Privacy Policy

At a glance

1. Controller

Responsible person / controller

Alex Földvári (Solory)

Address

Im Sand 4, 8105 Watt, Switzerland

Email

support@solory.ch

The person named above decides why and how personal data is processed for the purposes described in this policy, and is your point of contact for any data-protection question or request.

2. The roles we act in

We process personal data in two distinct roles. First, we are the controller of the personal data of our own account holders (for example your name, email, login and billing details) and of visitors to our website. This policy covers that processing.

Second, when you use the Service to manage information about your own clients, contacts, leads and correspondents, you are the controller of that data and we act only as your processor (Auftragsbearbeiter), on your instructions. That relationship is governed by our Data Processing Agreement, not by this policy. You are responsible for informing your own clients about your use of the Service and for having a lawful basis to process their data.

There is a third case, and it concerns people who have never heard of us. We host the contact form on a small number of websites we built for our own customers. When a visitor to one of those sites sends an enquiry, it is submitted to our servers and stored here - their name, their email address, their message, and the IP address and browser that sent it - and then forwarded to the site owner. For those enquiries we are the controller, this policy applies, and the same rights in section 10 are available: write to us at the address in section 14 and we will find the enquiry and act on it. We do not use them for anything except delivering and, where delivery failed, retrying the message.

3. Categories of personal data we process

• Account data: your name, email address, password (stored only as a secure hash), language and interface preferences, and any team or collaborator relationships.
• Content data: the business information you enter or upload, such as clients, leads, projects, quotes, invoices, expenses, payments, contracts, documents, calendar entries and email you send or receive through the Service. This may contain personal data about third parties, for which you are the controller (see section 2).
• Billing data: your chosen plan, subscription status and payment records. We do not store full card numbers.
• Usage and technical data: log data such as IP address, device and browser information, timestamps, and security and audit events generated when you use the Service.
• Support and communications data: the content of messages you send us and our replies, including support tickets and in-app chat.
• Signature data: when a contract or quote is signed through the Service, we record the signer's email address, the IP address and browser used, the time of signature, the one-time code sent to confirm it, and the drawn signature image. This is evidence that the signature happened, and it is deliberately kept with the signed document.
• Location data, only if you switch it on: the timer can record the coordinates where a work session was started and stopped. This is off unless you enable it, and your browser asks for permission each time.
• Notification data: if you enable browser notifications, the address your browser gives us to reach that device, together with the keys needed to encrypt the message. If you connect the Telegram assistant, your Telegram user ID.
• Campaign data: when you open an account, we record once - on our server, against your account - the advertising labels and click identifiers that were in the link you arrived through (for example utm_source, utm_campaign, or a network's own click identifier such as gclid or fbclid), the host of the website that referred you, and the page you were on. Nothing is stored on your device for this, and no such record is made for a visitor who only browses; a visit through a link that carries campaign labels adds at most one to the anonymous daily count described in the next item.
• Anonymous visit counts: when you open a page of our website through a link that carries campaign labels (utm_source or utm_campaign) - the ones we add to our advertisements and posts, or ones another website or service added to a link to us - our server adds one to a daily total for that combination of labels. The totals contain no IP address, no cookie or other identifier, no advertising network's click identifier and no details of your browser or device. Section 6 lists exactly what they contain.
• Advertising measurement data, only if you accept marketing cookies: the Meta pixel reports the pages you open, on the public site and in the app alike, to Meta Platforms Ireland Limited, together with your IP address, your browser and Meta's own cookies; and our server reports to Meta that you joined the waiting list or sent us a question about the product, that an account was opened and that a subscription was bought, of which only the account opening carries your email address, as a SHA-256 hash. Section 6 sets out exactly what is sent and what is not.
• Waiting-list data: if you signed up before launch, your name, email, language, the campaign parameters of the link you arrived through, and the personal discount code we issued to you.

4. Purposes and legal bases

We process personal data for the following purposes. Under the GDPR, where it applies, the corresponding legal bases are shown in brackets.

