Privacy notice

Controller

Two roles, and why the difference matters

For your account, Bilanzi is the controller: your email address, your sign-ins, your second factor, your language. Bilanzi needs that data to let you in and to keep your account.

For your business’s books, it is not. The receipts, contacts, invoices and entries belong to the business. Bilanzi processes them on its instructions and uses them for nothing else, not for analysis, not for advertising, not for improving a model.

In practice: the operator answers questions about your account. The business answers questions about its own figures; it alone decides roles and who sees which row.

Which data, what for

What Bilanzi does not collect: no advertising identifiers, no profiling, no sale or disclosure to advertisers or data brokers. Visits to the public pages are counted, visits to the workspace are not; how that works is further down.

Where the data sits, and who else touches it

Bilanzi relies on a number of services to run. Every one of them that touches personal data is listed here, with what it is responsible for and the place where it processes.

Bilanzi sends no SMS: the second factor is an authenticator app on your own device. Twilio is used only for WhatsApp.

Cloudflare, Resend, Umami, Google, Apple, Stripe, Twilio, WhatsApp, Slack, the search service and the AI development tool process outside Switzerland. Cloudflare, Resend, Google, Apple, Stripe, Twilio, WhatsApp, Slack, the search service and the development tool also process data in the United States. It is named here because it is a difference you should know about before you rely on it.

Signing in with Google and with Apple

Besides email and password you can sign in with Google or with Apple. It has its own section because in that case another company learns that you have an account at Bilanzi.

Bilanzi receives your email address, the confirmation that it is yours, and the identifier under which Google or Apple keeps your account. Google also sends your name and profile picture where they exist. Apple sends no name. Nothing more is requested: no access to contacts, calendar, files or mail.

Google, or Apple, learns that you signed in to Bilanzi, and when. Neither of them learns what you do inside Bilanzi afterwards.

If you choose Apple’s «Hide My Email», Bilanzi receives a relay address instead of your own. That works, but it leads to an account of its own, which does not coincide with an existing one.

Bilanzi never learns your password, and Google and Apple never learn one. Signing in runs through auth.bilanzi.ch, Bilanzi’s sign-in address at Supabase. The exchange uses a single-use secret that never reaches the browser.

Processing this data rests on the contract for your account. Involving Google or Apple rests on your consent: you choose that way in yourself, every time you sign in. You do not depend on it, because email and password get you to the same place.

Google and Apple are themselves responsible for the sign-in data. For people in Switzerland, according to their own statements, that is Google Ireland Limited and Apple Distribution International Ltd., both in Ireland. Both also process data in the United States.

For the United States, the Swiss Federal Council has recognised an adequate level of data protection only for companies certified under the Swiss-U.S. Data Privacy Framework. How Google and Apple safeguard the transfer is set out in their privacy policies:

• Google: https://policies.google.com/privacy
• Apple: https://www.apple.com/legal/privacy/

The app for iPhone and Android

Bilanzi is also available as an app for iPhone, iPad and Android. It shows the same workspace as bilanzi.ch and talks to the same server. What this page says therefore applies in the app too, and processing rests on the contract for your account in the same way.

On the phone, the app stores nothing from your books. The exception is receipts you photograph without a signal or share with Bilanzi. They stay in the app’s storage, outside any backup at Apple or Google, until the server has accepted them. The app then deletes them.

When you photograph a receipt, the scanner runs on the phone: on the iPhone it is Apple’s VisionKit, on Android Google’s document scanner from Google Play services. The image goes to Bilanzi only. Google’s scanner sends Google information about the device and its use, such as the version and how long a scan takes, but no image. Google is itself responsible for that information.

If you protect the app with your face or fingerprint, the phone does the check. The app only learns whether the check succeeded. The features of your face or finger never leave the phone, and Bilanzi’s server learns nothing about the check.

In the app, signing in with Google or Apple runs through the phone’s browser and then returns to the app. What the section above says about signing in applies.

You can download the app from Apple’s App Store and from Google Play. Apple and Google learn that you downloaded it, under their own terms. The app contains no library for advertising or statistics, and it does not track you across other companies’ apps and websites.

