntary. I count the number of your messages per day to protect against misuse; I delete this counter the following day.

Your messages pass through WhatsApp. The provider for Switzerland and the European Economic Area is WhatsApp Ireland Limited, Dublin, Ireland, a Meta company. WhatsApp processes the messages on my behalf and in doing so also transfers data to Meta Platforms, Inc. in the United States, based on the Data Privacy Framework and the EU standard contractual clauses. How WhatsApp processes your data as a controller in its own right is described in the WhatsApp privacy policy.

From WhatsApp, your messages reach my server at Infomaniak in Switzerland. The answers are generated by Mistral AI SAS in France (EU), which also reads PDFs and converts voice messages to text; for this, Mistral receives the content of your messages, voice messages and PDFs. Mistral does not use your data to train its models. I delete the conversation history from my server at Infomaniak in Switzerland 30 days after the last message; voice messages with their transcript, PDFs, images and other files 30 days after receipt. This lets me check requests, find errors of the speech recognition and improve it.

I receive the conversations, including your WhatsApp number, by email at info@strainovic-it.ch (mailbox at Infomaniak in Switzerland): immediately if you give an email address or phone number, otherwise in a daily summary. This is how I answer requests and improve the assistant. I keep these emails as long as needed to handle your request; if it leads to a quote or an order, the statutory retention obligations apply.

On WhatsApp too, the answers may contain errors; only quotes sent by email to info@strainovic-it.ch are binding.

Do not send confidential data via WhatsApp, such as passwords, login details or information about third parties; for such matters, write to me by email.

Phone calls

If you call +41 71 539 30 77, the same AI assistant as in the chat window and on WhatsApp answers. At the start, it tells you that it is an AI and that the conversation is recorded. The assistant never calls anyone itself.

The following is processed: your phone number and the conversation. The purpose is to answer your request; if you would like a call back, I will contact you personally.

The call is carried by Twilio Inc. in the United States, the telephone provider of the number; Twilio receives your phone number and the audio of the conversation and is certified under the Swiss-U.S. Data Privacy Framework. From Twilio, the audio goes to my server at Infomaniak in Switzerland. Speech recognition, the answer and the spoken answer work as for the voice conversation in the chat window (Mistral AI SAS in France and ElevenLabs, Inc. in the United States, which receives only the text of the answer; section "Chat window").

I record the call, your voice and the assistant’s, and delete the recording and transcript from my server at Infomaniak in Switzerland 30 days after the conversation. This lets me check requests, find errors of the speech recognition and improve it. In addition, the total call time per day is stored, linked to a check value of your phone number, to protect against misuse; I delete this entry the following day. After the call, I receive your phone number, a summary and the transcript by email at info@strainovic-it.ch; these emails are kept as described in the section "Chat window".

Your rights

You have the right to information about the data processed about you and to its correction or deletion. Where the General Data Protection Regulation applies, the rights to restriction of processing, to object and to data portability are added. Please contact the address given above.

The supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner, edoeb.admin.ch.

Changes

This policy may be adapted if the website or the legal requirements change. The version published here applies.

Translation of the German version; in case of discrepancies, the German version prevails.