• To provide, operate and maintain your account and the Service, including its core features (performance of a contract, Art. 6(1)(b) GDPR).
• To handle billing, subscriptions, one-off purchases and the four plans (performance of a contract, Art. 6(1)(b) GDPR).
• To keep the Service secure, prevent abuse and fraud, and maintain audit logs (legitimate interests, Art. 6(1)(f) GDPR; under the revDSG, our overriding interest in a secure service).
• To provide support and respond to your requests (performance of a contract and legitimate interests, Art. 6(1)(b) and (f) GDPR).
• To improve and develop the Service, using data in an aggregated or minimised form where possible (legitimate interests, Art. 6(1)(f) GDPR).
• To send service messages you need to receive, such as security, billing or important account notices (performance of a contract and legitimate interests, Art. 6(1)(b) and (f) GDPR). Optional messages such as a newsletter are sent only with your consent (Art. 6(1)(a) GDPR), which you can withdraw at any time.
• To comply with legal obligations, including accounting and record-keeping duties under Swiss law (legal obligation, Art. 6(1)(c) GDPR).
• To understand which campaign or link an account came from, so that we can judge where our advertising is worth continuing (legitimate interests, Art. 6(1)(f) GDPR; under the revDSG, our interest in knowing which of our own campaigns work). This uses only the parameters that were in the link at the moment of signup; nothing is stored on your device for it, and it is never used to build a profile or to target you with advertising.
• To count, per day and without identifying anyone, how many visits arrive through links that carry campaign labels - above all those of our own advertisements and posts - so that we can tell which advertisements bring visitors - including visitors who decline measurement cookies - and stop paying for those that do not (legitimate interests, Art. 6(1)(f) GDPR; under the revDSG, where a justification is needed at all, our overriding interest in knowing which of our own advertisements work, Art. 31(1) revDSG). No cookie is set or read for it and nothing is stored on your device; the result is a set of daily totals, described in full in section 6.
• To measure and optimise the advertising we buy on Facebook and Instagram (consent, Art. 6(1)(a) GDPR; under the revDSG, your consent). This is the one purpose in this list that rests on consent alone: without your agreement to marketing cookies nothing happens at all, and you can withdraw that agreement at any time. It is also the one where the recipient, Meta, then pursues its own purposes with what it receives rather than acting on our instructions, which makes us and Meta joint controllers for it. Sections 6 and 7 say what is sent, and what is not.

Under the revDSG, processing by a private person is lawful when it does not unlawfully breach the privacy of the data subject; we rely on the performance of our contract with you, your consent where required, applicable law, and our legitimate interests as the justification for the processing described above.

5. AI features

Some features use a third-party artificial-intelligence provider (OpenAI) to draft text, summarise your data, or read documents you submit to those features. Only the content needed to perform the task you invoked is sent, over an encrypted connection. Our AI provider processes this data on our behalf to return a result and, under our agreement with it, does not use data submitted through its API to train its models. AI output can be inaccurate and is always presented to you as a draft to review before you rely on it. We do not use these features to take decisions about you by automated means alone that would produce legal effects for you or similarly significantly affect you: they prepare text and summaries for you to check and act on.

One use is not something you press a button for: when you save an expense, its description and supplier name are sent to the same provider to compute a numeric representation, which is what lets the app suggest a category for the next similar expense. It happens only while AI features are enabled for your account, and you can turn them off under Settings.

Two other kinds of content reach the same provider and are worth naming separately, because neither is text you typed. A photograph of a receipt or an invoice you hand to the app is uploaded and read. And if you send the assistant a voice message on Telegram, the recording itself is uploaded and transcribed - the audio, not a transcript made here. Both are sent only for the task you asked for, both fall under the same no-training agreement, and both stop entirely when you switch AI features off.

AI features can be switched off for your whole account. With them off, nothing is sent to the AI provider - including the automatic step described above.