What we ask when you register

After registration, we write to help you get started: shortly afterwards to welcome you, on days one, three and seven about unfinished first steps, and if you work with Bilanzi, after two weeks with a tip and after a month with a review. That is at most six messages in thirty days and at most one per day. Apart from the welcome, we send during Swiss daytime. The messages use your first name if your account knows it, and they count the receipts, invoices and bank statements you have recorded, without amounts or content. If you named a previous program when you registered, we point you to moving in once. Accounts that already existed on 10 November 2026 were added to this series once, at the point that fits them, unless they had unsubscribed from the newsletter. Autopilot messages explain relevant help. The link in each message stops all of these messages, independently of the newsletter. We store registration time, first-step choice, visit days, deliveries and purchases in our database. We measure returns and purchases by source and registration date, without accounting content or third-party tracking. These records are deleted with your account. The purpose is to help you get started and improve our service.

When you register, Bilanzi asks a few optional questions: whether you run your own business, work for a fiduciary or do something else, which software you keep your books in today, and whether there is anything you want to tell us. You can leave every question blank. Registration works either way.

Bilanzi also stores the language you registered in and the source named in the link that brought you here, if it carries one. That is a word inside the link itself, such as the name of a newsletter.

The operator reads these answers to understand where people come from and what they need. They are passed on to nobody and used neither for advertising nor for a profile. They are kept in the database in Zurich.

The answers stay until your account is deleted. If you want them deleted sooner, a message to the operator is enough.

From 15 to 22 September 2026 this website had a form for requesting test access. It is no longer in service. Requests that came in through it stay stored until you ask for them to be deleted: name, email address, company, role, message and language.

When you give feedback

If you explicitly agree to «May we contact you about your feedback?» when closing a company or deleting your account, Bilanzi keeps your email address with your feedback, including after account deletion. It is used only to reply or update you about that feedback. You can withdraw consent at any time by contacting the operator.

In the workspace you can report a fault or suggest something through «Give feedback». Bilanzi stores your text and the kind of feedback. Along with it go the screen and address you were on, the name of the business you had open, your browser, the window size, the language and your email address.

The operator reads every piece of feedback and decides whether it gets built. In public Bilanzi shows only a feedback’s number and area and how many there are, never the text.

The operator hears about every new piece of feedback in an internal channel at Slack, a provider in the United States. What goes there is the number, the kind, the screen and the first 300 characters of the text. Your email address and the business’s name do not.

When the operator accepts feedback, it goes to the AI agents Bilanzi is built with, so that they can put it into practice. They run at a provider in the United States. What they get is the number, the kind, the text, the screen and the date. Your email address and the business’s name stay in Bilanzi.

When your feedback is shipped or answered, you get an email. A personal answer from the operator may also come from the operator’s own mailbox.

Feedback stays stored until you ask for it to be deleted.

News by email

Now and then the operator writes to you about what is new in Bilanzi. The email goes to every account with a confirmed address. It comes from an address at bilanzi.ch, and if you reply, you reach the operator.

For this, Bilanzi uses your email address, the language of your workspace and your first name, if you entered one under My account. If you sign in with Google, Bilanzi takes the first word of the name Google provides, until you enter something else there.

Bilanzi counts whether an email was delivered, bounced or reported as spam, whether you opened it and which links in it you clicked. Opening is shown by an invisible image that your mail app loads from bilanzi.ch. A click goes to bilanzi.ch first and then on. If your mail app does not load images, the opening is not counted.

The operator sees these figures added up per issue, to understand what interests people. They serve no advertising and go to no one else. They are kept in the database in Zurich until you ask for them to be deleted or your account is deleted.

These emails rest on your account with Bilanzi: anyone who uses an offer may be told about similar offers from the same provider, as long as they can refuse at any time (Art. 3 para. 1 let. o UCA).

You can unsubscribe at any time: with the link at the bottom of every email, with the unsubscribe button in your mail app, or under My account. You will still get emails about your account, such as a new password.

Letters to newly registered companies

Every working day Bilanzi reads the new entries in the Swiss Official Gazette of Commerce (SOGC): company name, UID, legal form, seat, address including c/o, purpose and capital. The commercial register is public, and its data may be used (Art. 14 CRO).

Bilanzi writes small businesses a paper letter with an offer. Fixed rules sort out holdings, real estate companies and letterbox companies. The AI at Infomaniak in Switzerland assigns the rest to an industry. The operator releases what goes out, and a lottery decides who gets a letter.

