Privacy Policy

1. Controller

The controller for the processing of personal data on our websites, for the management of accounts and subscriptions, for website previews that we create for prospective customers, and for our own communication is:

Patrick Lauber, Kundenbox, Reutlenring 15, 8302 Kloten, Switzerland

Email: privacy@kundenbox.ch

Data that a company records or receives in Kundenbox about its customers, contact persons and employees is processed by us on its behalf; the company is the controller for that data. The same applies to websites that a company has created with our website builder. Questions about this data are best addressed directly to the company; if such a request reaches us, we forward it to the company.

2. Data We Collect

Account data: when you create an account or are invited to a company, we process your name, email address, sign-in data, role and company via our authentication provider. We need these details to set up an account; Kundenbox cannot be used without them.

Subscription data: company name, billing address, chosen subscription, number of users and payments. Only our payment service provider receives card details.

Requests through our websites: if you write to us through a form or book a call, we process your details, such as name, company, email address, phone number and message, in order to answer your request.

Data a company records: customers, contact persons, objects, installations, orders, appointments, Belege, photos and measurements, as well as messages received through connected channels (email, WhatsApp, web forms), with sender details, content and attachments.

Employee data a company records: working hours, absences including illness, expenses, payroll data, AHV number and copies of identity documents and permits. Some of this is sensitive personal data.

Data of a company's customers: if someone opens, accepts or signs a Beleg that a company has sent them via a link, we record, as evidence for the company, their name, email address, signature, the consent text, a checksum of the document, the options chosen, IP address, browser, language and time.

Usage data: when you visit our websites and the application, we collect technical data such as IP address, browser type, device information, access times, pages viewed and features used, as well as error logs.

Calendar and email integrations: if a company connects a service such as an email mailbox or a calendar, we process the required access data solely to provide the respective feature.

Website previews for prospective customers: for companies that are not yet customers, we create a preview of a new website from their publicly accessible website and send the company the link. For this, we copy the texts, photos, logo and contact details from that website, such as company name, address, phone number and, where applicable, the name of the owner. We write the texts with the help of the AI services named in the list of recipients; the preview is delivered via Cloudflare. We delete the preview and its files after 30 days, or earlier on request to privacy@kundenbox.ch.

Data from other sources: we receive part of the data not from you but from the company that records you, from services it connects, from public registers and data of authorities (commercial register, Federal Register of Buildings and Dwellings, ElCom data), from public tenders and building permit publications, and from publicly accessible websites: those of companies for which we create a preview, and, for example, a firm's legal notice when the assistant looks up a billing address on behalf of a company.

We load map sections from swisstopo through our own server, and we serve fonts ourselves; your browser does not contact any third parties for this.

3. Purposes of Processing

We process personal data for the following purposes:

Providing and operating the platform and its features, including the AI-assisted features, and processing the companies' data according to their instructions.

Handling subscriptions, billing and debt collection.

Support and the handling of bug reports and requests.

Answering requests and acquiring new customers, including website previews for prospective customers.

Security and stability of our services: error monitoring, data backup and prevention of misuse.

Further development of the platform on the basis of usage statistics.

Measuring advertising performance on elektro.box and attributing registrations to campaigns.

Informing users: account notices, for example a welcome or the end of the trial period, and product news. You can unsubscribe from product news at any time via the link in every such email.

Complying with legal obligations, and enforcing and defending against claims.

We do not sell personal data, and we do not train our own AI models on the companies' data.

4. Legal Bases

Processing is based on the performance of the contract with the companies (provision, subscription, support), on legal obligations (for example the retention of business records), on our legitimate interests (security, stability, further development, ad measurement, acquiring new customers, informing users of existing companies about our own similar offerings under Art. 3 para. 1 let. o UCA) and, where required, on your consent. Where the GDPR applies, this corresponds to Art. 6(1)(b), (c), (f) and (a) GDPR. You may withdraw any consent you have given at any time with effect for the future. Data that we process on behalf of a company is processed on the legal basis on which the company relies.

5. Automated Decision-Making

We ourselves do not make any automated individual decisions within the meaning of Art. 21 FADP. On behalf of a company, however, certain processes in the platform run without human involvement for as long as the company does not switch them off: the AI creates orders from incoming requests or assigns the requests to existing orders; if details are missing, it asks the requesting person for them; if a customer replies to the email of a quote with an unambiguous acceptance, it records the quote as accepted and sends the order confirmation. The company is responsible for this. It can switch these processes off in the settings, and the persons concerned can contact it to state their point of view or to request a review by a human.

