Privacy policy

This privacy policy explains which personal data we process when you visit veriloc.ch and have an ancillary costs statement (Nebenkostenabrechnung) checked. It is based on the Swiss Federal Act on Data Protection (FADP), in force since 1 September 2023.

What we store: name, email address, payment details (never the card number) and statistical data about the check. We need them for accounting, support and refunds.
What we do not store: your lease, your statement or the result of the check. The documents are sent encrypted to Anthropic (USA) for the analysis. The result stays in your browser.
No cookies of our own: veriloc itself sets no cookies and uses no third-party analytics or advertising services.

Controller

SEBONA Treuhand Böhner
Owner: Sebastian Böhner
Hohstrasse 1, 8302 Kloten, Switzerland
Email info@sebona.ch

Please contact us at this address with any questions about data protection.

Visiting the website

Hosting

veriloc.ch is hosted by Cloudflare (Cloudflare Pages and Functions). The database (Cloudflare D1) is set up so that the data is stored in the EU. To deliver the pages and protect them against attacks, Cloudflare processes technical data such as your IP address. We do not keep any access logs ourselves.

Statistics without cookies

We measure the use of the website with our own statistics, without cookies. We count page views by page, referring website (domain name only), language and device type, as well as the use of individual functions.

To count visitors without recognising them beyond a single day, we compute a SHA-256 hash from the IP address, the browser identifier (user agent) and a random value that changes every day (salt). The salt and the hashes are deleted at the end of the day. Only daily totals remain.

We do not use third-party analytics and show no advertising.

Cookies and browser storage

veriloc sets no cookies of its own. During a check, the page keeps the progress of the check and the result in your browser’s session storage (sessionStorage). Your browser deletes this data when you close the tab.

During payment, Stripe may set its own cookies to prevent fraud. Cloudflare may also set technically necessary cookies to protect the website. You can block or delete cookies and browser storage in your browser settings; the check and the payment may then no longer work.

Checking a statement

Order details

To order a check, you give us your name and email address. We store:

• your name, email address and chosen language
• the payment status, the amount and the fee Stripe charges us
• the payment method, for example TWINT or a card with its brand; we never receive the card number
• the times of the individual steps, for example payment and check, and the number of attempts
• statistical data about the check: number of findings, amount in question, canton, device type, referring website, and the volume and cost of the AI analysis

We need this data for accounting, to answer your questions, for refunds and for statistics about veriloc.

Your documents

Your lease, the statement and, if provided, the previous year’s statement are transmitted encrypted (TLS) and processed only in memory for the analysis. veriloc does not store them, whether in a database, as files or in logs.

For the analysis, we send the documents through an application programming interface (API) to the AI provider Anthropic. Anthropic does not use them to train models and automatically deletes inputs and outputs within 30 days. Anthropic may keep them longer where the law requires it or where its automated safety systems flag them as violating its usage policy; in the latter case for up to two years.

Result

We do not store the result, meaning the report and the letter, on our servers. It exists only in your browser’s session storage until you close the tab. Please save the report as a PDF. We cannot restore the result later.

Payment

Payments are processed by Stripe; TWINT payments also go through Stripe. Stripe receives the data needed for the payment and processes the card details. Stripe processes some of the data under its own responsibility, for example to prevent fraud. If you pay with TWINT, Apple Pay or Google Pay, the privacy terms of those providers also apply. For more information, see Stripe’s privacy policy.

Waiting list

As long as payments are not yet switched on, you can join a waiting list. For this we store your email address, the language, the page on which you signed up and the time of sign-up. We will tell you once when veriloc launches and then delete the data, at the latest 12 months after you signed up.

Disclosure abroad

We disclose personal data to the following service providers. Cloudflare and Anthropic process it on our behalf; Stripe processes it partly under its own responsibility.

Cloudflare

Cloudflare, Inc., 101 Townsend St, San Francisco, CA 94107, USA. Hosting, delivery and protection of the website, database stored in the EU. Privacy policy

Anthropic

Anthropic Ireland, Limited, 6th Floor, South Bank House, Barrow Street, Dublin 4, D04 TR29, Ireland (contracting party), and Anthropic, PBC, 548 Market St, PMB 90375, San Francisco, CA 94104, USA. Analysis of the documents. Retention periods

Stripe

Stripe Payments Europe, Limited, One Wilton Park, Wilton Place, Dublin 2, D02 FX04, Ireland. Payment processing; Stripe also processes data in the USA. Privacy policy

Cloudflare and Anthropic use data centres in several countries, so data may also be processed in other states; Cloudflare usually answers requests from a data centre near you.

According to the Federal Council, Ireland and the other EU states provide an adequate level of data protection. The same applies to recipients in the USA that are certified under the Swiss-U.S. Data Privacy Framework. In all other cases, the disclosure is based on the European Commission’s standard contractual clauses as recognised by the FDPIC for Switzerland (Art. 16 para. 2 let. d FADP).

Retention

Your documents

Not stored by veriloc. Anthropic deletes them within 30 days (for exceptions, see above).

Result

Only in your browser, until you close the tab.

Order and payment

Ten years from the end of the financial year, as this data forms part of the accounting records (Art. 958f of the Swiss Code of Obligations). The statistical data about the check is kept for the same period.

Waiting list

Until the launch notice, at most 12 months.

Statistics

Salt and hashes until the end of the day, after that only daily totals.

Security

All connections to veriloc are encrypted with TLS. We store only what we need, and your documents not at all. Only authorised persons at SEBONA Treuhand Böhner have access to the stored data.

No automated individual decisions

veriloc assesses your statement automatically. This is an assessment of documents, not a decision about you as a person that has legal consequences for you or significantly affects you (Art. 21 FADP). It is up to you what you do with the result.

Your rights

You can ask us at any time:

• whether we process personal data about you and, if so, which data (Art. 25 FADP)
• to correct inaccurate data (Art. 32 FADP)
• to delete your data, unless the law requires us to keep it
• to hand over your data in a common electronic format or to transfer it to another provider (Art. 28 FADP)

You may also object to processing. Simply write to info@sebona.ch. We may ask you to prove your identity.

If you believe that we are not processing your data correctly, you can complain to the Federal Data Protection and Information Commissioner (FDPIC).

Changes

We update this privacy policy when veriloc or the law changes. The version published on this page applies.

This privacy policy is available in German, French and English. In the event of any discrepancy, the German version prevails.