Privacy policy

Shabija Leart is responsible for processing relating to the website, accounts, subscriptions and Zentra assistance. For data entrusted to remote services by a company, that company remains the controller; Zentra acts on its behalf according to the data processing addendum.

This policy concerns visitors, account holders, collaborators and people whose data is entrusted to Zentra. The Swiss Federal Act on Data Protection (nFADP) applies. Where the EU General Data Protection Regulation (GDPR) applies, in particular for people located in the Union, its rights and safeguards also apply; other mandatory provisions remain reserved.

To create and secure access, we process email addresses, display names, account and company identifiers, roles, invitations and authorised devices. Passwords are handled by Supabase Auth; they are not retained in plain text in Zentra’s business database. Website tokens use HttpOnly cookies. The date and version of accepted terms are recorded to document the contractual relationship.

Stripe processes payment and billing information. Zentra receives customer and subscription references, plan, due dates, payment statuses and billing details. Zentra does not store the full credit card number. Exchanges sent to support are used to handle and follow up your request.

The Solo, Team and Pro plans are billed monthly or yearly through Stripe. To apply the plan’s volume, Zentra counts the analyses the company uses each month; this counter does not contain the analysed text.

Data comes from you, the administrator inviting you, your device or connection and payment services. It is used to provide the service, manage the contract, ensure security and meet evidence obligations. A required field is necessary for the requested feature; without it, the feature cannot be provided.

Zentra Support is a separate service from the local assistant. When you connect your support tool or Infomaniak mailbox, ticket text and subjects are retained in your company’s space on D1, along with decisions, assignments and processing events. Credentials for tools and the analysis service are encrypted on the server. Attachments remain in your tool unless an administrator explicitly links Support to a Gestion company. For this invoice intake, PDF, PNG and JPEG supporting documents are retained in a private R2 space, with their checksums and extracted information in D1. Necessary text excerpts and candidate values are sent to the analysis engine (Anthropic, or TypeSafe as a fallback) for categorisation and pre-filling. Images and PDFs without text still require manual review. This data is accessible to authorised members of the linked Gestion company only. Pausing this link stops new imports; it does not delete supporting documents already received. Contact info@zentraapp.ch to export them or request their deletion, taking your accounting obligations into account. For Infomaniak, the dedicated key is encrypted; new inbox messages are retrieved periodically and categorised in Zentra Support without changing folders or messages at Infomaniak.

A Gmail, Microsoft 365 or Outlook.com mailbox, or another IMAP server, can also be connected, through an OAuth authorisation or, where the provider allows it, an app password. Tokens and passwords are encrypted on the server. Zentra periodically fetches newly received messages and processes them as described above. The replies you approve are sent from that mailbox. Each analysed message counts towards your plan’s analysis volume.

Before each analysis, Zentra removes e-mail addresses (only the domain remains), phone, IBAN, AHV and card numbers, as well as recognised passwords, keys and tokens from the text. Links are reduced to the site name. This filtering reduces the data transmitted without guaranteeing complete anonymisation of free text.

The filtered ticket text is sent to the analysis engine (Anthropic, or TypeSafe as a fallback) to suggest a category and a priority, estimate the language and expressed dissatisfaction, and detect an explicit request for human intervention. In automatic mode, a decision above your threshold is applied in the connected tool; ambiguous cases remain to be validated. Administrators choose the destinations and authorised members. Only send the data needed to handle the request. Contact info@zentraapp.ch to request an export or deletion of your Support space; disconnecting a tool stops new processing but keeps its history.

Access to the analysis service is provided by Zentra; customers do not need an account with this provider. This service does not guarantee exclusively Swiss hosting. The confidence score does not guarantee accuracy, and displayed time savings are estimates.

Zentra Autopilote is included in the Solo, Team and Pro plans. It is enabled per company in the settings, with a separate consent for online processing. It reads the e-mails received in Zentra Support and the documents dropped in to prepare work in Zentra: draft quote, supplier invoice to check, appointment, accepted or declined quote, announced payment, contact details to update or reminder. It can also suggest a category for a bank transaction, a supplier or a project, or recognise the columns of an imported file.

Before sending, Zentra removes recognised e-mail addresses, IBANs, AHV and card numbers, links, passwords, keys and tokens, without guaranteeing that free text is fully anonymised. The filtered excerpts and the possible choices are sent to Anthropic’s Claude model, used first, or to TypeSafe as a fallback. The model only answers closed questions (a choice, a score, yes or no): it has no access to the database and writes no data. Prices, items, amounts and checks come from Zentra, never from the model. Some recognitions, such as an announced payment or an accepted quote, are made by fixed rules without calling the model.