For a sole proprietorship and a general partnership, the company name contains a person’s name. That is why this page says who writes, for what and where the address comes from: Mainbranch GmbH, as advertising for Bilanzi, from the SOGC. The letter says the same in small print.

The letter carries a personal code. Whoever opens it finds their company prepared on bilanzi.ch. Bilanzi counts whether the code was opened and whether an account and a business with the same UID were set up afterwards. Bilanzi counts the same for companies without a letter, to measure the letter’s effect.

No more post: at bilanzi.ch/stopp with the code from the letter, or by email to the address above. The company then goes on a block list and never gets a letter again (Art. 30 para. 2 let. b FADP).

Whatever is sorted out or gets no letter, Bilanzi deletes after 90 days, except the UID and the reason. Companies that were written to stay for 12 months for the evaluation. The block list stays.

Bilanzi writes to fiduciary offices in the same way. Their address comes from the commercial register: from a search in Zefix for words such as “Treuhand” or “Buchhaltung”, or because a new company in the SOGC has its registered address with an office. Which offices get a letter can also come from lists the operator compiles from public directories, but the address always comes from the commercial register. For each letter, Bilanzi counts whether the code was opened, the video watched and an account opened. To receive no more mail, the route is the same as above, and the block list covers both letters. Bilanzi deletes offices that got no letter after 12 months.

The operator keeps every office that was written to as a prospect in the operator’s directory, with the name, UID and address from the commercial register and the wave and code of the letter. If an office opened the code, watched the video or opened an account, someone from Bilanzi may call it once. Whoever wants no more mail gets no call either. The office stays in the directory until it asks for its deletion.

Measuring Google ads

Bilanzi advertises with ads in Google Search and wants to know which of them work. No Google script runs on bilanzi.ch for this, and your browser talks to no Google address.

If you come from a Google ad, the link carries a click ID assigned by Google and details of the campaign. Your browser keeps both locally under «bz_attr», together with the page you landed on, the name of the page before it without its path, and the time. The entry stays there until you sign up and expires after 90 days. Right after the page loads, Bilanzi removes these details from the address bar so they do not end up in a shared link.

When you sign up, these details go to Bilanzi and are stored with your account, in the database in Zurich. The operator reads the campaign details to see which campaign brings sign-ups. This also applies to links with campaign details that do not come from Google, for example from a newsletter.

If your account carries a click ID, Bilanzi tells Google that your click led to a sign-up, a company set up or a subscription. A sentence below the «Create account» button points this out. You can object at any time, as described below.

Google receives the click ID, the time, the kind of event and, for a subscription, the amount of the first payment. No email address, no name and nothing from your books. Google collects these details once a day as a file from bilanzi.ch. Bilanzi does not allow them to be used for personalised advertising.

For people in Switzerland the recipient is Google Ireland Limited in Ireland. Google also processes the details at Google LLC in the United States. For the United States, the Federal Council has found an adequate level of protection for companies certified under the Swiss-U.S. Data Privacy Framework. According to its own statements, Google LLC is.

Bilanzi deletes the click ID 90 days after the click. The campaign details stay with your account until it is deleted.

You can object to this measuring at any time: in the workspace under My account › Privacy, with the box «Don’t use for measuring Google ads», or by email to the address above. After that, Bilanzi reports nothing more about you. What Google has already received stays with Google.

Appointments with Bilanzi

On bilanzi.ch you book an appointment with the operator. For this you give your name, office, email address, a phone number if you wish, a topic and phone or video. This data stays in Bilanzi.

The free times come from the operator’s Google Calendar. Bilanzi reads there only when he is busy, no titles and no content.

Bilanzi enters your appointment in this calendar, without you as a participant and without an invitation from Google. Google receives only the name of your office, the time and a link to the appointment at Bilanzi. If you choose video, Google also creates a Google Meet room.

Google acts as Bilanzi’s processor here. The recipient is Google Ireland Limited in Ireland, and Google also processes data in the United States. According to its own statement, Google LLC is certified under the Swiss-U.S. Data Privacy Framework.

Bilanzi sends you a confirmation by email and reminds you 24 hours and one hour before. You reschedule or cancel with the links in it.

