Privacy policy

The controller within the meaning of the Federal Act on Data Protection is:

Fristo — a service by Hoang Nguyen
Hohfurristrasse 24, 8408 Winterthur, Switzerland
datenschutz@fristo.ch

For customers in the EEA: we process data from Switzerland. The EU recognises that Switzerland has an adequate level of data protection.

This policy describes what we ourselves do with data: on our website and in connection with sign-in, billing and support.

The business is responsible for the data it records in Fristo — including the data of its employees and external contractors and the reports made via QR stickers. We process this data on its behalf and on its instructions (terms and conditions, § 8, and the data processing agreement). Questions about this are best addressed to the business; anything that reaches us we forward to it.

Account: name, email address, phone number (optional), role, language.

Operational data: buildings, assets, work orders, reports, inspection deadlines, documents, photos and plans, and the records that go with them — that is, what you record yourself.

Messages: messages, photos and files that people in a business write to one another are stored by us as operational data on behalf of the business. They can be read by the members of the conversation; a conversation about a work order by everyone allowed to see that work order. The business’s administrators do not read direct conversations and groups they are not members of. A deleted message loses its text and attachments immediately. In the browser, messages arrive via a Laravel Cloud service in Frankfurt; on the phone, via Apple (section “The Fristo app”). They are stored for as long as the business’s contract runs.

Reports without an account: anyone reporting a fault via a QR sticker enters a text and, optionally, a name and email address — the address so that they hear how it turns out. No account is created in the process.

Registrations without an account: external companies use a link to register their work at a business that has the Access & keys add-on module — with a contact person, the persons coming and a signature; a cleaning company confirms its work in the Cleaning add-on module via the link on its pass. The business is responsible (section “What the business is responsible for”); no account is created in the process.

Sign-in: the time of the last sign-in, the session and the sign-in codes, each with the IP address (section “Logs and IP addresses”).

Acceptance of the terms: anyone who opens an account accepts the terms and conditions and the terms of use. We record who accepted which version, when and in which language.

Contracts: if you sign a contract with us in Fristo, we record the name, position, email address, time, IP address and browser identifier as evidence.

Billing: billing address, plan, invoices and payments. We never see card details. If you choose QR invoicing, we check your company’s UID number in the public UID register of the Federal Statistical Office. We record the result, the company name according to the register and the time, and take your payment history with us (reminders) into account. We do not consult a credit agency.

Emails to us and our address book: anyone who writes to us — via the contact form or by email — is then in our address book, with name, email address and what they tell us (such as company, phone, position), together with the messages themselves. That way we find the exchange again and do not start from scratch every time.

Access requests, deletions and restrictions: we record who requested what and when, and what we did — as evidence, in a signed record.

Contact form and visits to our public pages: each in its own section below.

To run the application: calculate deadlines, assign work orders, produce records, sign you in and notify you. In addition, for billing and support, for security and to find and fix errors. Your operational data is not analysed for other purposes, and it is not sold to third parties.

Depending on the purpose:

Performance of contract (Art. 31(2)(a) FADP, Art. 6(1)(b) GDPR) — to run the application and to bill for it.

Legitimate interest (Art. 31(1) FADP, Art. 6(1)(f) GDPR) — for security, the prevention of abuse and troubleshooting, the anonymous count of page views, the spam protection in the contact form and the retention of documents required by Swiss law.

Consent (Art. 6(1)(a) GDPR) — solely for the visit statistics with an identifier. You can withdraw it at any time via “Cookie settings” at the bottom of every page; whatever was recorded until then remains lawful.

Beyond that we do nothing that would require consent: no advertising tracking, no profiles, no sharing for anyone else’s purposes. We do not make automated individual decisions.

The application and the database run on servers in Frankfurt am Main (region eu-central-1), operated through Laravel Cloud on Amazon Web Services. The daily backups are also held there.

Files — photos, documents, plans, records — are kept in storage from Cloudflare (R2), which Laravel Cloud operates for us. Its location is not restricted to the EU.

From a Swiss point of view, that is a disclosure abroad. To the states of the EEA it is permitted, because the Federal Council recognises an adequate level of data protection for them (Annex 1 of the Data Protection Ordinance). What goes to the USA, and which safeguard we rely on for it, is set out in the next section.

