Privacy Policy

1. Controller

Responsible person / controller

Alex Földvári (Solory)

Address

Wartauweg 19, 8049 Zürich, Switzerland

Email

support@solory.ch

The person named above decides why and how personal data is processed for the purposes described in this policy, and is your point of contact for any data-protection question or request.

2. Our two roles

We process personal data in two distinct roles. First, we are the controller of the personal data of our own account holders (for example your name, email, login and billing details) and of visitors to our website. This policy covers that processing.

Second, when you use the Service to manage information about your own clients, contacts, leads and correspondents, you are the controller of that data and we act only as your processor (Auftragsbearbeiter), on your instructions. That relationship is governed by our Data Processing Agreement, not by this policy. You are responsible for informing your own clients about your use of the Service and for having a lawful basis to process their data.

3. Categories of personal data we process

• Account data: your name, email address, password (stored only as a secure hash), language and interface preferences, and any team or collaborator relationships.
• Content data: the business information you enter or upload, such as clients, leads, projects, quotes, invoices, expenses, payments, contracts, documents, calendar entries and email you send or receive through the Service. This may contain personal data about third parties, for which you are the controller (see section 2).
• Billing data: your chosen plan, subscription status and payment records. We do not store full card numbers.
• Usage and technical data: log data such as IP address, device and browser information, timestamps, and security and audit events generated when you use the Service.
• Support and communications data: the content of messages you send us and our replies.

4. Purposes and legal bases

We process personal data for the following purposes. Under the GDPR, where it applies, the corresponding legal bases are shown in brackets.

• To provide, operate and maintain your account and the Service, including its core features (performance of a contract, Art. 6(1)(b) GDPR).
• To handle billing, subscriptions and the Free/Pro plans (performance of a contract, Art. 6(1)(b) GDPR).
• To keep the Service secure, prevent abuse and fraud, and maintain audit logs (legitimate interests, Art. 6(1)(f) GDPR; under the revDSG, our overriding interest in a secure service).
• To provide support and respond to your requests (performance of a contract and legitimate interests, Art. 6(1)(b) and (f) GDPR).
• To improve and develop the Service, using data in an aggregated or minimised form where possible (legitimate interests, Art. 6(1)(f) GDPR).
• To send service messages you need to receive, such as security, billing or important account notices (performance of a contract and legitimate interests). Optional messages such as a newsletter are sent only with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• To comply with legal obligations, including accounting and record-keeping duties under Swiss law (legal obligation, Art. 6(1)(c) GDPR).

Under the revDSG, processing by a private person is lawful when it does not unlawfully breach the personality of the data subject; we rely on the performance of our contract with you, your consent where required, applicable law, and our legitimate interests as the justification for the processing described above.

5. AI features

Some features use a third-party artificial-intelligence provider (OpenAI) to draft text, summarise your data, or read documents you submit to those features. Only the content needed to perform the task you invoked is sent, over an encrypted connection. Our AI provider processes this data on our behalf to return a result and, under our agreement with it, does not use data submitted through its API to train its models. AI output can be inaccurate and is always presented to you as a draft to review before you rely on it.

6. Cookies and similar technologies

We use only strictly necessary, first-party cookies and similar storage. Specifically: a session cookie that keeps you signed in, a cookie that remembers your chosen language, and a cookie that remembers interface preferences such as whether the sidebar is collapsed. Your theme choice is stored locally in your browser.

We do not use advertising cookies, cross-site trackers, or third-party analytics that profile you. Because we set only strictly necessary cookies, no consent banner is required for them. You can clear cookies in your browser at any time, though signing in again will set the session cookie needed to use the Service.

7. Recipients and subprocessors

We do not sell your personal data. We share it only with the service providers that help us run the Service, each bound by a data-processing agreement and permitted to use the data only to provide their service to us. Our current subprocessors are:

We may also disclose personal data where required by law, to enforce our Terms, or to protect our rights, safety or property or those of others. A current list of subprocessors is maintained in our Data Processing Agreement.

8. Where your data is stored, and international transfers

Your account and content data are held in a database hosted in Switzerland, in the Zurich region (eu-central-2) operated by our infrastructure provider. Some of our subprocessors process limited data outside Switzerland, in the European Union or the United States, as shown in the table above (for example email delivery and the AI features).

Where personal data is transferred abroad, we rely on appropriate safeguards: transfers to countries recognised by the Swiss Federal Council and the EU as providing adequate protection, and, for other countries such as the United States, the European Commission's Standard Contractual Clauses together with the Swiss addendum recognised by the FDPIC, plus additional technical measures such as encryption in transit.

9. How long we keep data

We keep personal data only as long as needed for the purposes above. Account and content data are kept for as long as your account is open. When you close your account, we begin the deletion process described in section 10.

Some data is kept longer where the law requires it, in particular records needed to meet accounting and retention duties under the Swiss Code of Obligations (generally up to ten years). Security and audit logs are kept for a limited period appropriate to their purpose, and backups are rotated and overwritten on a regular cycle.

10. Your rights and how to exercise them

Subject to the conditions of the revDSG and the GDPR, you have the right to access your personal data, to have inaccurate data corrected, to have data deleted, to receive your data in a portable format, to object to or request restriction of certain processing, and, where processing is based on consent, to withdraw that consent at any time without affecting past processing.

You can exercise the most important of these rights yourself, directly in the app, without contacting us:

• Access and portability: from Settings > Privacy you can export a complete copy of your data as a ZIP archive containing a structured JSON file, provided under your right of access and data portability.
• Erasure: from Settings > Privacy you can request account deletion. Deletion starts a 30-day grace period during which you can cancel, after which your account and personal data are deleted or irreversibly anonymised. Deletion may be paused while you have unpaid invoices that must be retained for legal record-keeping.
• Rectification: you can correct most of your data at any time by editing it directly in the app.

For any other request, or if you need help, contact us at support@solory.ch. We may need to verify your identity before acting. You also have the right to lodge a complaint with a supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC / EDÖB, Bern); in the EU, your local data-protection authority.

11. Security

We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. These include database row-level isolation so each account can reach only its own data, optional two-factor authentication, encryption of data in transit, private file storage with short-lived access links, least-privilege access controls, and audit logging. No system can be guaranteed completely secure, so we cannot promise absolute security, but we work continuously to protect your data.

12. Children

The Service is intended for business use by adults and is not directed at children. We do not knowingly collect personal data from children.

13. Changes to this policy

We may update this Privacy Policy to reflect changes to the Service or to legal requirements. We will post the updated version with a new date and, for material changes, take reasonable steps to notify you. Please review it from time to time.

14. Contact

For any question about this policy or about how your personal data is handled, contact Alex Földvári at support@solory.ch or by post at Wartauweg 19, 8049 Zürich, Switzerland.