6. Cookies, website measurement and email tracking

The cookies we set ourselves are either strictly necessary or a preference you chose on screen, and the same goes for similar storage. A session cookie keeps you signed in, one remembers your chosen language, one remembers interface preferences such as whether the sidebar is collapsed, and your theme choice is stored locally in your browser. Those are examples, not the whole set: the Cookie Policy names every one of them, what it holds and how long it lasts, including the storage that holds an unfinished draft. The measurement and advertising cookies described below are not ours: they are set by the Google and Meta scripts, and only if you agree to them.

These strictly necessary cookies are set without asking, because the Service cannot be provided without them. A further cookie records your cookie choice itself, so that we do not have to ask again on every page.

We also use Google Analytics 4, a measurement service of Google Ireland Limited, to understand how the site is found and used: which pages are read, which country a visit came from, and which advertisement or link brought a visitor to us. It runs on the public pages and, once you are signed in, in the app itself. This is not strictly necessary, so it runs only if you agree to it. Until you agree, no Google script is loaded and nothing is sent to Google.

Where you do agree, Google Analytics sets first-party cookies (named _ga and _ga_*) and receives your shortened IP address, your device and browser type, an approximate location derived from that IP address, and the pages you open. We reduce page addresses to their general shape before they are sent: an address such as /invoices/<identifier> is transmitted as /invoices/[id]. Pages reached through a personal link we send to you or to your clients - client portal, contract signature, quote and file-share links - are excluded from measurement entirely, and their addresses are never transmitted.

If you additionally agree to marketing cookies, we load the Meta pixel. Meta Platforms Ireland Limited is the company behind Facebook and Instagram, and that is where our advertising runs. The pixel is a small script fetched from Meta: it reports that a page was opened - and also, when you join our waiting list or send us a question about the product, that you did - and it sets Meta's own cookies (_fbp, and _fbc when you arrived through a link on Facebook, Instagram or another Meta service to which Meta added its click identifier, such as one of our advertisements or a post that links here; _fbc holds that identifier). Through it Meta receives your IP address, your browser's user agent, the address of the page you opened and the address of the page you came from. Until you agree, the script is never fetched, so Meta learns nothing whatsoever about your visit - not even your IP address.

Two things about that pixel are worth saying plainly, because a reader could reasonably assume otherwise. First, it is loaded on every page of the site and, once you are signed in, of the app as well, not only on our public pages; the personal links described below are the only exception. Second, it reads the address of the page for itself, so that address is not reduced to its general shape the way the Google measurement above is: a page such as /invoices/<identifier> reaches Meta as it stands. It carries no invoice figures, no client names and nothing else out of your records, but it is the real address. If you would rather Meta did not see which pages of the app you open, decline marketing cookies, or withdraw them later; everything described here then stops.

Separately from your browser, our own server reports three things directly to Meta, and only when the same marketing consent is present in the request: that you joined our waiting list or sent us a question about the product through our contact page (any other enquiry - about your account, about a bill or about something else - is not reported), that an account was created, and that a subscription was bought after a successful payment. The account creation carries your email address hashed with SHA-256, never the address itself; the waiting-list signup, the enquiry and the purchase carry no email address at all, nor anything else you typed into the form - not your name, not your email address, not your message. Every report carries whichever of Meta's two cookies named above your browser holds, the IP address and user agent of that request, the name of the event and the moment it happened, the address of the page it belongs to (a fixed address of ours, with no identifier in it), and a reference for the event itself. For a signup we derive that reference from your account identifier and for a purchase from the payment session, so that a report sent twice is counted once; for a waiting-list signup or an enquiry it is a random reference, which the pixel's report of the same moment carries too, so that Meta counts the two as one. The waiting-list signup and the enquiry also say which of those two forms they came from; the purchase also carries the plan's list price in Swiss francs for the term bought, a month or a year. Nothing else: no name, no postal address, no telephone number, no invoice figures, none of your business records.

Meta uses this to measure and optimise our advertising, and it decides for itself what else it does with the data, so for this one purpose Meta is not acting on our instructions - see section 7. None of it happens without your consent to marketing cookies, and none of it happens on a personal link we send to you or to your clients: the pixel is not loaded on client portal, contract signature, quote or file-share pages. Declining costs you nothing: the Service is identical either way, and your separate decision about the Google measurement described above is untouched. This is also a different thing from the campaign label we record once when you open an account, described in sections 3 and 4: that record is made on our own server, needs no consent, and is never sent to an advertising network.