Some of our service providers are based in the USA and may be required by authorities there to hand over data. Our contracts with them oblige them to review such requests and to inform us, as far as the law allows. Transmission is encrypted, and we ourselves hand over data only where the law obliges us to.

We use service providers who process data on our behalf. We have concluded a data processing agreement with each of them.

– Laravel Holdings Inc. (USA) with Laravel Cloud: operation of the application, database, file storage and backups. For this, Laravel uses its own sub-processors, namely Amazon Web Services (data centres in Frankfurt) and Cloudflare (file storage and the network that forwards every request and fends off attacks; this involves processing your IP address).

– Laravel Nightwatch (also Laravel Holdings Inc.): monitoring of errors and response times. For each request, the address requested, the time, duration and result are recorded, together with a shortened IP address and the identifier of the signed-in person — not their name, not their email address and not what you enter in forms. In addition, error messages and the subject line of emails sent. The data is held in the EU and deleted after 90 days.

– cyon GmbH (Basel, Switzerland): sending our emails — sign-in codes, notifications, acknowledgements, invoices. The processing takes place in Switzerland.

– Anthropic PBC (USA): only if you use “Read from document”, room detection on the floor plan or the AI document capture module. The selected document is sent to a language model for analysis; the proposal comes back in a form that you see and can change before saving. Under the contract, Anthropic does not use the data for training and deletes inputs and outputs within 30 days — unless it has to retain them for longer because of abuse or by law. The same model may help us draft replies to your messages; in that case the text of the message is sent along.

– Stripe Payments Europe Ltd. (Ireland): card payments, as soon as you pay for a paid subscription by card. Card details go straight to Stripe; we never see or store them. Stripe itself is responsible for fraud prevention and statutory obligations and transfers data to Stripe Inc. (USA) for these purposes.

– Google LLC (USA): reCAPTCHA in the contact form (section “The contact form and its spam protection”).

– Apple (Apple Distribution International Ltd., Ireland, and Apple Inc., USA): delivery of notifications to the Fristo app. Apple bases the transfer to the USA on the European Commission’s standard contractual clauses.

PostFinance AG (Bern) retrieves incoming payments on QR invoices for us; as a bank, it processes the data under its own responsibility.

For our own communication and administration — email, office applications, accounting, dispatch — we use common services with their registered office or data centres in Switzerland and the EU. What you write to us is held there.

Data goes to Laravel, Cloudflare, Anthropic, Stripe, Google and Apple in the USA. Laravel, Cloudflare, Stripe and Google are certified under the EU-US Data Privacy Framework and its Swiss-US part; for certified companies, Switzerland and the EU recognise an adequate level of protection. With Anthropic, the European Commission’s standard contractual clauses apply in the version recognised by the Swiss Federal Data Protection and Information Commissioner (FDPIC); the same applies in addition to all the others should a certification lapse.

Beyond that, we do not pass on any data — unless we are required to do so by law.

With every request, our hosting provider and its network process your IP address in order to deliver the page and fend off attacks.

We ourselves limit sign-in attempts, reports and requests via the contact form per IP address; these counters expire after one hour at most. With a sign-in code, we store your email address and IP address and delete both after 30 days. Your session may contain your IP address and browser identifier; it ends two hours after your last request. If you sign a contract in Fristo, we record your IP address and browser identifier as evidence for as long as the contract has to be retained.

Beyond that, we do not store any IP address — not even in the contact form or for reports via a QR sticker.

As long as your account exists. After the end of the contract, your business’s data remains available read-only for a while so that you can export all of it — for at least 30 days and at most one year; we tell you the exact period upon cancellation. After that we delete it. Records you filed yourself remain readable unchanged until then.

The backups go back one month; older ones are deleted. Deleted data may remain there for that long.

Sign-in codes: 30 days. Requests from the contact form and emails to us, together with the exchange about them: two years after the last message — then we delete them automatically, and with them the entry in the address book, unless you are a customer or business partner. Visit statistics with an identifier: 14 months. Records of access requests, deletions and restrictions: ten years, as evidence.