The other AI suggestions are aids; people decide what happens with them. Alerts about employees, for example on the frequency of short absences, are seen only by a company's owner and the persons responsible for HR; they do not trigger any automatic consequence.

6. Processors and Third-Party Services

We disclose personal data to the recipients listed below. We maintain this list alongside our register of processing activities under Art. 12 FADP; a new service appears here before it receives data, and we inform the companies about it as set out in the Terms. For each one we state where the service processes the data and what it receives. Most recipients are our processors. Services marked «where» receive data only if a company connects them, and then on its instructions. Google Ads, the browser vendors' push services and swisstopo process the data under their own responsibility.

• A. Steiger AG, Switzerland — matching of the subscription to the Steiger calculation data and, with the company's consent, transmission of the statistics report. The company's Steiger customer number and the article number, Verlegungsart and document type of the Steiger articles used are transmitted; no personal data.
• Anthropic, USA — AI-assisted features: classification of incoming messages, drafts of replies and quotes, reading attachments, receipts and invoices, and the assistant's answers. What is transmitted is the content each feature needs: message texts, drafts, attachments and Belege as images or PDFs, and the account data queried for that purpose. Under Anthropic's commercial terms, this content is not used to train AI models. We also use AI tools from Anthropic for support and troubleshooting; in doing so, data from the affected account may be transmitted insofar as the troubleshooting requires it.
• Attio, USA — two-way sync of customers and their contact persons with the company's CRM, where a company sets up the connection.
• bexio, Switzerland — where the company sets up the connection: synchronisation with its accounting and, if switched on, with bexio Lohn, in both directions depending on the areas chosen. Customers, suppliers and contact persons, quotes, invoices and payments, supplier invoices, articles, projects, working hours, expenses and absences, and details of the employees are transmitted; with bexio Lohn, also their master data such as AHV number, IBAN, date of birth, nationality, permit and home address.
• Clerk, USA — sign-in and management of user accounts: name, email address and sign-in data. Because the sign-in service loads on all our pages, including the Beleg pages, Clerk also receives the IP address and browser details of visitors.
• Cloudflare R2; contracting party: Cloudflare, Inc., USA; stored in the EU (Cloudflare R2's «EU» jurisdiction) — nightly backup copy of the file storage: attachments, document PDFs, receipts, signatures, contracts and logos. When a file is deleted from the file storage or replaced there, its previous copy normally stays in the backup for up to 90 days after the next nightly backup, and is then permanently deleted by the following nightly backup. As long as a file is in the file storage, its backup copy stays too. This includes the files of entries permanently deleted from the trash, because those files stay in the file storage, and files kept as evidence for an issued or completed document. Supplier invoices and receipts are the exception: deleting one also removes the file from the file storage, and its backup copy then expires within the periods given above.
• Cloudflare, USA — storage and delivery of the websites built with the website builder, including their certificates. In doing so, Cloudflare receives the IP addresses of the visitors to these websites.
• CRB (Swiss Centre for Building Rationalisation), Switzerland — licence check and delivery of the CRB standards NPK, BKP and eBKP. The company's CRB customer and licence number and an identifier of its workstation are transmitted; no personal data.
• ELDAS, Switzerland — the electrical wholesale article master. Article numbers are transmitted; no personal data.
• Federal Office of Topography swisstopo, Switzerland — turning an address into coordinates and looking up building data. The address of an Object is transmitted.
• Google Ads (gtag.js), USA — measuring advertising performance on elektro.box: which page views and sign-ups came from an ad, together with IP address, device and an advertising identifier stored in a cookie. On elektro.box only — not on kundenbox.ch, and not on the document pages a company's own customer opens.
• Google Cloud Storage; contracting party: Google Cloud EMEA Limited, Ireland; stored in Switzerland (region europe-west6, Zurich) — nightly backup copy of the file storage: attachments, document PDFs, receipts, signatures, contracts and logos. When a file is deleted from the file storage or replaced there, its previous copy normally stays in the backup for up to 90 days after the next nightly backup, and is then permanently deleted at Google within about 31 further days. As long as a file is in the file storage, its backup copy stays too. This includes the files of entries permanently deleted from the trash, because those files stay in the file storage, and files kept as evidence for an issued or completed document. Supplier invoices and receipts are the exception: deleting one also removes the file from the file storage, and its backup copy then expires within the periods given above.