Bilanzi deletes the appointment and its emails 12 months after the appointment. Your office stays as a contact in the operator’s directory until you ask for its deletion.

Applying as a founding firm

Until 30 October 2026, a fiduciary firm could apply to become a founding firm, on bilanzi.ch, through the letter or in the workspace. For this, Bilanzi stored the firm, town, name, email address, a phone number if you wanted, and the answers to three questions. If the application came through the letter, its code is stored with it.

Bilanzi needed these details to decide on the application and to reply to the firm. For this, the firm went into the operator’s directory as a prospect, and he got a notice.

A founding firm saw the ideas of all founding firms, each with the name of the firm that wrote it. A firm appeared under “The founding firms” only if it had agreed to.

The programme has ended. Bilanzi no longer takes applications and no longer shows ideas or a list of the founding firms. An application still without a decision is declined, and every place as a founding firm has ended.

Bilanzi deletes a declined application twelve months after the decision. When a founding firm’s place ends, Bilanzi deletes the name, email address and phone number from the application after twelve months. The firm’s name and town, its number and its ideas stay in the history of the founding firms. The firm stays as a contact in the operator’s directory until it asks for its deletion.

Paying with Stripe

You pay for paid plans and letter credit through Stripe Payments Europe Ltd. in Dublin, Ireland. To pay and to change your payment method, Bilanzi sends you to pages run by Stripe. That is where you give your card or TWINT. No Stripe script runs on bilanzi.ch.

You choose, change and cancel your plan in Bilanzi. Only the people who administer the organisation can do that, and only they see the payments. Bilanzi charges the renewal automatically to the saved payment method. Since 14 October 2026 an AI balance can no longer be topped up, neither by hand nor automatically. On request, the operator refunds what is left through Stripe. If the plan runs yearly or no payment method is saved, an email arrives a week before.

When you buy a plan, Bilanzi gives Stripe the organisation’s name, the email address of the person buying, the language, the amount and internal numbers for the organisation, the payment and the plan. When you top up letter credit, Stripe receives only the amount, the language and internal numbers for the organisation and the payment. On Stripe’s pages your payment details are added. When you buy a plan, Stripe also asks for the billing address and, if you want to give it, your UID or VAT number. Stripe sends the receipt by email.

Bilanzi keeps Stripe’s messages about every payment in full. They include the customer number, the amount, the state of the payment, the brand, last four digits and expiry date of the card or TWINT, and the link to the receipt. Bilanzi never sees a full card number.

Processing rests on the purchase contract. For part of the data Stripe is responsible itself, for example for fraud prevention and its own legal duties. Stripe also processes data in the United States. How it safeguards that is set out in its privacy policy: https://stripe.com/privacy

Payments and receipts belong to the operator’s own books and are kept for ten years (CO Art. 958f para. 1).

When a model reads a receipt

Bilanzi can have a receipt read by a language model and turn it into a proposed entry. This exists in the paid plans such as Autopilot, included in the price of the plan. On Free, the owner of a business can try the AI once on a few pages of receipts.

In the paid plans, a receipt you upload to the «Receipt inbox» or file with «Scan a receipt» goes to the model straight away. Receipts that arrive by email or WhatsApp are read as soon as automatic reading is switched on in the «Receipt inbox». It is on when you buy Autopilot, and you can switch it off at any time. Whatever waits during a pause of the AI is read on the first day of the following month. On Free, a receipt only goes out with the trial button. Payslips never go out.

Along with the receipt go your business’s name, the currency, today’s date, whether the business is registered for VAT, the file name and the chart of accounts. The model needs these to propose an entry.

The same model answers the questions you ask Bilanzi about your books. The question then goes out with an extract from the books, limited to what you are allowed to see yourself. The extract can contain the names of customers, suppliers and bank counterparties, payment references, figures from the income statement and the total of the latest payroll run. Items and prices from your catalogue are added. If the question is about a particular customer, their contact persons with role, email and phone also go out, along with their latest notes and activities, open next steps, quotes and jobs.

The same model suggests accounts for bank lines, reviews entries before a closing and writes texts for quotes and payment reminders, each time only when you start it. For the bank, the open lines go out with counterparty and payment reference, along with the chart of accounts and the assignments you made before. For the review, individual entries go out with text, amount, account and VAT code. For a text, the customer’s name goes out with the quote’s line items or the invoice’s open amount.