You can change or withdraw your choice at any time using the Cookie settings link in the footer of every page, or under Settings, Privacy once signed in. Withdrawal takes effect immediately for everything that follows. You can also clear cookies in your browser at any time, though signing in again will set the session cookie needed to use the Service.

When you make that choice we record it on our server: what you agreed to, when, from which country, and which version of this policy was in force. We keep this as proof that consent was given, which the law requires us to be able to show, and we keep it for as long as we may have to demonstrate it.

One count does not depend on your cookie choice, because it uses no cookie: it sets none, it reads none, and it stores nothing on your device. It works only with what your browser sends with every request anyway - the address of the page and the standard headers of the request. When a page of our website is opened through a link that carries campaign labels - the utm_ parameters that we add to the links in our advertisements and posts, or that another website or service added to a link to us; utm_source or utm_campaign must be present - our server adds one to a total for that day. A separate total is kept for each combination of: the day (Swiss time); the labels utm_source, utm_medium, utm_campaign, utm_content and utm_term as they appear in the link, whoever added them; the language of the page, where its address names one; the page, reduced to its general address (for example /register); and whether the request came from an automated program such as a search engine or a link-preview service, which our server decides at that moment from the browser's self-description (its user agent) and does not keep. That is all. The count keeps no IP address, no cookie or other identifier, no browser or device details, no referring address, no time of day and no record of the individual visit; it does not use an advertising network's click identifier (such as fbclid or gclid) at all; and a visit is counted once, when it arrives, and is not followed from page to page. A label that contains an @ sign, and could therefore be an email address, is replaced before it is counted. Only the public pages of our website and the registration, sign-in and subscription-purchase pages are counted; pages inside the app, and pages reached through a personal link we send to you or to your clients, are never counted. While the page is being delivered, our server necessarily receives your IP address, as with every page view; it is part of the technical log data described in section 3, and the count neither uses nor keeps it.

We use these totals to see which of our advertisements and links bring visitors - including the many who decline measurement cookies and are therefore invisible to Google Analytics - and we compare them only with other totals, such as the number of waiting-list signups per campaign, never with an individual visit, person or account. Our legal basis under the GDPR is our legitimate interest in judging our own advertising (Art. 6(1)(f) GDPR); under the revDSG, where the processing needs a justification at all, it is justified by the same overriding interest (Art. 31(1) revDSG). The counting runs on our hosting provider (Vercel) and the totals are kept in our own database in Zurich (Supabase), both on our behalf and both listed in section 7; the totals are passed to no one else - advertising networks included - and are deleted 13 months after the day they count. You may object to this count at any time (Art. 21 GDPR, and likewise under the revDSG). Because we cannot recognise you, an objection takes effect technically: let your browser send a Do Not Track or Global Privacy Control signal - a visit that carries either is not counted - or open our address without the part that begins with a question mark. You can also send an objection or a question about this count to support@solory.ch. Because the totals contain nothing that identifies you, neither we nor anyone else can find your visit in them afterwards, so there is nothing in them that we could show you, correct or delete. This count is separate from the technical log data described in section 3, which is unchanged.

Separately from cookies, the emails we send you are tracked. Each message contains a small invisible image and links that pass through our email provider, so we can see whether the message was opened, when, and which links were clicked. We use this to tell whether important messages are arriving at all, to spot delivery problems, and to stop writing to addresses that no longer work. This is not done through a cookie and does not depend on your cookie choice.

You can prevent it at your end: most email programs can be set not to load remote images, which stops the open from being recorded, and you can copy a link rather than clicking it. We would rather be exact than reassuring, and exact means not blaming somebody else: tracking is configured once per sending domain, on or off for everything sent from it. Our email provider does offer a per-message switch and our code can already carry it, but nothing in the product sets it - so today we cannot honour an objection by disabling tracking for your address alone. That limit is ours, not theirs, and we intend to remove it. If you object meanwhile, write to us and we will stop reading the results for your address and delete the ones we hold.

