YESbusiness Privacy Policy

1. Introduction

YESbusiness Sàrl, UID CHE-444.646.675, with its registered office at Reichenbachstrasse 118A, 3004 Bern, Switzerland, attaches the utmost importance to the protection and confidentiality of its users’ personal data.

This policy sets out how such data is collected, processed, retained and protected in connection with the YESbusiness website and its online platform (hereinafter “the Platform”).

2. Data controller

The controller of the data processing is:

YESbusiness Sàrl
Reichenbachstrasse 118A
3004 Bern
Switzerland
support@yesbusiness.ch

YESbusiness has not appointed a data protection officer. Any question or request relating to the processing of your personal data is handled by the data controller, at support@yesbusiness.ch (with “Data protection” in the subject line). YESbusiness undertakes to reply as soon as possible.

3. Territorial scope

YESbusiness services are intended exclusively for individuals and companies domiciled or having their registered office in Switzerland. The processing described below is subject to the revised Swiss Federal Act on Data Protection (FADP), in force since 1 September 2023.

YESbusiness also complies with the principles of the European Union’s General Data Protection Regulation (GDPR) where it applies.

4. Legal bases for processing

YESbusiness processes personal data on the following bases:

• performance of the contract concluded with the user (provision of the Platform, invoicing, support);
• compliance with legal obligations;
• the legitimate interests of YESbusiness in providing, securing and improving its services;
• the consent of the data subject, where required (AI assistant, connected AI assistants, newsletter, advertising cookies and tags on the public website).

5. Purposes of data processing

The personal data collected is processed exclusively for the following purposes:

• Management of user accounts and authentication
• Provision of the SaaS services (accounting, VAT, bank import and bank connections, partner area)
• Operation of the AI assistant, where the user has activated it
• Payment management and invoicing via Stripe
• Sending of transactional communications and customer support
• Compliance with legal and regulatory obligations
• Security of the Platform, prevention of abuse and of unlawful use
• Continuous improvement of the services (usage analytics, quality of the assistant’s answers)
• Measuring the effectiveness of advertising campaigns (which channel brings sign-ups and customers)

6. Categories of data processed

YESbusiness processes in particular the following categories of personal data:

• Identification data: surname, first name, address, e-mail, telephone number, language
• Business data: professional status, company, UID number, role and access rights
• Accounting and financial data: accounting entries, supporting documents and imported documents, imported or synchronised bank transactions, IBAN, VAT returns
• Billing data: subscription, payment history and invoices. Credit card details are entered and processed directly by Stripe and are not retained by YESbusiness
• Communication data: exchanges with support, notifications and alerts
• Conversations with the AI assistant, where it is activated (art. 9)
• Technical and usage data: IP address, connection information, browser and device, usage logs, pages viewed, interactions and session recordings (art. 8)
• Marketing attribution data: campaign parameters (utm_source, utm_medium, utm_campaign, utm_term, utm_content) and ad-click identifiers (gclid for Google, fbclid for Meta, li_fat_id for LinkedIn), linked to the person’s analytics profile (art. 8.2 and 8.4)

6.1 Third-party data entered by the user

The user enters or imports into the Platform data concerning third parties (customers, suppliers, employees, banking counterparties). For such data, the user is the data controller and YESbusiness acts as a processor, acting on the user’s instructions and solely within the scope of providing the service. It is for the user to have a sufficient legal basis for that processing and to inform the data subjects.

7. Newsletter and marketing

• When you subscribe to our newsletter or agree to receive marketing communications from us, we use your personal data (mainly your name and your e-mail address) in order to send you information about our products, services, news and special offers.
• Newsletter subscription follows a double opt-in procedure: after entering your e-mail address, you receive a confirmation e-mail containing an activation link. Your subscription only becomes effective once you have clicked that link.
• E-mails are sent using the Postmark service (art. 10).
• You may unsubscribe at any time, either via the link provided for that purpose in each e-mail, or by writing to us at support@yesbusiness.ch. Once unsubscribed, you will no longer receive commercial communications unless you voluntarily subscribe again.
• We measure the performance of our mailings (open and click rates). This data is analysed in aggregate form, without individual profiling.

8. Cookies, audience measurement and technical logs

8.1 Strictly necessary cookies

YESbusiness uses cookies that are strictly necessary for the proper operation of the Platform, in particular for managing the user session and securing access. These cookies cannot be disabled without rendering the service unusable.

