Privacy Policy

1. Controller

The controller responsible for processing your personal data within the meaning of the Swiss Federal Act on Data Protection (FADP) is Your Ultimate Workspace by Marco Jucker ("we", "us" or "Zytbox"), Eigerstrasse 2, 3007 Bern, Switzerland. For any data protection questions, you can reach us at hello@yuw.ch.

2. Personal data we process

We collect and process the following categories of personal data:

  • Account data: name, email address and password (stored only as a cryptographic hash)
  • Time tracking data: time entries, projects, tasks and notes you create in Zytbox
  • Contract and payment data: your subscription plan, billing details and payment status (card details are processed exclusively by our payment provider)
  • Usage data: features used, settings and timestamps
  • Technical data: IP address, browser and device type, and server log data

3. Purposes and legal bases

We process your data to perform our contract with you (providing and operating Zytbox), to process payments and manage subscriptions, to send transactional messages such as invoices, password resets and important service notices, to operate the service securely, resolve issues and improve it, and to comply with legal obligations. Where the EU General Data Protection Regulation (GDPR) applies to users in the EU or EEA, we base our processing on the performance of the contract (Art. 6(1)(b) GDPR), our legitimate interest in secure and improved operation (Art. 6(1)(f) GDPR), separately obtained consent (Art. 6(1)(a) GDPR), and legal obligations (Art. 6(1)(c) GDPR).

4. Processors and recipients

To operate Zytbox we use carefully selected service providers that process personal data only on our instructions and under data processing agreements. We do not share your data with third parties for advertising purposes. Specifically, these are:

  • Hosting and infrastructure: servers and data storage with a provider located within the EU or EEA
  • Payment processing: Stripe (Stripe Payments Europe, Ltd. and Stripe, Inc.) for the paid plans
  • Email delivery: an external provider for sending transactional emails
  • Web analytics: Vercel Web Analytics (Vercel Inc.) for cookieless, anonymous usage statistics
  • Web analytics: Google Analytics (Google Ireland Ltd.), only where you have given your consent

5. Disclosure abroad

Your personal data is generally processed on servers in Switzerland or the EEA. In connection with payment processing via Stripe, with email delivery, and with the web analytics services named above, data may be transferred to countries outside Switzerland and the EEA, in particular the United States. Where data is disclosed to a country without an adequate level of data protection, we ensure appropriate safeguards through contractual guarantees (standard contractual clauses) or other bases permitted under Art. 16 f. FADP and Art. 44 et seq. GDPR.

6. Retention period

We retain your personal data for as long as your account is active and this is necessary for the purposes described. After you delete your account, your data is deleted or anonymised within 90 days. Statutory retention obligations remain reserved, in particular the ten-year retention of invoicing and business records under Art. 958f of the Swiss Code of Obligations.

7. Data security

We take appropriate technical and organisational measures to protect your data against unauthorised access, loss or misuse. These include encrypted transmission (TLS), hashed storage of passwords and restrictive access controls.

8. Cookies

To operate the website we use strictly necessary cookies, for example for session management and authentication. These are required for the service to function. To analyse and improve our offering we use Vercel Web Analytics, which collects anonymous usage statistics without cookies and without cross-site tracking. In addition we use Google Analytics (Google Ireland Ltd.), but only with your prior consent. This sets cookies and data may be transferred to the USA. The legal basis is your consent, which you can withdraw at any time with future effect via the cookie settings in the footer. We do not use advertising cookies.

9. Your rights

Under applicable data protection law, you have in particular the following rights. To exercise them, a message to hello@yuw.ch is sufficient:

  • access to the data processed about you (Art. 25 FADP)
  • rectification of inaccurate data
  • erasure or restriction of processing
  • release or transfer of your data in a common format (data portability)
  • withdrawal of a given consent and objection to certain processing

10. Automated decisions

We do not make decisions based solely on automated processing that produce legal effects concerning you or similarly significantly affect you.

11. Changes to this privacy policy

We may update this privacy policy, for example when the service or the legal situation changes. The version published on this page is the one that applies. We will inform you of material changes by email or through a notice in the app.

12. Contact and supervisory authority

For questions, requests or to exercise your rights, you can reach us at hello@yuw.ch. You also have the right to lodge a complaint with a supervisory authority, in Switzerland with the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch).