Privacy Policy

1. Controller

The controller responsible for data processing on this website and the Kundenbox platform is:

Patrick Lauber, Kundenbox, Reutlenring 15, 8302 Kloten, Switzerland

Email: privacy@kundenbox.ch

2. Data We Collect

Account data: When you create an account, we collect your name, email address, and profile information via our authentication provider.

Communication data: Kundenbox processes customer requests received through connected channels (email, WhatsApp, web forms), including sender details, message content, and attachments. We process this data on behalf of our customers (the respective businesses).

Usage data: When you visit our website, we collect technical data such as IP address, browser type, device information, and access times.

Calendar and email integrations: If you connect an integration (e.g. email or calendar), we process the required access data solely to provide that feature.

3. Purposes of Processing

We process personal data to provide and operate the Kundenbox platform, to consolidate customer requests from multiple channels into one inbox, to offer AI-assisted features such as summaries and reply suggestions, to ensure the security and stability of our services, and to comply with legal obligations.

4. Legal Bases

Processing is based on the performance of our contract with our customers, on legitimate interests (e.g. security and improvement of the platform), on legal obligations, or — where required — on your consent. You may withdraw consent at any time with effect for the future.

5. Processors and Third-Party Services

We rely on carefully selected service providers that process data on our behalf. We maintain this list alongside our register of processing activities under Art. 12 FADP; a new service appears here as soon as it is connected. For each one we state where it processes the data and what it receives.

• Anthropic, USA — AI-assisted analysis of messages and drafts. The text of an incoming message is transmitted for this.
• bexio, Switzerland — handover of documents to accounting, where a company sets up the connection.
• Clerk, USA — sign-in and staff account management: name, email address and sign-in data.
• ELDAS, Switzerland — the electrical wholesale article master. Article numbers are transmitted; no personal data.
• Federal Office of Topography swisstopo, Switzerland — turning an address into coordinates and looking up building data. The address of an Object is transmitted.
• Google Ads (gtag.js), USA — measuring advertising performance on elektro.box: which page views and sign-ups came from an ad, together with IP address, device and an advertising identifier stored in a cookie. On elektro.box only — not on kundenbox.ch, and not on the document pages a company's own customer opens.
• Google Cloud Storage; contracting party: Google Cloud EMEA Limited, Ireland; stored in Switzerland (region europe-west6, Zurich) — nightly backup copy of the file storage: attachments, document PDFs, receipts, signatures, contracts and logos. When a file is deleted from the file storage or replaced there, its previous copy normally stays in the backup for up to 90 days after the next nightly backup, and is then permanently deleted at Google within about 31 further days. As long as a file is in the file storage, its backup copy stays too. This includes the files of entries permanently deleted from the trash, because those files stay in the file storage, and files kept as evidence for an issued or completed document. Supplier invoices and receipts are the exception: deleting one also removes the file from the file storage, and its backup copy then expires within the periods given above.
• Google, USA — access to the Gmail mailbox, where a company connects one.
• Langfuse, EU/EEA — log of AI calls, including the texts submitted with them.
• Linear, USA — our ticket system. When someone reports a bug or a request through the assistant, the reported text verbatim, the reporter's name and email address, the company, the page and the device are transmitted.
• Meta Platforms (WhatsApp Business), USA — receiving and sending WhatsApp messages, where a company uses that channel.
• Microsoft, USA — access to the Outlook mailbox, where a company connects one.
• OpenRouter, USA — fallback route for the AI analysis when Anthropic does not respond. The same texts are transmitted as to Anthropic.
• Otto Fischer AG, Switzerland — handing a material order to the wholesaler, if the firm stores its own shop credentials. Article numbers, quantities and the Beleg number as the commission reference are transmitted.
• PostHog, EU/EEA — usage statistics for the application: which pages and features are opened and which operations are triggered, together with user identifier, role and company. For signed-in users, name and email address are transmitted as well.
• Postmark, USA — sending and receiving email, including sender details, content and attachments.
• Pronovo, Switzerland — filing of subsidy applications on the company's behalf, where it files them through us.
• Push services of the browser vendors (Google, Apple, Mozilla, Microsoft), USA — delivery of notifications to a device, where someone switches them on.
• Railway, EU/EEA — operation of our servers, background processes and website, including their logs.
• Sentry, EU/EEA — error reports. They contain IP address, device and user identifier, and may contain fragments of payload data.
• Stripe, USA — handling of the company's subscription. No data about a company's own customers is transmitted.
• Supabase, EU/EEA — database and file storage. This holds all data entered in the account, attachments included.
• Timestamping service (SwissSign or Swisscom), Switzerland — timestamps that make documents verifiable. A hash value is transmitted; no payload data.
• VSAS (Verband Schaltanlagen und Automatik Schweiz), Switzerland — calculation data for switchgear building. Search terms and article numbers are transmitted; no personal data.

Data processing agreements with appropriate safeguards are in place with all providers. Services that are only used once a connection has been set up are marked as such above.

6. International Data Transfers

Some of our service providers process data outside Switzerland or the EEA, in particular in the United States. In such cases, we ensure an adequate level of data protection through appropriate safeguards, such as standard contractual clauses or certification under the Swiss-U.S. Data Privacy Framework.

7. Retention and Deletion

We store personal data only as long as necessary for the purposes described above or as required by statutory retention obligations. Communication data processed on behalf of our customers is stored and deleted according to their instructions. After the end of the contract, data is deleted or anonymized.

8. Your Rights

You have the right to access the personal data we hold about you, to have inaccurate data corrected, to request deletion, to restrict processing, to data portability, and to object to processing. To exercise your rights, simply email privacy@kundenbox.ch. You also have the right to lodge a complaint with the competent supervisory authority — in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC).

9. Data Security

We take appropriate technical and organizational measures to protect your data against unauthorized access, loss, or misuse. These include encryption in transit, access controls, tenant-separated data storage, and regular security reviews.

10. Cookies

We use strictly necessary cookies to provide sign-in and core platform functionality (e.g. session cookies from our authentication provider). On elektro.box we additionally set Google Ads cookies to measure which visits and sign-ups came from an ad. We do not do this on kundenbox.ch, nor on the document pages a company's own customer opens from a link we sent them. You can block or delete these advertising cookies in your browser; the platform remains fully usable.

11. Changes to This Privacy Policy

We may update this privacy policy from time to time, for example when our services or the legal situation change. The version published on this page applies.

12. Contact

For any privacy-related questions, you can reach us at privacy@kundenbox.ch or by mail: Patrick Lauber, Kundenbox, Reutlenring 15, 8302 Kloten, Switzerland.