Last updated: September 2026
Privacy policy
This document describes the processing of personal data carried out within the StratBoard service, in accordance with the Swiss Federal Act on Data Protection and, where applicable, the European General Data Protection Regulation. Who acts as controller depends on who uploads the accounts. For account data — email address, name, organisation, preferred language — the controller is CIABATTI, CHE-254.984.262, Zermatt. For accounts uploaded by an accounting firm on behalf of its client, the firm is the controller and CIABATTI acts as processor, in accordance with article 12.1 of the terms and conditions.
Our principles
Minimisation: we collect only what is strictly necessary. Location: your documents are hosted in Zurich, Switzerland, and application processing runs in Frankfurt, in the European Union. Transparency: every collection is described here. Retention: your accounts, your reports and the parameters that produced them are kept for ten years, because that is how long you might have to produce them.
Data collected
Three categories must be distinguished. Account data: email address, name, organisation, preferred language. Uploaded documents: your company's financial statements and operational data, processed solely to produce your report. Technical usage data, retained in aggregated form. No advertising tracker is set.
Purposes
Delivery of the service, invoicing and accounting obligations, contractual communication. Service improvement on the basis of aggregated metrics, never on the basis of the content of your documents.
Hosting and subprocessors
Database and document storage: Supabase, region eu-central-2, Zurich, Switzerland. Application: Vercel, execution in region fra1, Frankfurt. Transactional email: European provider.
Retention
Your source documents, the reports produced and the normalisation parameters behind them are retained for ten years from the end of the financial year concerned. This period is not our choice: it is the one article 958f of the Swiss Code of Obligations imposes on accounting books and records, and a report that explains why a figure appears in your accounts is one of them. It also matches the period during which an analysis handed to a third party can be held against you. At the end of those ten years, the data is deleted. You may request early deletion, subject to your own legal retention obligations, and we will tell you what you give up by doing so.
Your rights
Access, rectification, erasure, portability, restriction and objection in accordance with the Swiss DPA and GDPR. To exercise them, write to hello@stratboard.ch. A response will be sent within thirty days. The right to erasure is subject to the legal retention obligations that apply to you.
Contact
CIABATTI, CHE-254.984.262, Zermatt. hello@stratboard.ch. For complaints, you may also contact the Federal Data Protection and Information Commissioner in Bern.