8.2 Audience measurement and usage analytics (PostHog)

YESbusiness uses PostHog, hosted in the European Union, to understand how its website and its application are used. The following is collected for this purpose:

• pages viewed, clicks and interactions with the interface (automatic event capture);
• session recordings reconstructing navigation within the interface;
• technical information (browser, device, approximate country derived from the IP address);
• once the user is logged in, the linking of these events to their account by means of a user identifier;
• at sign-up, the marketing attribution data described in art. 6, stored on the person’s analytics profile (the first visit counts), to measure the cost of each channel per customer.

A cookie set on the .yesbusiness.ch domain makes it possible to connect a visit to the public website and use of the application by the same person. This cookie, copied to the browser’s local storage, is set when the page loads, without a banner. It contains the origin of the visit and the address of the first page visited; if that address carries campaign parameters or an ad-click identifier (gclid, fbclid, li_fat_id), these are in it too. When a person lands directly on the application’s sign-up page, these parameters are also kept in the browser’s local storage. Requests pass through a subdomain of yesbusiness.ch before reaching PostHog’s infrastructure.

This processing is based on the legitimate interest of YESbusiness in understanding the actual use of its service, improving its usability, detecting errors and measuring the cost of its campaigns per customer. PostHog data is never sold or used for remarketing, and YESbusiness uses neither Google Analytics nor any comparable system.

You may object to this audience measurement by writing to support@yesbusiness.ch, or by blocking these requests using your browser’s settings or extensions.

8.3 Technical logs

Cloudflare’s infrastructure and the application servers record technical logs (IP address, timestamp, request, response code, errors) for security, abuse prevention and diagnostic purposes. These logs are retained for a limited period.

8.4 Advertising campaign measurement (Google Ads, Meta, LinkedIn)

Where. YESbusiness measures the effectiveness of its advertising campaigns with tags from Google Ads, Meta and LinkedIn. These tags run only on the public website www.yesbusiness.ch. They are never loaded in the application.

Consent. The Google Ads, Meta and LinkedIn tags load only after you accept them in the consent banner. The campaign parameters and click identifier in the landing-page address are, however, already recorded by our audience measurement tool (art. 8.2), without a banner. If you refuse, nothing changes in the website or the application. You can withdraw your consent at any time through the link in the website footer.

What is collected. The tags collect each platform’s own cookies, the IP address, browser and device information, the page visited, the ad-click identifier (gclid, fbclid or li_fat_id) and the conversion event (sign-up or subscription).

How the conversion reaches the platforms. Depending on the platform, through its tag on www.yesbusiness.ch, or from YESbusiness, which sends the platform the click identifier, the browser identifier its tag set, the browser type (user agent) and the fact that a sign-up or subscription took place. In both cases YESbusiness never sends a name, email address, phone number or company data, not even in hashed form. No accounting data is sent.

Role of the platforms. Google, Meta and LinkedIn are not YESbusiness’s processors. For collection on our website, each platform and YESbusiness act as joint controllers. For what the platform then does with the data, including for its own advertising purposes, it is a controller in its own right. Their privacy policies:

• Google: https://policies.google.com/privacy
• Meta: https://www.facebook.com/privacy/policy
• LinkedIn: https://www.linkedin.com/legal/privacy-policy

Cookies (Google and LinkedIn: expected names and lifetimes, confirmed when their tags are added):

• Google: _gcl_au – about 90 days
• Meta: _fbp, _fbc – about 90 days
• YESbusiness: ybs_consent – 6 months, keeps your choice in the banner
• LinkedIn: li_sugr, bcookie, lidc – session to about 1 year

Countries. Google (Ireland / United States), Meta (Ireland / United States), LinkedIn (Ireland / United States).

9. AI assistant

9.1 Optional nature

The Platform’s AI assistant is optional and requires explicit activation by the user. The Platform remains fully usable without it.

9.2 Data transmitted

When the assistant is used, the following is transmitted to the model provider: the content of the conversation together with the company data required for the context of the request (for example balances, accounting entries, information about the company and the documents concerned). This data may include data concerning third parties entered by the user (art. 6.1).

9.3 Provider and its use of the data

The model used is Gemini from Google, via the paid offering of Google’s programming interface (Vertex AI). Under the terms applicable to that offering, Google does not use requests or responses to train or improve its models. Google logs requests and responses for a limited period, solely in order to detect breaches of its usage policy, to ensure the security of the service and to meet its legal obligations.