We keep invoices and accounting documents for ten years, because the Swiss Code of Obligations requires it (Art. 958f CO). We keep signed contracts and the acceptance of the terms for as long as claims arising from them are not yet time-barred — up to ten years after the end of the contract (Art. 127 CO).

Technical and organisational measures in line with the state of the art:

Encrypted transmission (TLS) on every connection.

Sign-in without a password — by one-time code or passkey. With a passkey, your fingerprint and face stay on your device; we never receive them.

Separation of businesses at the database layer, not just in the interface.

Daily backups and logged support access.

No one can guarantee complete security. If we discover a data security breach that affects you, we inform you and — where the law requires it — the supervisory authority.

On your first visit we ask which cookies you allow. You can change your choice at any time via “Cookie settings” at the bottom of every page.

Necessary — always active, because the site does not work without them:
– fristo-session: your session and sign-in, two hours after your last request
– XSRF-TOKEN: protection against form abuse, for the same length of time
– appearance: your choice of appearance, one year; sidebar_state: whether the application’s sidebar is open, seven days
– fristo_consent: your answer to this question, one year
– fristo_reinigung: a cleaning company’s pass on the phone that opened the pass’s link, one year

Analytics — only with your consent:
– fristo_av: a random identifier by which we recognise returning visits, one year. It contains nothing about you and is read only on our public pages.

In addition, the site stores the following in your browser’s storage (not as a cookie, and without sending it to us): your reading aids, the currency chosen for prices and your cookie choice.

We set no cookies for third parties. The only exception is Google reCAPTCHA: it is loaded as soon as the section with the contact form appears on screen, and may then set its own cookies (section “The contact form and its spam protection”).

What you write in the form — name, email address, optionally business and phone, your message — we store in order to reply. We delete the request and the exchange about it automatically two years after the last message.

Against mass submissions we use Google reCAPTCHA v3. As soon as the section with the form appears on screen, your browser loads a script from Google. From then on, technical details about your device and your behaviour on the page are transmitted to Google — including to the USA — and on submission they are turned into a score saying how likely it is that you are a human. The basis is our legitimate interest in a form that stays reachable (Art. 31(1) FADP, Art. 6(1)(f) GDPR); for the transfer to the USA we rely on the EU-US Data Privacy Framework and its Swiss-US part, under which Google is certified.

Google’s privacy policy and terms of service apply in addition (policies.google.com). Of this check we store only the score, so that we can judge whether the threshold is set correctly. If the spam protection holds back your request, you can reach us by email at email@fristo.ch.

We want to know how our public pages — home page, legal pages, registration — are used, so that we can improve them. There are two levels to this.

Without consent we count anonymously: one row per day with the page, language, device type (phone or computer) and the name of the website someone came from — and a counter. No IP address, no identifier in your browser, no time of day. Nothing in it allows a visit to be traced back, not even by us.

With your consent we additionally record for each page view:
– the random identifier from the fristo_av cookie and a session identifier
– the page opened, with its address, including campaign details (utm)
– the page you came from
– browser, operating system and device type, derived from the identifier your browser sends along
– country and, where available, city — determined from the IP address by our hosting provider’s upstream network
– language, time and how quickly the page responded

We do not store your IP address (not even encrypted or shortened), your name, your email address or any link to an account. The data is held by our hosting provider in Frankfurt, is not passed on and is deleted after 14 months.

Behind the sign-in there are no visit statistics and no analysis of your behaviour. So that Fristo runs reliably, we record technical details of every request there — which page, how fast, whether an error occurred (Nightwatch, section “Who else has access”).

We keep our customers’ accounts in Fristo informed about new features, maintenance and outages, invite them to events and send greetings on holidays. Such an announcement appears among the notifications and under “News”; important ones we also send by email or as a notification to the phone (section “The Fristo app”).

For this we use what your account already contains — name, language, role and business — so that an announcement reaches the right people, in their language and addressed by name. For each person we record whether and when they opened it, whether it has already been shown to them on opening Fristo and whether it was sent to them by email: this way it counts as read and does not appear twice. Only the number is evaluated, never the individual — we see how many people opened an announcement, not who. We do not record whether you open an email.