The same tracking applies to email that YOU send to your own clients through the Service, and the results are shown to you in the message history. For those messages you are the controller: it is for you to decide whether that tracking is lawful and proportionate in your own relationship with your recipients, and to tell them about it in your own privacy notice. It cannot currently be turned off for individual messages, because it is a property of the sending domain rather than of the message.

7. Recipients and subprocessors

We do not sell your personal data. We share it with the service providers that help us run the Service, and as a rule each of them is bound by a data-processing agreement and may use the data only to provide their service to us. Two kinds of entry in the table below are not that, and they belong above the table rather than in a note under it. Meta receives advertising measurement, only where you have consented to marketing cookies, and then decides for itself what it does with it, which makes us and Meta joint controllers for that measurement rather than us its client. Telegram and Discord, if you connect them, are not bound to us by such an agreement at all. Who receives what:

The last five are OPTIONAL and happen only once you allow them. Leaving aside Telegram and Discord, which are covered next, Meta is the one entry that is not our processor: the others use the data only to provide their service to us and only on our instructions, while Meta pursues its own advertising purposes with what it receives, which makes us and Meta joint controllers for that measurement. Telegram and Discord are consumer messaging platforms that we do not control and that are not bound to us by a data-processing agreement; connecting them is your decision, and what you route through them leaves our infrastructure. We would not recommend forwarding client data to either of them.

We may also disclose personal data where required by law, to enforce our Terms, or to protect our rights, safety or property or those of others. A current list of subprocessors is maintained in our Data Processing Agreement.

8. Where your data is stored, and international transfers

Your account and content data are held in a database hosted in Switzerland, in the Zurich region (eu-central-2) operated by our infrastructure provider. Some of the recipients named above process limited data outside Switzerland, in the European Union or the United States, as shown in the table (for example email delivery, the AI features and, where you have consented to it, website measurement). The advertising measurement described in section 6 is one of those cases: it goes to Meta Platforms Ireland Limited in Ireland, and Meta may process it at Meta Platforms, Inc. in the United States.

Where personal data is transferred abroad, we rely on appropriate safeguards: transfers to countries recognised by the Swiss Federal Council and the EU as providing adequate protection, and, for other countries such as the United States, the European Commission's Standard Contractual Clauses together with the Swiss addendum recognised by the FDPIC, plus additional technical measures such as encryption in transit.

For the advertising measurement, Meta relies on the European Commission's Standard Contractual Clauses for the transfer from Meta Platforms Ireland Limited to Meta Platforms, Inc. Because Meta determines its own purposes for that data, that onward transfer is Meta's to justify rather than ours; we name it here so that you can see it happens at all, and your consent to marketing cookies is what decides whether it happens for you.

9. How long we keep data

We keep personal data only as long as needed for the purposes above. Account and content data are kept for as long as your account is open. When you close your account, we begin the deletion process described in section 10.

The anonymous daily visit totals described in section 6 contain nothing that identifies a person; they are deleted automatically 13 months after the day they count.

Some data is kept longer where the law requires it, in particular records needed to meet accounting and retention duties under the Swiss Code of Obligations (generally up to ten years). Backups are rotated and overwritten on a regular cycle.

The audit log is different, and we would rather say so plainly than imply otherwise. It records who did what in your account - and every time we accessed it to support you - and it cannot be edited or deleted, by you or by us. That is the point of it: a record that can be quietly amended is no evidence of anything. When your account is erased the entries stay, for the same reason - but your name, email address, IP address and browser details are scrubbed out of them, which is the part of an entry that identifies you.

10. Your rights and how to exercise them

Subject to the conditions of the revDSG and the GDPR, you have the right to access your personal data, to have inaccurate data corrected, to have data deleted, to receive your data in a portable format, to object to or request restriction of certain processing, and, where processing is based on consent, to withdraw that consent at any time without affecting past processing.

