How We Handle Data Protection

Language Notice: This Privacy Policy may be provided in multiple languages. The English version is provided for convenience only. In the event of any discrepancies or inconsistencies between the translated versions and the original German version, the German version shall prevail.

You have the right to understand how the data you entrust to us is used.

In this privacy policy, we explain in clear language what data we process, why we process it, and how we handle it.

This privacy policy applies to users of the infinity.swiss platform and the products offered on it, which are developed and provided by NextBusiness AG.

For information on data processing for visitors to this website who are not logged in, please see our cookie policy for this marketing site.

Nature, purpose, and scope of data collection

Our policy is to collect personal data only for essential purposes and not to sell it to third parties for direct marketing.

Identity and access

We primarily process the personal data necessary for the operation and use of our products. This includes your name, email address, and company affiliation, which are required for a functional login.

Correspondence

We retain support requests and other correspondence, including your email address, so that we have the context of previous inquiries for reference when answering future questions. Email inquiries may be forwarded to our third-party support software, Intercom.

Payment processing

To process credit card payments for Infinity subscriptions, our billing partner, Stripe Payments Europe, Limited, processes personal data such as your name, email address, and the payment details you provide.

Stripe may also collect identifying device data for the purpose of fraud detection in card payments.

Measuring advertising effectiveness

If you discovered our products through one of our advertisements and register on infinity.swiss, we store which campaign and channel led to your sign-up so that we can track campaign effectiveness.

Uploaded data

Business data that you upload to our products is hosted by our application. As mentioned in our Terms of Service, you are solely responsible for the data you upload. Liability for data loss is excluded.

This data processing is necessary for you to use our products as intended.

Product usage

We collect general usage data regarding the use of the product. This data is used for analytical purposes in aggregated form to further develop our products, as well as for support purposes in individual cases, as it allows us to better understand the context when processing a request.

Bank connections

When you use Live Accounting, you can connect Infinity to supported bank accounts. For this feature, bank data is exchanged between the respective bank, the infrastructure operator SIX BBS AG, and infinity.swiss. This data includes the IBAN, other account details, and transactions.

For security monitoring and error analysis, we also maintain technical logs of successful and failed data exchanges between SIX BBS AG and infinity.swiss.

If you wish to terminate a bank connection, you can disconnect it in Infinity at any time. If you disconnect the connection or delete your Infinity account, we will remove the associated permissions granted in our systems.

Please note that in this case, you must also revoke authorization for Infinity through your bank.

Technical logs

We maintain technical logs for our products. These help us identify issues and ensure security, for example by detecting suspicious activity.

These logs contain information about account access and activity. For these purposes, individual logs also collect the IP address of the access, the approximate location, and details about the browser used.

Error diagnostics

When technical errors occur in our products, error details are automatically logged so that we can identify when something is not working correctly.

For this purpose, we work with the third-party provider Sentry (Functional Software, Inc. d/b/a Sentry in California), whose error diagnostic platform we use to collect and analyze this error data.

Error details include information about the features used prior to the error event and are assigned to the user via their IP or email address.

Additional services

When using certain features, trusted third-party providers may also process company data. You are always free to decide whether you wish to use these features.

When and how our team accesses this data

Master data

We may access general personal data such as your name, email address, or company affiliation, as well as basic company information, for the purposes mentioned above, e.g., to correspond with you.

Business data

In principle, our team members do not access sensitive business data without obtaining your consent.

We may ask for your consent to do so, for example, to help you with a support request or to resolve a technical issue with your account.

In individual cases, however, we cannot rule out access if it is technically necessary, arises from a legal obligation, or if we are investigating a potential violation of our terms of use.

Third-party providers we work with

We use tools and infrastructure from third-party providers we trust to offer our services.

Collected data may be processed and stored by these third-party providers so that we can provide our services.

Working with third-party providers to offer cloud software is common practice and necessary for us to provide our products.

For full transparency, we list the sub-processors we work with here:

Data storage and application infrastructure

We host our app.infinity.swiss application and the products offered on it with the following providers. Data is stored and processed on these companies' infrastructure.