If a bank line contains a web address, Bilanzi’s server opens the home page of that address and gives the model its title and description. Only the address itself goes out, nothing from your books.

If a bank line names a company Bilanzi does not know yet, Bilanzi’s server first asks an AI search service in the United States what that company does. The service searches the web for it. Only the company’s name goes out, never a person’s name, no amount and nothing from your books. The answer goes with the line to the model at Infomaniak, and the suggestion names its source at the end.

With Autopilot for payroll you can tell Bilanzi Lohn in one sentence what has happened, for example that someone is leaving or changing their level of employment. This is only possible if the owner has switched on Autopilot for payroll, and only for people who may write in payroll. Your sentence and the first and last names of the business’s employees then go to the same model. Whatever you write in the sentence goes with it, including an absence, a level of employment or a wage. The AHV number, date of birth, address, bank details and the wage from the master data are not sent. The model proposes who and what it is about, and only when you confirm the proposal does it become a report in Bilanzi Lohn. Bilanzi stores neither the sentence nor the model’s answer. All that is recorded is that a question was asked, who asked it and what it cost, and in the audit trail, which case you confirmed for which employment.

If, with Autopilot for payroll, you catch up on months that your previous software has already paid, you can upload the old payslips, as PDFs or photos. This, too, is only possible if the owner has switched on Autopilot for payroll, and only for people who may write in payroll. Each uploaded file then goes to the same model in full, with everything that is on it. On a payslip that is usually the person’s name, address, AHV number, wage, deductions and bank details. None of it can be left out, because the model reads the pages as images. Nothing else from Bilanzi Lohn goes with it, not even a list of employees. For each payslip the model reads the name, the month, the net wage and the payment day, and Bilanzi itself matches the name to an employment. Bilanzi does not keep the file and stores neither its name nor the model’s answer. What was read exists only in your browser and prefills the catch-up until you check and confirm the month. What is stored then is the same as when you catch up by hand, namely the payment day and whether the net wage matches, not the amount that was read. Also recorded are the fact that a file was read, who started it and what it cost, and in the audit trail, for which employment and which month.

The provider is Infomaniak Network SA in Geneva, and the processing takes place in Switzerland. In the workspace Bilanzi names the provider and the place of processing on the screen where the work happens. Only what is expressly released on a recorded, evidenced and approved route goes out; otherwise the database refuses the call. Not the screen, the database.

By its own account, Infomaniak does not store the requests and does not use them to train models. The contract terms the operator agreed with Infomaniak apply.

For every use of the AI, Bilanzi records when it happened, for what, what it cost and who started it. From this, Bilanzi bills any remaining AI balance and sees how much the AI reads for a business in a month. The result is stored with this record, such as the proposed entry, the answer or the suggested text. That way a repeated request does not cost twice, and it stays clear what the AI did. The question and the receipt are not part of that record. For the trial on Free, Bilanzi records who started it and how many pages have been read.

If the AI reads far more than usual for a business in a month, the operator is told and can get in touch with you. The operator sees the business and the cost, but no content.

Bilanzi pays for a question without books itself, for example on Free or from a WhatsApp number without an account. Here too it records only when, through which channel, for what reason and what it cost, and with an account, who asked.

The proposal stays a proposal. Nothing is posted until a person accepts it, and the acceptance is recorded in the audit trail.

When you write to Bilanzi on WhatsApp

In the paid plans you can send receipts to Bilanzi by WhatsApp and post them with one button. You connect WhatsApp yourself under My account and give your express consent when you do. Bilanzi records when that was and which text you agreed to.

Bilanzi only sends you reminders if you switch them on for WhatsApp under My account, each kind on its own. A reminder names the business and a count, an amount or a deadline from your books. You can switch them off there at any time.

Bilanzi receives your phone number, the messages, photos and PDFs you send, and the buttons you press. A photo or PDF becomes a receipt of your business, just like an uploaded file. The model described above reads it if automatic reading is switched on. The same model answers a question from the books you may read yourself, as in the “Ask Bilanzi” field. Its replies therefore name amounts, accounts and names from your books. If you work at a fiduciary, a text without “Bilanzi:” in front goes to the operator and not to the model, as the next section describes.