Each proposal is a card that you approve in one click and can undo from the log. Nothing is sent, issued, paid or posted on your behalf unless an administrator enables an explicit rule or automatic approval. These options are off by default and limited to exact, reversible cases, for example an SMS reminder the day before an appointment.

The proposal, the choices, the confidence, the checks performed, the company and user references, the latency and your feedback are kept in D1 for traceability, as long as the company uses the feature or until it asks for deletion. This log does not keep the full analysed text. Online processing can be turned off or paused without blocking manual operations. The details are set out in the Zentra Autopilote terms.

Customers, suppliers, quotes, invoices, employees, payroll, projects, time, banking, entries and settings are kept in the application’s local database. Connecting does not systematically transmit this entire database to the publisher. The remote features described below have their own scope.

Protect the device, its access and backups. Uninstalling the application or deleting its files does not constitute a request to delete hosted copies.

Files imported from bexio, WinBIZ, Crésus, Banana, AbaNinja, Swiss21, Excel or CSV are read on the device, with a preview, a history and the option to undo. The bookkeeping export for the fiduciary (Banana, Crésus, Abacus, WinBIZ or CSV), the consolidation and the “Export everything” function create their files on the device. These files are not sent to Zentra. Only Autopilote’s help in recognising the columns of a file sends the column titles and the necessary excerpts, filtered as described above.

The file status for your fiduciary is off by default. If the company turns it on in the app, the app publishes a summary computed on the device: number of missing receipts and unreconciled bank transactions, last VAT period filed and last closing, with no amounts and no document content. This summary is kept in D1, visible to the company’s members in their account, and replaced at each publication. Stopping the sharing deletes it.

• Company profile: the account holder or an administrator shares the name, contact details and activity from settings. Supabase retains this profile, accessible to authorised devices. This sharing alone does not transmit bank details, payroll or entries.
• Project files: on a device connected to the company, added plans, photos and files are sent with project references, the file name, type, size and hash. Authorised devices in the same company download them and keep an offline copy. Pending operations resume when the network returns or the app reopens. Deletion is shared; its record prevents an old copy from uploading the file again.
• Invoice archiving: the PDF is transmitted only on an archiving request, with its number, dates, hash and history.
• Complete remote backup: the account holder or an administrator can transmit the database and attachments, including payroll. The daily copy must be explicitly enabled and requires an open, connected application. Connection secrets and the device licence are excluded. Restoration replaces the database after confirmation and creation of a local safety copy; it does not merge two databases.
• Second copy of the legal archive: at the company’s request, the app encrypts each yearly legal archive with a recovery key that only the company holds, then sends it in blocks to a dedicated area of Cloudflare R2. Zentra receives neither the key nor readable content: only the encrypted file, its name, the year, its fingerprints and the key’s fingerprint. Without the recovery key, nobody at Zentra can read this copy. Its physical location is not guaranteed to be in Switzerland.

When the company shares a quote or an invoice by link, the published document (number, title, client name, dates, lines, totals, status and PDF) is kept in D1 and R2. The link is personal and stops working 90 days after the last publication. The person who receives the link can view the document and accept or decline a quote; their decision and its date are recorded and passed on to the company.

If the company offers online booking, the app publishes only the start and length of free slots, never the content of the calendar. A client who picks a slot leaves their name, phone number and a message; this request is kept in D1 and passed to the company’s app, which accepts or declines it.

If the company asks for a deposit, the app creates the payment link on the company’s own Payrexx account. Payment by TWINT or card takes place at Payrexx, under its terms; Zentra only publishes the amount and the link. To limit abuse and document a decision, Zentra keeps a one-way fingerprint of the IP address and browser, never the IP address itself. The portal sets no cookies.

The owner or an administrator can create API keys for their company, for reading or for submitting drafts. The token is shown only once; Zentra keeps only a fingerprint of it, with its name, prefix, scope and last use. As long as a key or a webhook exists, the app publishes in D1 a read copy of your clients, items, quotes, orders, invoices and payments: client contact details, lines, amounts and statuses computed by the app. Payroll, accounting and attachments are not part of it.

Any tool holding a key can read this data through the API or through the Zentra MCP server, for example an AI assistant you connect to it. That tool receives the data it requests and falls under your own contract with its provider. A drafts key only drops a client, quote or order as a draft into the app’s inbox: nothing enters your books without approval in Zentra. Received drafts are kept in D1 with their status.

Webhooks send the selected events (client, quote, order, invoice, payment, draft imported or rejected) with their data to the https address you choose, signed with a secret encrypted on the server. Zentra keeps the status of each delivery and makes up to 8 attempts. Revoking the last key and deleting the webhooks stops publication; the copy already published is kept until you ask for its deletion.