• Cloudflare
  Infrastructure provider for DNS of infinity.swiss, for operating the API and attack prevention, and frontend cloud provider for static content. Cloudflare processes technical connection data (e.g., IP addresses) to ensure secure and stable operation of the application and to protect against attacks as part of providing the API. For the delivery of static content, Cloudflare processes no personal or business data apart from the IP address and similar device information. Cloudflare uses server locations worldwide depending on user location, including within the European Union and Switzerland.
• Flow Swiss
  Our primary backend hosting provider. Flow Swiss AG is located in Switzerland.
• Microsoft Azure
  Cloud infrastructure provider. The server location used is Zurich.
• MongoDB Atlas
  Server provider for hosting business data. The server location used is Zurich through Microsoft Azure.
• Ason
  Partner for payroll accounting with Infinity. Ason processes and stores payroll data. The company and its servers are located in Switzerland.

Payment processing

Payment processing is handled by professional third-party providers. We never store full credit card details on our own systems.

• Stripe
  Service provider for credit card payment processing. We work with the corporate entity Stripe Payments Europe, Limited, which is located in Ireland.

Support and customer communication

We use third-party software to respond to incoming inquiries, conduct proactive customer communication, and send notifications.

These tools process names, email addresses, browser and device information, and usage data to assist in resolving support requests.

• Intercom
  Support software for live chat in the product and customer communication. Intercom operates in Ireland and California, USA.
• Postmark
  Email provider for sending transactional emails required for service operation, such as verification, password resets, and feature notifications. Postmark operates in Illinois, USA.
• Mintlify
  Host of our product handbook. Mintlify collects and processes IP addresses and browser and device information for diagnostics and security purposes. Mintlify operates in California, USA.

Product analytics

We use analytics tools to measure feature usage and improve usability. We only collect anonymized or aggregated data with these analytics tools.

• PostHog
  Analytics tool used to understand feature usage in our products, including AI features such as Instant Fill and Live Accounting. We use servers hosted in the EU. PostHog's headquarters are in California, USA.

Logging & error analysis

We use the following logging and monitoring tools to oversee our infrastructure. These tools process usage data and technical event logs, some of which are associated with a user via an IP or email address.

• Sentry
  Error monitoring service. Functional Software, Inc. d/b/a Sentry is located in California, USA.
• Better Stack
  We use software from Better Stack for logging our services. Better Stack is located in Prague, Czech Republic.
• LogSnag
  Business event logging service. LogSnag is located in Maryland, USA.

Additional data processing agreements

• If you activate Live Accounting, the additional data processing terms for Live Accounting also apply.
• If you use the AI agent Juno, the additional data processing terms for Juno also apply.

Data storage location

We store the data for the infinity.swiss platform on Swiss servers in Zurich. The servers that process this business data are also located there.

Data stored and processed by third-party providers may potentially leave the country.

Individual servers that do not come into contact with business data, but only deliver static content (such as this marketing site or frontend clouds), are located in the European Union or, depending on the access location, elsewhere via a Content Delivery Network.

For technical reasons, it cannot be entirely ruled out that certain data may temporarily flow via international connections (e.g., when users access infinity.swiss from abroad) or that certain operational access and activities may take place outside national borders.

How we ensure data security

Data security is our top priority. We employ a variety of security and precautionary measures—both technical and structural—to protect personal and business data.

Server connections are established using industry-standard encryption. Regular data backups are performed.

However, we cannot guarantee complete security on our own – here we also rely on you to protect your own account, by keeping your access credentials secure, using two-factor authentication, and protecting your devices with current system updates and antivirus software.

Data retention & termination

We retain data for at least the duration of your use of our products.

You have the right to have your personal data deleted at any time; however, you may no longer be able to use our products afterward, as certain data is required for our services to function.

It is possible that data may temporarily remain in infrastructure backups. This data will also be removed once the backup retention period expires and the backup is deleted.

Data portability

You have the right at any time to request a collection of your personal or business data from us for archival purposes, for switching to another system, or for information purposes.

Changes

We reserve the right to make changes to this privacy policy at any time, which you accept unconditionally by continuing to use our services. You can always find the latest version on our website.

Controller

The party responsible for this privacy policy is NextBusiness AG, The Circle 60, 8058 Zurich.