1. Parties and subject
This agreement applies between you as a business client of Klyrenta (controller) and the operator of Klyrenta named in the legal notice (processor). It covers the personal data in the documents that you upload, or that your clients upload through a private upload link of the receipt inbox, for example names, addresses, bank details and amounts of suppliers, customers and employees.
2. Purpose and instructions
We process these data only to provide the service you use: to read the documents, check them, show you the results and keep them for download. Your use of the service and your settings are your instructions. We do not use the data for our own purposes, do not sell them and do not use them to train AI models. If we consider that an instruction breaches data protection law, we tell you.
3. Confidentiality
We treat the data as confidential. Only the operator of Klyrenta has access to them, and only as far as needed to run the service, answer your questions or fix a fault. Anyone we involve is bound to the same confidentiality. We are aware that fiduciaries and other clients may be bound by professional secrecy towards their own clients; we treat the data accordingly.
4. Data security
We take technical and organisational measures appropriate to the risk (Art. 8 FADP), in particular:
- Website and data on servers in Switzerland (hosting by Infomaniak Network SA); all connections encrypted (HTTPS).
- Access to the client area only through a one-time sign-in link sent to your email address; upload links of the receipt inbox are long and random and can be renewed or switched off at any time.
- Uploaded files are deleted 90 days after processing; the website loads no scripts or content from other providers and uses no tracking.
- Limits on attempts and uploads protect against misuse.
5. Subprocessors
You authorise us to use the following subprocessors. Contracts bind them to protect and secure the data:
- Infomaniak Network SA, Switzerland: hosting the website and storing the data.
- Anthropic Ireland, Limited, Ireland, with processing by Anthropic PBC in the USA: reading the content of uploaded documents. Anthropic may not use it to train its models; according to Anthropic, inputs and outputs are deleted within 30 days, unless they must be kept longer by law or to enforce its usage policy.
Not subprocessors: Stripe, which processes payments as its own controller and never receives your documents, and the Federal Statistical Office (FSO), which receives only the public VAT numbers of suppliers to look them up in the UID register.
Before we add or replace a subprocessor, we tell you by email at least 30 days in advance. You can object; if we find no solution, you can end the contract as of the change.
6. Transfers abroad
According to the Federal Council, Ireland provides adequate data protection. For the processing in the USA, Anthropic’s data processing addendum contains the European Commission’s standard contractual clauses with the amendments for Switzerland, which the Federal Data Protection and Information Commissioner (FDPIC) recognises (Art. 16 para. 2 let. d FADP).
7. Support
We help you, as far as we can, to answer requests from data subjects (for example for access or deletion) and to meet your other obligations under the FADP. Requests that reach us directly are passed on to you.
8. Data security breaches
If we become aware of a breach of data security that affects your data, we tell you without delay, and at the latest within 48 hours, with the information we have, so that you can assess whether you must report it to the FDPIC (Art. 24 FADP).
9. Duration and deletion
This agreement applies as long as we process data for you. Uploaded files are deleted 90 days after processing. If you ask us to close your account or to delete your data, we delete your documents and results within 30 days; download what you want to keep before. An account without any activity for 24 months is deleted with its documents and results, unless a monthly plan is still running or paid credit is still unused. We tell you by email 30 days before; signing in keeps the account. Copies in backups are overwritten after 35 days at the most. Data that we must keep by law (for example payment records) are kept only for that purpose.
10. Information and checks
On request we give you the information you need to check that we comply with this agreement. Further checks, for example by an auditor bound to confidentiality, are possible by agreement and at your expense.
11. Final provisions
This agreement is part of the general terms and conditions. Where it says more about data protection, it prevails. Swiss law applies; the place of jurisdiction is that of the general terms and conditions.