You can unsubscribe at any time from announcements by email about events, holidays and new features — via the link in every announcement email or in Fristo under “News”. In Fristo itself they continue to appear. Exceptions are messages about outages, maintenance and fixes and personal messages about your contract: they are part of our service and still arrive after you unsubscribe.

Images in announcements are stored at a public address with a random name, the same for all recipients — otherwise your email client would not display them. They contain no data from businesses.

A language model from Anthropic can suggest and translate the text for us (section “Who else has access”). Only our own texts go there, no information about you or your business.

The basis for messages about outages, maintenance, fixes and your contract is the performance of the contract (Art. 31(2)(a) FADP, Art. 6(1)(b) GDPR); for the other announcements it is our legitimate interest in informing our customers about Fristo (Art. 31(1) FADP, Art. 6(1)(f) GDPR).

The iPhone app is another way into the same application; everything in this policy applies to it as well. In addition:

Device: when pairing, we record what the device is (“iPhone”), the versions of the app and the operating system, a name such as “Marco’s iPhone” and when it was last used. That way, you and your business can see in Fristo which devices are signed in and sign each one out individually. A device that has not been used for 90 days is signed out automatically — after 30 days for businesses with their own sign-in system.

Notifications: if you allow notifications, the app receives an identifier from Apple to which we send notifications — for example “New work order for you” with the title and location of the work order, or a new message with the sender and the beginning of the text. They are delivered via Apple’s push service. Signing out deletes the identifier on our side.

Camera and photos: the camera reads QR codes on the device; only the recognised code is transmitted. Photos that you take on a work order, a report or in a conversation, or choose from your photos, go to Fristo just like a photo uploaded in the browser.

Dictation: speech recognition runs on the device. Only the recognised text is transmitted, never the recording.

Face ID and device passcode: the check is done by the operating system. The app only learns whether it succeeded.

On the device: so that you can work without reception, the app stores your own work orders with the related buildings, assets and documents, as well as entries that have not yet been sent — protected by the operating system’s file protection. Widgets, the lock screen and the Dynamic Island show only what is already on the device. When you sign out, the app deletes all of it.

No advertising, no tracking: the app contains no advertising and no third-party analytics or tracking services.

Downloads and updates run through the App Store; Apple itself is responsible for them.

You can request information about your data and a copy of it, have it corrected, deleted or restricted, and receive it in a common electronic format so that you can pass it on (Art. 25, 28 and 32 FADP, Art. 15 to 20 GDPR).

Most of this works without us. You download the access report in your profile under “Your data” — a signed PDF to read and a JSON file to pass on; for the whole business, the administration does this under “Support and data protection”. You correct your details in your profile; the administration downloads all of the business’s data with the data export. You request deletion and restriction in the same places; we carry them out within 30 days and send you a signed record. Restricted means: your data stays stored and readable, but it is no longer changed or processed further.

What we have to keep as evidence remains even after a deletion — invoices, signed contracts and the acceptance of the terms (section “For how long”). Wherever your business refers to you in its records — work orders, feedback, compliance records —, it will then say “Ex-Mitarbeiter/in” (former employee). Training records for medical devices keep name, personnel number and signature, because the business retains them as evidence for the device (medical device log).

Without an account or with questions: datenschutz@fristo.ch. If it concerns data that a business has recorded in Fristo, the business is responsible; if you request deletion or restriction in the application, we inform it, and it can object within ten days. If that gets you nowhere, you can turn to the Swiss Federal Data Protection and Information Commissioner (edoeb.admin.ch); in the EEA, to the supervisory authority responsible for you.

Where we rely on a legitimate interest, you can object to the processing at any time — on grounds relating to your particular situation. A message to datenschutz@fristo.ch is enough. We then no longer process the data, unless there are compelling grounds for doing so that override your interests, or we need it to enforce or defend legal claims.

In everyday operation, we only see your data if you visibly grant access for a specific case. It is time-limited and logged; you can inspect the log.

Excepted is what is necessary without your approval: fixing a fault or a security incident, restoring a backup, following up an indication of abuse or fulfilling a legal obligation. We limit such access to what is necessary and record it.

We adapt this policy when the application or the legal situation changes. The date at the top shows the current version. For material changes, we inform the businesses’ administrators by email or in the application.