You can exercise the most important of these rights yourself, directly in the app, without contacting us:

• Access and portability: from Settings > Privacy you can export a complete copy of your data as a ZIP archive containing a structured JSON file, provided under your right of access and data portability.
• Erasure: from Settings > Privacy you can request account deletion. Deletion starts a 30-day grace period during which you can cancel, after which your sign-in is permanently disabled and your email address removed from it; your files, your stored credentials and every connected channel are deleted; and the rest is irreversibly anonymised.
• Rectification: you can correct most of your data at any time by editing it directly in the app.
• Direct marketing: you can object to receiving marketing messages at any time and without giving a reason, by using the unsubscribe link in any such message or by writing to us. We then stop, and we keep only the record needed to honour the objection.
• Advertising measurement: from the Cookie settings link in the footer of every page, or from Settings > Privacy once signed in, you can withdraw your consent to marketing cookies at any time. The Meta pixel then stops loading and our server sends Meta nothing further. What Meta already holds is a matter for Meta, whose own settings and contact details are on its site.
• Objecting to the anonymous visit count: let your browser send a Do Not Track or Global Privacy Control signal, and visits that carry it are not counted (section 6).

Erasure has limits, and they are worth stating before you rely on it rather than after. What survives, and why:

• Accounting records - invoices, the payments booked against them and the expenses claimed - are kept for ten years from the end of the financial year, because Art. 958f of the Swiss Code of Obligations requires it. The personal details attached to them are scrubbed as far as the record still makes sense without them.
• Contracts that were signed stay, with the signature evidence described in section 3. An executed agreement is not ours alone to erase: the other party has a legitimate interest in it, and a signature that can be deleted is not evidence of anything.
• The audit log stays as an audit log. After an erasure the entries remain, with your name, email address, IP address and browser details scrubbed out of them.
• The deletion request itself is kept, so that we can show when the request was made and when it was carried out.
• Backups are not edited. A deletion reaches them as they are rotated and overwritten on their normal cycle, within a few weeks.

If a step of the erasure fails, the request stays open and is retried, rather than being marked complete. You will not be told your data is gone while any of it is not.

For any other request, or if you need help, contact us at support@solory.ch. We may need to verify your identity before acting. You also have the right to lodge a complaint with a supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC / EDÖB, Bern); in the EU, your local data-protection authority.

11. Security

We take appropriate technical and organisational measures to protect personal data against loss, misuse and unauthorised access. These include database row-level isolation so each account can reach only its own data, optional two-factor authentication, encryption of data in transit, private file storage with short-lived access links, least-privilege access controls, and audit logging. No system can be guaranteed completely secure, so we cannot promise absolute security, but we work continuously to protect your data.

Solory is operated by one person, who administers the platform and can open a session in an account in order to answer a support request or investigate a fault. Doing so writes a record to that account's own audit log, which the account holder can read; the session is visible on screen while it lasts; and it is limited to what the question needs. Nobody else has access.

Such a session is read-only unless it is deliberately opened in a mode that permits changes, which exists because some support requests cannot be answered without correcting something. When it is, the changes are made as the operator and are recorded as such in the same audit log, so you can see not only that somebody looked, but what they altered and when. We use it to fix what you asked us to fix, and for nothing else.

If a breach of personal data does occur, we have a written procedure with a fixed clock rather than an intention to do our best. We notify the Federal Data Protection and Information Commissioner where the revDSG requires it, and, where the GDPR applies, the competent supervisory authority within 72 hours of becoming aware. Where a breach is likely to put you at high risk we tell you directly, in your own language, saying what happened and what it means for you. Every breach is recorded internally, including those that did not meet the threshold to be notified.

12. Children

The Service is intended for business use by adults and is not directed at children. We do not knowingly collect personal data from children.

13. Changes to this policy

We may update this Privacy Policy to reflect changes to the Service or to legal requirements. We will post the updated version with a new date and, for material changes, take reasonable steps to notify you. Please review it from time to time.

14. Contact

For any question about this policy or about how your personal data is handled, contact Alex Földvári at support@solory.ch or by post at Im Sand 4, 8105 Watt, Switzerland.