Last updated: October 29, 2026
The purpose of this policy is to inform data subjects about the processing of personal data carried out by ark.swiss sàrl, in accordance with Article 19 of the Swiss Federal Act on Data Protection (FADP, revised and in force since 1 September 2023) and Article 13 of the General Data Protection Regulation (GDPR).
1. Data controller
ark.swiss sàrl
Chemin de la Duchesne 13, 1806 St-Légier, canton de Vaud, Suisse
General email: info@arkflow.ch
Data protection email: privacy@ark.swiss
2. Data subjects and data collected
- Visitors to arkflow.ch: technical server logs (truncated IP, user agent, page visited, date and duration).
- Prospects (signup form): first name, last name, email, optional phone number, organisation name, desired subdomain, chosen product and plan.
- Customers: login credentials, preferences, billing history, support correspondence.
- Customer accounting and fiduciary data (third-party data): bookkeeping entries, supporting documents, contact and client data, processed on behalf of the Customer, which is the data controller; ark.swiss sàrl acts as data processor.
3. Purposes of processing
- Performance of the subscription contract and provision of the Service (Compta, Fiduciaire).
- Billing and collection.
- Technical support and transactional communication.
- Security, fraud prevention and Service integrity.
- Service improvement on the basis of aggregated statistics.
- Compliance with legal obligations (accounting, tax, AMLA where applicable for fiduciary clients).
4. Legal basis
- Performance of the contract (Art. 6 §1 lit. b GDPR; Art. 31 §2 lit. a FADP) — account, billing, support data.
- Legal obligation (Art. 6 §1 lit. c GDPR; Art. 958f CO) — accounting retention of invoices for 10 years.
- Legitimate interest (Art. 6 §1 lit. f GDPR; Art. 31 §1 FADP) — Service security, abuse prevention, aggregated product improvement.
- Performance of the contract and legitimate interest (Art. 6 §1 lit. b and f GDPR; Art. 31 §1 and §2 lit. a FADP) — AI features built into the Service, described in this policy and can be disabled on request.
- Consent (Art. 6 §1 lit. a GDPR; Art. 31 §1 FADP) — non-strictly contractual communications.
5. Recipients and subprocessors
| Subprocessor | Location | Purpose |
|---|---|---|
| netcup GmbH | Karlsruhe, Germany; server in Vienna, Austria (EU) | Application production and database for ark.flow Compta |
| Infomaniak Network SA | Geneva, Switzerland | ark.flow Fiduciaire production, hot standby for ark.flow Compta, transactional SMTP and Swiss-hosted AI models (can be disabled on request) |
| Stripe Payments Europe Ltd. | Dublin, Ireland (EU) | Card payment processing |
| Cloudflare, Inc. | San Francisco, USA | CDN, DNS, network protection (SCCs + adequacy) |
| Anthropic, OpenAI, Google (Gemini API) | United States | AI models for accounting categorisation, document reading and assistance (can be disabled on request) |
| OpenRouter | United States | Routing to third-party AI models, when configured (can be disabled on request) |
| Umami (self-hosted by ark.swiss sàrl) | European Union | Cookieless analytics |
ark.swiss sàrl does not use any third-party commercial behavioural analytics service (no Google Analytics, no Meta Pixel, no LinkedIn Insight, no Hotjar, no Intercom). AI providers are used under their API terms, which in principle exclude training on the data sent. AI features can be disabled on request.
6. International transfers
Our application infrastructure, its business continuity and its backups are hosted exclusively in Europe. ark.flow Compta production is operated by netcup GmbH on a server in Vienna (Austria, European Union), with a hot standby site at Infomaniak Network SA in Geneva. ark.flow Fiduciaire runs in production at Infomaniak Network SA in Geneva (Switzerland). Historical Borg backups are kept on ark.swiss-owned infrastructure in Switzerland. Data strictly necessary for payment processing transits through Stripe Payments Europe Ltd. (Ireland, European Union) under applicable adequacy decisions. When AI features are used, the required excerpts are sent to the configured provider: with Infomaniak, processing takes place in Switzerland; with Anthropic, OpenAI, Google (Gemini API) or OpenRouter, it may take place in the United States. Transfers to the United States (Cloudflare) are governed by the EU-U.S. Data Privacy Framework and, subsidiarily, by the European Commission's standard contractual clauses.
7. Retention periods
- Account data: duration of the subscription + 30 days after termination.
- Customer Content: duration of the subscription + 30 days (export window).
- Invoices and accounting records: 10 years (Art. 958f CO). This statutory obligation prevails over the right to erasure.
- Centralised technical logs: 14 days.
- Prospect data: 24 months maximum after last contact.
8. Security
Technical and organisational measures include: HTTPS connections through Cloudflare with HSTS, encryption at rest for credentials and tokens in AES-256-GCM, a dedicated database per Instance, daily encrypted Borg backups with integrity checks, logging of sensitive actions in the application, Trivy and Semgrep security scans on every build. Details are on the Security page and in the DPA.
9. Data subject rights
In accordance with Art. 25 et seq. FADP and Art. 15 to 22 GDPR, you have the following rights:
- Right of access (Art. 25 FADP / Art. 15 GDPR).
- Right to rectification (Art. 32 FADP / Art. 16 GDPR).
- Right to erasure (Art. 32 FADP / Art. 17 GDPR), subject to the 10-year statutory retention for invoices.
- Right to portability (Art. 28 FADP / Art. 20 GDPR) — JSON/CSV export and native Crésus export for ark.flow Compta.
- Right to object (Art. 30 FADP / Art. 21 GDPR).
- Right to withdraw consent at any time (Art. 30 FADP / Art. 7 §3 GDPR).
To exercise these rights, write to privacy@ark.swiss. A response is provided within a maximum of 30 days. Identity verification may be requested in case of reasonable doubt.
10. Automated decisions and profiling
ark.swiss sàrl does not make any automated individual decisions producing legal effects within the meaning of Art. 21 FADP and Art. 22 GDPR. Accounting categorisation suggestions produced by AI models are reviewed by the Customer or its accountant before import; no entry is recorded without that confirmation, and suggestions below 95 % confidence stay in draft until validated.
11. Cookies
Cookies and trackers are described in the Cookie Policy.
12. Data breaches
If a data security breach is likely to result in a high risk to the personality or fundamental rights of the data subjects, ark.swiss sàrl reports it to the Federal Data Protection and Information Commissioner (FDPIC) as soon as possible (Art. 24 FADP). Where the GDPR applies, the competent supervisory authority is notified within 72 hours of becoming aware, unless the breach is unlikely to result in a risk (Art. 33 GDPR). Data subjects are informed where the law requires it (Art. 24 §4 FADP, Art. 34 GDPR).
13. Supervisory authority
You have the right to lodge a complaint with a supervisory authority:
- Switzerland — Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch.
- European Union — supervisory authority of your country of residence (e.g. CNIL in France).
14. Data protection contact
ark.swiss sàrl is not legally required to appoint a Data Protection Officer (DPO). Requests are handled by a dedicated contact point: privacy@ark.swiss.
For B2B customers (fiduciaries, firms, companies subject to GDPR/FADP), a formal Data Processing Agreement (DPA), compliant with Art. 28 GDPR and Art. 9 FADP, is available and automatically accepted upon subscription. A PDF version signed by both parties can be provided upon request at privacy@ark.swiss.
15. Changes
This policy may be amended. Any material amendment is notified by email and an archived version remains available on request.
In case of discrepancy between language versions, the French version prevails.