• Google, USA — sending our own acquisition emails to electrical firms from Kundenbox's Google Workspace mailbox.
• Google, USA — where a company connects it: reading and sending emails in the Gmail mailbox, entering employees' appointments in Google Calendar and querying busy times, optionally through an authorisation that the administrator of the Google Workspace account grants for all employees.
• Langfuse, EU/EEA — log of AI calls with their complete inputs and outputs, including the message texts and account data that the respective feature uses.
• Linear, USA — our ticket system. When someone reports a bug or a request through the assistant, the reported text verbatim, the reporter's name and email address, the company, the page and the device are transmitted, together with a screenshot of the page and any attached files, if they are sent along.
• Meta Platforms (WhatsApp Business), USA — receiving and sending WhatsApp messages, where a company uses that channel.
• Microsoft, USA — where a company connects it: entering assigned appointments in employees' Outlook calendars (title with order number, time, address of the object, the description of the appointment and of the order, and a link into the application), also through a company connection for all employees, and querying busy times; if switched on, storing the files of orders and objects in the OneDrive of the person who sets up the connection.
• OpenRouter, USA — fallback route for the AI analysis when Anthropic does not respond. The same content is transmitted as to Anthropic. OpenRouter may forward the request to Anthropic, Amazon Web Services, Google Cloud or Microsoft Azure; the country of processing is not fixed, but as a rule it is the USA.
• Otto Fischer AG, Switzerland — handing a material order to the wholesaler, if the firm stores its own shop credentials. Article numbers, quantities and the Beleg number as the commission reference are transmitted.
• PostHog, EU/EEA — usage statistics for the application: which pages and features are opened and which operations are triggered, together with user identifier, role and company, as well as error messages from the browser. For signed-in users, name and email address are transmitted as well. The course of the visit is also captured as a session recording: page structure, mouse movement, clicks, scrolling and page changes. All text and all input is masked before transmission and images are hidden; what is transmitted is the layout of the page and how it was used, not its contents.
• Postmark, USA — sending and receiving email, including sender details, content and attachments, as well as sending our account notices and product news.
• Pronovo, Switzerland — filing of subsidy applications on the company's behalf, where it files them through us.
• Push services of the browser vendors (Google, Apple, Mozilla, Microsoft), USA — delivery of notifications to a device when someone switches them on.
• Railway, Netherlands (data centre in Amsterdam) — database and file storage, and operation of our servers, background processes and website, including their logs. This holds all data entered in the account, attachments included.
• Sentry, EU/EEA — error reports and application logs with IP address, device, browser details and user identifier; they may contain fragments of payload data. If an error occurs on our websites or in the application, a recording of the last interaction steps is also transmitted, in which all text and input is masked and images are hidden; this does not happen on the pages that a company's customers or employees open from a link sent to them (Belege, forms, personnel questionnaires, reviews), nor in embedded contact forms.
• simap.ch (Verein simap.ch), Switzerland — fetching tender documents with the firm's own simap vendor account, if it connects one. simap learns which documents the firm fetches; only that account's sign-in is transmitted, no data of the firm's customers.
• Stripe, USA — handling of the company's subscription. If a company's customer pays a Beleg with TWINT, Stripe receives the Beleg number, the amount and the address of the invoice page to which Stripe redirects after payment, as well as the payment details that the paying person enters at Stripe themselves; the money goes directly to the company's Stripe account. We do not transmit the customer's name and address.
• Timestamping service, Switzerland — timestamps that make documents verifiable, once such a service is connected. Only a checksum (hash value) of the document is then transmitted; no payload data.
• TypeSafe, USA — classification of incoming emails by the kind of message. The sender, subject, an excerpt of the text and details about the attachments are transmitted.
• VSAS (Verband Schaltanlagen und Automatik Schweiz), Switzerland — calculation data for switchgear building. Search terms and article numbers are transmitted; no personal data.