Infomaniak transcribes a voice message in Switzerland, on an approved route of its own. Bilanzi fetches the sound from Twilio, sends it to Infomaniak and then deletes it at Twilio. Bilanzi does not store the sound. The text takes the path of a typed question and appears above the reply. Only the time, the size of the file and the length of the text are recorded.

If someone writes from a number that is not connected to any account, the text goes to the operator as a request, as the next section describes. If the question starts with “Bilanzi:”, Bilanzi answers it from its own pages and help, without any books. For that, the text of the question goes to the model described above. Of such a question Bilanzi keeps only a hash of the number and of the message, for one day, against repetition and abuse. Bilanzi deletes the message at Twilio.

The messages travel through WhatsApp, a Meta service, and through Twilio Inc., which runs Bilanzi’s connection to WhatsApp. Between your phone and Meta a message is encrypted. At Meta and at Twilio it is decrypted so that Bilanzi can read it and reply. Both also process the messages in the United States.

For the United States, the Federal Council has found an adequate level of protection for companies certified under the Swiss-U.S. Data Privacy Framework. According to their own statements, Twilio Inc. and Meta Platforms, Inc. are.

At Twilio, Bilanzi deletes every photo as soon as it is filed as a receipt, and every message as soon as it is processed or delivered. In Bilanzi the text of a message stays only until it is processed or sent, except in a request to the operator. What Meta and Twilio keep beyond that depends on their own terms.

Your number, and the time, type and status of every message, stay with Bilanzi, even after you disconnect. That way it can be traced what was posted by WhatsApp. If you want any of it deleted, a message to the operator is enough. Receipts stay for as long as the retention duty runs.

The processing rests on your consent. You withdraw it with «Disconnect» in Bilanzi or by writing STOP in the chat. After that, Bilanzi processes no further message from your number.

For WhatsApp itself, WhatsApp’s terms and privacy policy apply. How Twilio and WhatsApp process data is set out in their privacy policies:

• Twilio: https://www.twilio.com/en-us/legal/privacy
• WhatsApp: https://www.whatsapp.com/legal/privacy-policy

Requests to the operator

At [email protected] and on Bilanzi’s WhatsApp number you reach the operator directly. By WhatsApp this applies if you work at a fiduciary and have connected your number, and to numbers without an account. If your text starts with “Bilanzi:”, Bilanzi answers itself, as the section on WhatsApp describes.

Bilanzi files every message as a request and reports it to the operator at once, by WhatsApp through Twilio and Meta. The report names your firm, your name, your address or part of your number, and an excerpt of your text. If WhatsApp does not reach the operator, the report goes by email through Resend to the platform’s administrators.

An email to [email protected] arrives at Cloudflare Email Routing, which forwards it to Resend, which receives it for Bilanzi. Bilanzi stores the sender, the name, the subject and the text.

You get a confirmation with the deadline. The operator’s answer comes back the same way, by WhatsApp or by email through Resend. You do not see his own number.

For every request Bilanzi records when it arrived, when the first answer came and when it was solved. That is how the operator checks his promise on response times.

Bilanzi deletes the text, name, address, number and subject of a request and its answers 12 months after it arrived. The times then stay without any link to a person, for the monthly figures. Bilanzi deletes the list of emails to [email protected] after 30 days. At Twilio, Bilanzi deletes every message as soon as it is in the request or delivered.

How visits are counted

On the public pages Bilanzi counts which page was opened. Nothing is counted in the workspace: a path there can carry the id of a receipt or an invoice, and such a path belongs in no statistic.

Counting works without a cookie and without an identifier left behind in your browser. That is why no consent banner appears on these pages.

Your browser talks to no foreign address for it. The counting script is served by bilanzi.ch, and this server takes the measurement and passes it on to Umami. What travels with it:

• the page you opened and the page you came from
• language, screen size, browser and operating system
• your IP address, so that Umami can tell one visit from the next; Bilanzi does not store it

Anyone whose browser is set to Do Not Track is not counted. The browser still loads the counting script, and while it does, bilanzi.ch passes your IP address and your browser’s identification on to Umami.

Nothing from your books is ever part of a measurement: no amount, no name, no receipt.

