Record of processing activities

As of 16 October 2026

This record is kept under art. 12 of the Federal Act on Data Protection (FADP) and art. 24 of the Data Protection Ordinance (DPO). It lists what Finz’art does with personal data, on its own account and on behalf of the people who use the app. It is published for transparency; the privacy policy explains the same processing to the user, in detail.

Who keeps this record

Jordane Vettese, sole proprietorship Finz’art - JVettese, UID CHE-313.464.758, see the legal notice. Data protection contact: support@finzart.ch.

Finz’art has two roles. It is the controller for accounts, the subscription, support and the website (part A). It is a processor (art. 9 FADP) for the data the user enters about their clients, patients, suppliers and team: the user is the controller (part B).

A. Processing for which Finz’art is the controller

A1. Accounts, sign-in and service e-mails

• Purpose. Create and protect the account, find the same data on several devices, send the confirmation code, the forgotten password code, the trial messages, and the invitation or readmission of a team member.
• Data subjects. Users and the people they invite to their team.
• Data. E-mail address, password as a hash (scrypt), language, confirmation and trial dates, version and date of acceptance of the terms of use, connected devices (name, type, last sync), fingerprints of the session tokens, number of failed sign-in attempts.
• Recipients. Infomaniak Network SA, Switzerland (hosting of the server, the database and e-mail).
• Retention. As long as the account exists; deleting the account erases everything in one operation. The encrypted nightly backups expire after thirty days. A session token is erased seven days after it is revoked or thirty days after it expires.

A2. Subscription

• Purpose. Take out, collect and manage the subscription.
• Data subjects. Users who subscribe.
• Data. At Stripe: e-mail address and payment data. On the Finz’art server: the subscription status, the next due date and the customer identifier at Stripe, never the card number.
• Recipients. Stripe Payments Europe Ltd, Ireland.
• Retention. As long as the account exists; deleting the account cancels the subscription. Stripe keeps its own data according to its legal obligations.

A3. Support and contact form

• Purpose. Answer questions and requests.
• Data subjects. Anyone who writes to support.
• Data. Name, e-mail address, message.
• Recipients. Infomaniak Network SA, Switzerland (e-mail). The server passes the message on without keeping a copy.
• Retention. In the support mailbox for the duration of the exchange, twelve months at most.

A4. Website

• Purpose. Serve the website and protect it.
• Data subjects. Website visitors.
• Data. Technical server logs: IP address, page requested, date. No cookies, no audience measurement.
• Recipients. Infomaniak Network SA, Switzerland (hosting).
• Retention. A limited period, for security purposes only.

A5. Daily cap of the analysis service

• Purpose. Limit what an account can spend each day on calls to the analysis service.
• Data subjects. Users of the assistant.
• Data. The account identifier, the day and the number of requests. Never the content of a request.
• Recipients. None: this counter stays on the server, in Switzerland.
• Retention. Two days, then erased.

A6. Update check of the mobile app

• Purpose. Find out whether an update is available.
• Data subjects. Users of the mobile app.
• Data. Installed version, device type, an installation identifier specific to this copy of the app. No data entered in the app.
• Recipients. Expo (650 Industries, Inc.), United States, which hosts the updates.
• Retention. Under Expo’s terms; Finz’art links this identifier to nothing.

B. Processing on behalf of users

Controller: each user, for the people whose data they enter. Processor: Finz’art, within the limits of point 6 of the terms of use. Without a Finz’art account, the data stays on the user’s device and Finz’art processes none of it, except the scan (B7), the assistant (B6) and voice transcription (B8) if the user uses them.

B1. Sync and backup of business data

• Categories of processing. Copy the user’s business data to the server, then to the other devices of the account and its team.
• Data subjects. The user’s clients, patients, suppliers and team members.
• Data. Contacts (names, addresses, e-mails, phone numbers), quotes, invoices, credit and debit notes, payments, expenses, jobs, hours, planning appointments and their notes, supplier offers, internal quote calculations, change log, VAT returns, company settings and logo.
• Recipients. Infomaniak Network SA, Switzerland. Team members according to the modules the user opens to them; the user’s fiduciary, read-only.
• Retention. As long as the account exists. The sync log ninety days at most; the trace of a deletion (type and identifier, no content) as long as the account exists; a notice of a discarded change thirty days at most. The encrypted nightly backups expire after thirty days.