If the company connects a shop, the shop sends its orders, payments and cancellations to Zentra through signed webhooks. Zentra checks the signature with the connection’s secret, encrypted on the server, discards duplicates and drops each event into the app’s inbox: order number, client (name, e-mail, phone, addresses), lines, shipping, amounts and payment method. These items are kept in D1. The app finds or creates the client and prepares a draft order that you approve. The shop and its payments remain governed by your contracts with Shopify, WooCommerce and your payment providers.

Sending by post uses the company’s own Pingen account, saved in its Zentra account; its secret is encrypted on the server. When you confirm a mailing, the app sends the invoice PDF to Zentra, which hands it straight to Pingen for printing and dispatch. Zentra does not keep this PDF: it keeps the document number, its fingerprint, the delivery option, the quoted price and the letter’s status. Pingen processes the letter and the recipient’s address under its own terms and bills the mailing to the company.

If the company connects its Infomaniak mailbox to Zentra, the quotes, invoices and receipt requests sent from the app go through the Zentra server and then through that mailbox. Its key is encrypted on the server. Zentra keeps the recipient, the subject, the delivery status and the attachment’s fingerprint, without keeping the PDF or the message text. Without this connection, the app sends through the mail account set up on the device.

• SMS: off until the company has saved its own ASPSMS, Swisscom Enterprise SMS or compatible service account. The app sends the recipient’s number, the sender and the text directly to the provider; the key stays encrypted on the device and is not sent to Zentra. Each message is logged in the company’s database. The provider bills the SMS to the company. The company makes sure its clients agree to be contacted by SMS.
• Google review requests: Zentra sends no data to Google. The app prepares an e-mail or an SMS with the link to your review page, at most one request per client and per chosen period. What the client then publishes falls under Google’s terms.
• Job site map: the map tiles come from OpenStreetMap, which receives the device’s IP address and the areas displayed. An address is looked up only when you click, with the Swiss Confederation’s geodata service (geo.admin.ch). The positions found stay on the device.
• Dictation: speech recognition is that of the device or the keyboard. Depending on the system, it may be processed by its publisher, for example Apple, Google or Microsoft. Zentra does not receive the recording; the resulting text is read on the device, without AI, to prepare a draft report or quote.

TWINT and card payment links for invoices, deposits and the till are created by the app on the company’s own Payrexx account. The client pays at Payrexx; the app reads back the payment status to suggest the reconciliation.

The checks before paying suppliers (changed IBAN, supplier never paid, possible duplicate, unusual amount) and the double approval are computed on the device, from your invoices and payment orders. They are not sent to an analysis service. Each confirmation, approval or receipt request is written to the company’s audit log with the person who made it.

If you turn on the morning summary, the app sends Zentra the number of items to handle and at most eight short lines, which may name a client or an amount. Zentra e-mails them to your account address from a zentraapp.ch address. On a phone, a notification that only gives the number of items goes through Apple’s service (APNs) or Google’s (Firebase Cloud Messaging), which receives the device’s notification identifier. The summary can be turned off at any time.

• Supabase: authentication, company profile and, if continuous sharing is enabled from version 1.67, complete private revisions of the database and attachments. The main project is configured in Zurich, Switzerland (eu-central-2). Support functions and some subprocessors may operate from other countries.
• Cloudflare: hosting of the site, the APIs, the MCP server and webhooks (Cloudflare Workers), traffic protection, D1 database (accounts, subscriptions, Support spaces, Autopilote proposals, client portal, API read copy, integrations inbox, technical incident log) and R2 storage (project files, portal PDFs, archives, encrypted copies of the legal archive and backups). Exclusive location in Switzerland is not guaranteed.
• Anthropic: Claude model used first to read Zentra Support messages and the e-mails, documents and requests handled by Zentra Autopilote, only on the filtered excerpts. Under its commercial terms, data sent through its API is not used to train its models. Processing may take place in the United States.
• TypeSafe: fallback classification engine for Zentra Support and, after activation and consent, for Zentra Autopilote, used if Anthropic is unavailable. Only the necessary excerpts and choices are sent for Autopilote. Processing may take place outside Switzerland; see the terms of the activated service.
• Stripe: payment, billing, subscriptions and fraud prevention; international processing depending on the service used.
• Infomaniak: domain and contact mailbox info@zentraapp.ch, hosted in Switzerland. The correspondent’s provider also participates in delivering their messages.
• Sign-in emails: transport configured in Supabase Auth, separate from the Infomaniak support mailbox. It depends on the active SMTP service.
• Notifications: the morning summary is sent by the SMTP service configured for the zentraapp.ch sending address; on a phone, Apple (APNs) and Google (Firebase Cloud Messaging) deliver the notification.

