Privacy Policy

Axolot is an online accounting service published by Vergasta Digital (« we »), designed and operated in Switzerland. This policy meets the information obligations under Art. 19 FADP and the requirements of Art. 13 FADP Ordinance. It is concise, transparent, understandable and easily accessible.

Data controller

Depending on the data concerned, the data controller within the meaning of Art. 5 let. j FADP is Vergasta Digital or you, as applicable in the cases below.

• Vergasta Digital, 2610 Saint-Imier, Switzerland, contact@vergasta.ch, for user account data (Axolot ID), Axolot licence billing data and technical platform logs.
• You (the using business, sole proprietor or sole proprietorship), for your customers', suppliers', accounting records and supporting documents entered or uploaded in Axolot. Vergasta Digital then acts as a processor within the meaning of Art. 9 FADP, on documented instructions set out in the data processing agreement (DPA).

Categories of personal data

• Account data (Axolot ID), namely name, email address, password (hashed), locale, two-factor authentication (TOTP), OAuth identifiers (Google, Apple).
• Company data, namely legal name, address, IDE/UID number, IBAN/QR-IBAN, VAT liability, accounting settings.
• Accounting data, namely invoices, quotes, journal entries, bank transactions (CAMT or open banking), receipts and uploaded supporting documents.
• Third-party data, namely contact details of your customers and suppliers (address book).
• Licence billing data, namely amounts, payment references, last four digits of card (via Stripe).
• Technical data, namely audit and security logs (Art. 4 FADP Ordinance), IP address, session identifier, timestamps.
• Sensitive data by association. Certain supporting documents may contain sensitive data within the meaning of Art. 5 let. c FADP (health, trade unions, private life). You remain responsible for the lawfulness of their processing.

Purposes and legal bases

Automatic receipt reading by artificial intelligence

When you upload a receipt, its image may be transmitted to an artificial intelligence service to automatically extract information (merchant, date, amount, VAT). This processing relies on Infomaniak's sovereign AI, hosted in Switzerland.

• Your supporting documents do not leave Swiss territory.
• They are never used to train artificial intelligence models.
• Only the image strictly necessary for extraction is transmitted, for the duration of processing.

Processors and recipients

We use service providers (sub-processors within the meaning of Art. 7 FADP Ordinance), bound by contract to confidentiality and data protection obligations equivalent to ours. Prior authorisation and the objection procedure are detailed in the data processing agreement (DPA).

Hosting and transfers

The application and your accounting data are hosted in Switzerland at Infomaniak Network SA. Except for the providers listed above, your accounting data and supporting documents are not transferred outside Switzerland. Transfers abroad are governed by appropriate safeguards (Art. 16 and 17 FADP).

Retention period

• Accounting records and data, retained for at least 10 years, in accordance with Swiss legal obligation (Art. 958f CO).
• Account data (Axolot ID), retained for as long as your account is active, then deletion or anonymisation within a reasonable period after closure.
• Audit logs (Art. 4 FADP Ordinance), retained for at least 1 year, on infrastructure separate from the production database.
• Security logs, retained for a limited duration proportionate to their purpose.

Security

We implement appropriate technical and organisational measures, including encryption of communications (HTTPS/TLS), two-factor authentication (TOTP), encryption of bank tokens at rest, strict data segregation between businesses (multi-tenant) and logging of access to personal data (Art. 4 FADP Ordinance).

Your rights (Art. 25 to 29 FADP)

As a data subject, you have the following rights, within the limits of the law.

• Right of access (Art. 25 FADP), to obtain information about the processing of your data.
• Right to rectification (Art. 32 FADP), to have inaccurate data corrected.
• Right to erasure (Art. 32 FADP), to request deletion, subject to legal accounting retention obligations.
• Right to data portability (Art. 28 FADP, Art. 20 and 21 FADP Ordinance), to receive your data in a commonly used electronic format (JSON/CSV export from the application).
• Right to object (Art. 30 FADP), to object to certain processing based on overriding legitimate interest.

To exercise your rights, write to us at contact@vergasta.ch. We respond within one month (Art. 25 para. 4 FADP). You may lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch.

Cookies

We use cookies strictly necessary for the operation of the service (session, security). These cookies do not require your consent.

On the public marketing website (information pages, pricing, contact), we also offer audience measurement via Google Analytics 4 (Google LLC). Purpose: to understand site usage and improve our content. Legal basis: your consent (Art. 6 lit. a FADP Ordinance). The script is loaded only after acceptance via the banner shown on your first visit. You may withdraw consent at any time by clearing site data in your browser or by declining via the banner. Retention period on Google's side: according to Google's policy (https://policies.google.com/privacy). We do not use advertising cookies or Google Ads signals.

Changes

This policy may evolve to reflect legal or functional changes. The date of the last update appears at the top of this page.