B2. Receipts and file for the fiduciary

• Categories of processing. Keep the photos and PDFs of receipts attached to expenses; on the user’s decision, deposit the accounting file of a period for their fiduciary.
• Data subjects. Suppliers and anyone named on a document.
• Data. Receipt files, exports of the period (CSV, Excel, XML, journal, VAT return).
• Recipients. Infomaniak Network SA, Switzerland. The person holding the read-only link created by the user; team members with the Expenses module.
• Retention. A receipt leaves the server with its expense; a file, when the user removes it; a link is valid for one year and can be removed at any time; everything goes with the account. The legal ten-year retention of records (art. 958f CO) remains the user’s responsibility, on their device and in their encrypted backups.

B3. Quote acceptance link

• Categories of processing. Publish a quote on a link that the user sends to their client, and keep the proof of acceptance.
• Data subjects. The users’ clients.
• Data. The quote and the user’s business contact details; on acceptance, the name typed by the client, the date, the time and their IP address, with a copy of the accepted quote.
• Recipients. Infomaniak Network SA, Switzerland. Anyone holding the address of the link.
• Retention. The link is valid for the period shown on the quote and can be revoked at any time; the proof is erased ninety days after the link ends.

B4. Team

• Categories of processing. Invite people into the user’s space and open modules to them.
• Data subjects. Invited collaborators and fiduciaries.
• Data. Invited e-mail address, role, open modules, invitation and acceptance dates, fingerprint of the invitation code, author of each change in the sync log.
• Recipients. Infomaniak Network SA, Switzerland.
• Retention. The code fingerprint is erased when it expires, seven days after sending; the rest as long as the access or the account exists.

B5. Health data (care sector)

• Categories of processing. Keep a patient’s record and what their health insurer asks for in order to reimburse them.
• Data subjects. The patients of users in the care sector.
• Sensitive data (art. 5 let. c FADP). Date of birth, sex, insurer, insured person and insurance card numbers, reason for treatment, doctor and prescription, previous prescriptions, type of care of each visit, appointment notes.
• Recipients. Infomaniak Network SA, Switzerland, with an account. This data appears on the patient’s invoice and is never sent to the assistant.
• Retention. As B1.
• Specific measures. Discreet mode is on from the start in this sector. The app reminds the user that this data is sensitive and that they are responsible for it towards their patients, professional secrecy included.

B6. Assistant and reading of documents by the analysis service

• Categories of processing. Reminder drafts, dictating and correcting quotes, rewording a line, weekly summary, questions, expense category, reading the fields of a document.
• Data subjects. Clients, patients and suppliers that the user names or that appear on a document.
• Data. The dictated or typed text, the facts of a reminder, the image of a document, depending on the function; in discreet mode, without the names of clients and suppliers. The details are in point 3 of the privacy policy.
• Recipients. Anthropic PBC, United States, through the Finz’art server, which keeps neither the text nor the image.
• Retention. None on the Finz’art server. At Anthropic, under its data processing agreement; Anthropic does not use this data to train its models.

B7. Text recognition of a document (scan)

• Categories of processing. Read the text of a photo or an imported file.
• Data subjects. Anyone named on the document.
• Data. Only the image of the document, without any identifier of the user.
• Recipients. a9t9 software GmbH (ocr.space), Germany, directly from the phone.
• Retention. None at Finz’art; at ocr.space under its policy. The text read stays on the device.

B8. Voice transcription

• Categories of processing. Turn a dictation made on a phone into text, with an account or the access code.
• Data subjects. The user and the people they name while dictating.
• Data. The voice recording and expected words.
• Recipients. None: the transcription software is installed on the Finz’art server, in Switzerland. The speech recognition of the phone or the browser, when used, is subject to the terms of its provider.
• Retention. In memory for the duration of the transcription, never written to disk; the app erases the recording from the phone as soon as it is sent.

C. Disclosure abroad

D. Security measures (art. 8 FADP, art. 1 to 3 DPO)

• Server, database, backups and e-mail hosted in Switzerland; encrypted connections (HTTPS).
• Passwords hashed (scrypt); limited sign-in attempts, account locked after several failures.
• Short-lived session tokens, renewed on every use, with detection of a stolen token; a password reset or “Sign out other devices” ends every session at once.
• Strict separation between accounts; in a team, access limited to the open modules; fiduciary read-only; access withdrawn at the next sync.
• Public links (quote, fiduciary) made of a long random token, limited in time and revocable.
• Encrypted nightly database backups, kept thirty days.
• On the device: secrets in the iOS Keychain or the Android Keystore; the user’s backups encrypted (AES 256 GCM).
• Separate, revocable consents before the scan, reading by the analysis service and the assistant; discreet mode on from the start in the care sector.
• Server logs without business content or secrets.

E. Updates

This record is reviewed whenever a processing activity changes, together with the privacy policy.