We conclude data processing agreements with our processors, as a rule the data protection terms that form part of their contracts. For services that a company connects itself, the terms it has agreed with the respective provider also apply. If a company connects its own AI application such as Claude, ChatGPT or Cursor to its account, the data queried through it reaches the provider of that application on the company's instructions.

7. International Data Transfers

The recipients and the country in which they process the data are given in the list above: Switzerland, states of the EU and the EEA, and the USA. Under Annex 1 of the Data Protection Ordinance (DPO), the states of the EU and the EEA provide an adequate level of data protection.

For recipients in the USA, we rely, depending on the recipient, on its certification under the Swiss-U.S. Data Privacy Framework, which the Federal Council has recognised as adequate, or on the standard contractual clauses of the European Commission (Implementing Decision 2021/914) with the adaptations required for Switzerland. On request, we will tell you which safeguard applies to a particular recipient.

8. Retention and Deletion

We keep personal data for as long as is necessary for the purposes stated, for as long as statutory retention obligations apply, or for as long as we need it to safeguard legitimate interests, for example as evidence.

Data that we process on behalf of a company remains stored for as long as its contract runs and until it deletes the data or instructs us to delete it. After the end of its subscription, the data remains stored in readable form for at least twelve months so that the company can view and export it; what happens after that is governed by the Terms in the section «Data After the Contract Ends». The company fulfils its statutory retention obligations itself (Art. 958f CO, as a rule ten years).

Entries removed from the trash with «Delete forever» are no longer visible afterwards, but they are not deleted: they remain stored so that the accounting and the Belege remain traceable; the exceptions are named in the entry on Google Cloud Storage above. This data is actually deleted only on the company's instruction, which it can send us at privacy@kundenbox.ch, insofar as no statutory retention obligation prevents this.

A user account that is removed is not deleted but deactivated: the name and email address are kept with the time, expense and payroll entries to which they belong.

We delete the images of identity documents and permits six months after the person's recorded leaving date; the details used for the check (type, number, expiry date) are kept. Such images that were uploaded but never submitted are deleted after 30 days.

Database backups as well as logs, error reports and usage statistics held by our service providers are overwritten or deleted in their fixed cycle; we will tell you the individual periods on request to privacy@kundenbox.ch.

9. Your Rights

You have the right to access the data stored about you, to have inaccurate data corrected, to deletion, to restriction of processing, to receive or transfer your data, and the right to object to processing. To exercise your rights, an email to privacy@kundenbox.ch is enough.

We usually answer requests within 30 days and free of charge. To make sure that we give information to the right person, we may ask for proof of identity. Where statutory retention obligations prevent deletion, we restrict the processing instead.

Where we process data on the basis of our legitimate interests, you may object to this processing at any time; to usage statistics, ad measurement and campaign attribution even without giving reasons (see «Cookies»).

If a company has recorded data about you, for example because you are its customer or are employed by it, the company is responsible for that data; please contact the company with your request. We support it in responding.

You also have the right to lodge a complaint with the competent supervisory authority — in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC).

10. Data Security

We take appropriate technical and organisational measures to protect your data against unauthorised access, loss or misuse. These include encrypted transmission, separation of data per company, role-based access rights, a nightly backup of the files in a data centre in Switzerland and continuous error monitoring.

We access a company's data only insofar as this is necessary for support, troubleshooting, operation or security of the platform, or the company asks us to. If we sign in to a company's account for this purpose, a record is kept of who it was and when. Only persons authorised by us to do so have direct access to the database.

11. Cookies

We use four kinds of cookies and similar storage in your browser (localStorage).

Strictly necessary: session cookies from our authentication provider Clerk, plus our own cookies for the chosen language, the display of the navigation and the handover of the sign-in between our domains. Sign-in and the platform's core functions do not work without them, so they cannot be switched off.

Usage statistics: PostHog stores a random identifier in your browser to link page views, the features used and the masked course of a visit (session recording, see «Processors and Third-Party Services») to one another — including visits without signing in.

Ad measurement: on elektro.box only, we set Google Ads cookies to measure which visits and sign-ups came from an ad.

Campaign attribution: if someone comes to us through a link with campaign details or from another website, we store the campaign details, the referring domain and the landing page in our own cookie for up to 90 days, without any identifier of the visiting person, in order to attribute a later registration to the campaign.

On the Beleg pages that a company's customer opens from a link sent to them, we use neither usage statistics nor ad measurement; only the strictly necessary cookies and error monitoring load there.

How to refuse usage statistics, ad measurement and campaign attribution in your browser: with the switch directly below this section; with your browser's «Global Privacy Control» or «Do Not Track» signal — if it sends either, we do not start them at all; or by blocking or deleting cookies in your browser. The switch applies per domain, so separately for kundenbox.ch and elektro.box. Regardless of this, we continue to count operations that our server carries out itself, such as an order being created or a Beleg being sent, in PostHog, together with the company and, if you triggered the operation, your user identifier. The platform remains usable if you refuse; if you also block the strictly necessary cookies, however, you can no longer sign in. Error monitoring remains active even after a refusal, because we need it for stability and security.

So that the application also works without a connection, it additionally stores a working copy of the company's data in the browser (IndexedDB) and saves interface settings in localStorage.

12. Changes to This Privacy Policy

We may amend this privacy policy as needed, for example when our services or the legal situation change. The version published on this page applies. We inform the companies of material changes in advance by email or in the application.

13. Contact

For any privacy-related questions, you can reach us at privacy@kundenbox.ch or by mail: Patrick Lauber, Kundenbox, Reutlenring 15, 8302 Kloten, Switzerland.