Cookies and what stays in the browser

Bilanzi sets neither an advertising cookie nor a counting cookie: the counting described above does without one, and the workspace is not counted at all. That is why no consent banner appears: the four cookies below are needed for a sign-in, and a necessary cookie is not something you are asked to accept.

These four cookies are needed for a sign-in to work at all:

Your browser also keeps a few things locally: which way you signed in last time, which business and which screen you had open last, which notices you dismissed and which changelog entries you have already seen. None of that ever reaches Bilanzi.

Until you register it remembers the plan you chose, and until you accept it, an invitation. Both reach Bilanzi when you register or accept.

While a tab is open it holds actions whose outcome is still open and Bilanzi’s answers to your questions. Both disappear with the tab.

Whether a help panel is open or closed is stored by Bilanzi with your account, so that it stays the way you left it on every device. The browser keeps a copy.

If you came from an ad or a link with campaign details, your browser keeps them under «bz_attr» until you sign up, for at most 90 days. They reach Bilanzi only when you sign up. More in the section on measuring Google ads.

How long things stay

Bookkeeping data is subject to a statutory retention duty: the books, the vouchers and business correspondence for ten years (CO Art. 958f para. 1), papers connected with immovable property for twenty years (VAT Act Art. 70 para. 3).

Bilanzi treats that as a rule rather than a hint: inside the period the database refuses to destroy a receipt attached to an entry or an expense claim. An entry is never overwritten; a correction is a visible, linked reversal.

You can delete your account yourself at any time, in the workspace in the danger zone under Account. Your business’s books are untouched by that while the period runs. That is not Bilanzi’s decision but the business’s duty.

With the account, Bilanzi deletes your sign-in address, your password, your settings, what you told us when you signed up, your feedback and any WhatsApp connection, number included. In the books, the audit trail and the records of AI use you then appear without a name or an address.

For anything outside the retention duty there is no automatic deletion today, except for the letters to companies and fiduciaries, the appointments with Bilanzi, the applications as a founding firm and the requests to the operator: invitations, feedback and the records of AI use stay stored. If you want any of it deleted, a message to the operator is enough. Bilanzi does not store the text of the emails it sends, except the answers to a request to the operator.

Partners, shareholders, management, board of directors and signatories stay stored as history, also after a role ends, for as long as the business keeps its books in Bilanzi. In the audit trail their roles appear without a name or an address. If the business removes an entry made by mistake, Bilanzi deletes it, with the last role the person and with the last role holding shares their address.

What is enforced to protect this data

The following points are enforced in code and covered by automated tests; they are not statements of intent:

• The separation between businesses lives in the database and is checked on every single query, not in the application in front of it.
• Your access credential never reaches the browser in readable form: it sits in a cookie no script can get at.
• The second factor is optional and belongs to signing in: whoever sets up an authenticator app confirms once after the password. What a person may then do is decided by their role.
• The audit trail records entries, receipts, the chart of accounts, bank accounts, period locks and permissions in a chain: each record points to the one before. A change made in Bilanzi appears there, and “Verify the chain” shows whether every record still fits its predecessor. Downloads of books and receipts and access through reviewer links are recorded with time, document and account or named reviewing body. Logs are retained at least as long as the corresponding books. Not every screen view is recorded.
• Transport is encrypted throughout, and the browser talks only to bilanzi.ch. Cloudflare receives that connection and passes it on to Bilanzi. No connection leaves your session for another service, except a redirect you start yourself, such as signing in with Google or Apple or paying at Stripe.
• If Bilanzi itself accesses a business’s books, at its request or to fix a fault, this goes into a log that the owner and administration see in the settings. The business grants support access for a limited time and withdraws it at any time.

Your rights

You may ask which data about you is processed, require the correction of wrong details, request your data in a common format, and object to processing where it does not rest on a statutory duty.

For your account, turn to the operator named above. For a business’s books, turn to that business; Bilanzi acts there on its instruction and passes on a request that reaches it.

Handing the data over is not a favour but a function: under «Take the books out» the workspace hands over a business’s books as a file, with nobody to ask.

The route to the Federal Data Protection and Information Commissioner is open to you as well.

Changes

This notice is updated when the processing changes, for example when a service is connected or replaced. The date above names the state, and material changes are communicated to the businesses that have signed up.