Privacy policy

Controller

RedSwiss Invoice (invoice.redswiss.ch) is operated by Anthony Thomas, a private individual resident in Switzerland. For any question about your personal data: info@anthony-thomas.ch.

Two different roles

For your account data, we are the controller.

For the data you enter about your own customers (names, addresses, emails, invoices, payments) and for the bank statements you import, you are the controller: we process them only on your behalf and on your instructions, to provide you with the service. It is up to you to inform your customers about the processing of their data.

Data we process

• Account: name, email address, password (stored only as a hash, never in plain text), two-factor authentication settings.
• Sign-ins: IP address and browser of your sessions and recognised devices, so we can warn you about unusual sign-ins.
• Organisation: details of your business, team members and invitations.
• Your customers: name, email address, postal address and notes.
• Invoicing: products, invoices, invoice lines, payments and reminders.
• Imported bank statements (camt.053 format): payer names, IBANs, amounts, dates and references, used to match payments to your invoices.
• Subscription: for paid plans, payment data is processed by Stripe. We do not store your card details.
• Statistics: cookieless audience measurement with a tool hosted on our own servers (Umami). Page addresses are recorded without parameters, tokens or identifiers.

Purposes

• Providing the service: creating QR-bills, sending them, tracking their payment and matching your bank statements.
• Securing accounts: two-factor authentication, sign-in alerts, abuse prevention.
• Managing subscriptions and payments.
• Sending service emails: address confirmation, sign-in alerts, invitations, password resets, and the invoices and reminders you send to your customers.
• Improving the website with aggregated statistics.

We do not use your data or your customers' data for advertising and we do not sell it.

Legal bases

Where the EU General Data Protection Regulation (GDPR) applies, we process data to perform our contract with you, on the basis of our legitimate interest (security, cookieless statistics) or to meet our legal obligations.

Hosting and service providers

• Infomaniak Network SA (Switzerland): hosting of servers and databases. Your invoicing data is stored in Switzerland.
• Resend (United States): sending emails, including the invoices and reminders sent to your customers. Resend stores email content and delivery logs in the United States; this transfer is covered by standard contractual clauses adapted to Swiss law.
• Stripe (Ireland and United States): subscription payments. Stripe is certified under the Swiss-U.S. Data Privacy Framework.

These providers only process data to deliver their services to us.

Retention

• Account: kept while active, then deleted within 30 days of your request.
• Customers, invoices, payments and imported statements: kept as long as your organisation's account exists, then deleted with it.

Accounting law generally requires invoices and accounting records to be kept for 10 years (art. 958f of the Swiss Code of Obligations). This obligation is yours: download your invoices before deleting your account.

Some data may be kept longer where the law requires it, for example the payment records of your subscription.

Cookies

We only use cookies that the website needs to work: a session cookie to keep you signed in and a cookie that remembers your theme preference (light or dark). We use no advertising or tracking cookies.

Security

Traffic is encrypted (HTTPS), passwords are hashed, two-factor authentication is available, each organisation's data is kept separate and invoice links only give access to the invoice concerned.

Your rights

You can ask to access your data, correct it, delete it or receive a copy in a common format, and object to certain processing. Write to us at info@anthony-thomas.ch; we reply within 30 days. If you are a customer of one of our users, please first contact the business that sent you the invoice.

You can also contact the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch) or, if you live in the European Union, the data protection authority of your country.

Changes

We may update this policy. The date of the current version is shown at the top of this page; for significant changes we will inform you by email or on the website.