Operations may take place in Switzerland, the European Economic Area and the United States, among other locations, as well as in the countries of the subprocessors published by the providers. Zurich and the .ch domain do not guarantee the location of the entire service. For a location requirement or the safeguards applicable to a transfer, contact us before entrusting the data concerned.

Provider information: Supabase, Anthropic, Cloudflare, Stripe and Infomaniak. Locations and safeguards must be reviewed for each service; this policy does not certify providers.

Pingen, Payrexx, ASPSMS, Swisscom, Shopify, WooCommerce, your mail provider (Infomaniak, Google, Microsoft or other) and the tools you connect to the API or the MCP server are used with your company’s own account. They act under your contract with them and not as Zentra’s subprocessors, even when Zentra passes a document to them at your request. Their price, processing locations and terms fall under that contract. Before turning them on, check that they suit the data concerned.

• Local data: retained on devices and in backups until deletion by the company, subject to its obligations.
• Account, roles and licence: necessary during the service relationship. A closure request determines which data to delete and which to retain for a legal obligation or dispute. Revoking access does not delete all security history.
• Project files: retained until deletion by an authorised person; deletion records and offline or backed-up copies must also be considered.
• Remote backups: retained until deletion by an administrator, within the limits of 50 copies, 10 GB per company and 512 MB per copy. Old copies are not all automatically deleted every day.
• Archived PDFs: deadline calculated ten years after the end of the financial year concerned. A correction creates a new version. The interface does not offer early deletion. The deadline is not proof that an automatic purge has been performed.
• Second copy of the legal archive: kept for the legal period; no function deletes it before the end of that period.
• Client portal: links stop working 90 days after the last publication. Published documents, decisions and booking requests remain kept for traceability until the company asks for deletion.
• API and integrations: the read copy, received drafts, shop orders, the status of webhooks and that of letters are kept as long as the company uses these functions, then until it asks for deletion.
• File status for the fiduciary: replaced at each publication and deleted when sharing is stopped.
• Cookies and attempts: view the technical retention periods. Expired payment attempts and abuse prevention counters are cleared during new operations; expiry does not mean immediate deletion from the server.

Support exchanges are retained during handling and necessary follow-up. The publisher’s own billing follows its accounting obligations. On request, we specify retained categories, their reasons and retention criteria. Deletion does not mean instant erasure of all technical backups.

The optional model runs on the device. Downloading it requires a connection to model and component distributors, which receive the corresponding network information. Documents and questions processed by this local feature are not transmitted to a remote AI service. Its extractions and suggestions must be checked. It does not independently decide on hiring, dismissal or an employee’s rights.

Zentra uses HTTPS, company membership checks, roles, revocable devices and integrity checks. Server errors are recorded in a limited technical log (operation, code and reference), without message content or client data, and kept for 30 days. Apart from the second copy of the legal archive, remote storage is not end-to-end encryption whose key only the client holds. Limit the access you grant, install updates and avoid sending complete files to support. No measure guarantees that no incident will ever occur.

From version 1.66, the account holder or an administrator can explicitly share a complete copy of the company with its authorised members. This copy includes customers, quotes, invoices, projects, accounting, payroll and attachments. Every download requires an authorised device session. Other historical backups remain restricted to the account holder and administrators.

The version 1.66 copy initialises an empty device. From version 1.67, the account holder or an administrator can enable continuous sharing of the entire database with Supabase. Revisions include documents, the logo, settings and payroll; each authorised member can receive them according to their role. The creator of new quotes and invoices is identified by their account or, failing that, their device. The ten most recent completed revisions are retained for transport, along with unfinished uploads. Concurrent changes require an explicit choice with a local backup; unsent changes must be reapplied manually. Connection secrets and the licence remain specific to each device. A reset removes the workspace from the device concerned and retains a local safety backup. It does not delete online data or other members’ copies. Revoking access blocks subsequent downloads without remotely erasing documents already received.

You may request information about your data, its correction or deletion under the applicable legal conditions, and its return or transfer where this right applies. You may withdraw consent for the future where processing relies on it. A retention obligation or the rights of others may limit a request; the reason will be explained to you.

Write to info@zentraapp.ch specifying the request and the account or company concerned. We verify your identity proportionately. Do not send an identity document, password or payroll file unsolicited. For employer data, also contact the company responsible for its use.

Export, backup and access management features remain available according to your permissions. Account deletion is requested through support and remains separate from cancellation. If you encounter difficulties, you can contact the Federal Data Protection and Information Commissioner.

The version appears at the top of the page. A significant change to the purposes, data or services concerned must be brought to your attention before implementation. Cookies are covered on a separate page; no advertising consent is required to create an account.