9.4 Place of processing

Requests sent to the assistant are processed on Google’s European infrastructure: in Switzerland, in the Zurich region, or, where the model used is not available there, in a region of the European Union. They are not transferred to the United States for the purposes of that processing.

Where processing takes place in the European Union, it is based on Google’s data processing addendum and, as far as necessary, on the European Commission’s standard contractual clauses; the member states of the European Union are moreover among the states whose legislation provides adequate protection within the meaning of Swiss law.

9.5 Retention by YESbusiness

Conversations are retained by YESbusiness in its database hosted in Switzerland. They are used:

• to improve the quality of the service and of the assistant’s answers;
• to verify that the Platform is not being used for unlawful or illegal purposes.

Where the assistant is used without an account (before registration), the IP address and the conversation are retained for 90 days for security and abuse-prevention purposes and then deleted automatically; only YESbusiness administrators have access to them.

It is recommended not to enter into the assistant sensitive personal data that is not necessary for the request.

9.6 Connected AI assistants (YESbusiness connector)

Independently of the built-in assistant described in articles 9.1 to 9.5, the user may link an AI assistant of their own choosing (for example Claude by Anthropic, ChatGPT by OpenAI or another compatible client) to the Platform through the YESbusiness connector. This connection is optional; the user sets it up themselves, after signing in to their account, on a consent screen where they choose the companies concerned, the level of rights granted (read only; preparation of entries that the user confirms themselves; autonomous entries within an amount limit the user sets) and, through a separate checkbox, whether the content of their receipts and documents may be read.

The provider of the connected assistant is chosen by the user and is not a processor acting for YESbusiness. The data the user asks their assistant for (for example balances, entries, bank transactions, VAT statements and, where authorised, the content of documents) is transmitted to it by the connector and then processed by that provider under its own terms, in its own processing locations and under its own privacy policy, on the basis of the contract between the user and that provider. The commitments of articles 9.3 and 9.4 (no training, processing in Switzerland or in the European Union) do not apply to that processing. It is for the user to check their provider’s terms, in particular with regard to data concerning third parties (art. 6.1).

YESbusiness transmits through the connector only what the assistant requests within the rights granted, and never subscription and payment data, members and invitations, or bank credentials. For each call, YESbusiness logs the tool used, the company concerned, the date and time, the outcome and, for free text, only its length. Every entry created by an assistant is marked as such and appears in the company’s AI activity list, where it can be undone. These logs are retained for security, evidence and support purposes in accordance with article 13.

The user may at any time view and revoke their connections in their account settings (“Connected apps”); signing out of all sessions also ends the connections. Revocation does not erase data already transmitted to the assistant’s provider, whose deletion is a matter for that provider.

10. Recipients and subcontractors

YESbusiness works with several technical providers in order to deliver its services. These processors may access the data strictly within the scope of their assignments. The main providers are:

• Xano (Switzerland): database, application logic and file storage
• Google Cloud (Switzerland): hosting infrastructure
• Cloudflare (United States, global network): delivery, security and execution of the web application; technical logs
• Google – Gemini (Switzerland – Zurich region, or European Union): AI assistant (art. 9)
• Google – Places API: address suggestions during data entry; the text entered in the address field is transmitted to Google for that purpose
• Stripe (Ireland / United States): card payment processing
• Postmark (United States): sending of transactional e-mails and of the newsletter
• PDF.co (United States): PDF document generation
• PostHog (European Union): audience measurement and usage analytics (art. 8.2)

Recipients that are not processors. Google Ads (Ireland / United States), Meta (Ireland / United States) and LinkedIn (Ireland / United States) receive the data described in art. 8.4 to measure our advertising campaigns. They are not our processors and also process this data for their own purposes.

YESbusiness does not sell personal data. It shares data for advertising purposes only as described in art. 8.4, and nothing else. Disclosure to authorities occurs only where a legal obligation requires it.

11. Transfers outside Switzerland

Transfers of personal data to third countries, in particular the United States, take place only subject to appropriate safeguards ensuring a level of protection that meets Swiss and European legal requirements: an adequacy decision, participation in the applicable data protection framework, or standard contractual clauses adopted by the European Commission, supplemented where necessary by additional measures. Transfers to Google, Meta and LinkedIn rely on the Swiss-US Data Privacy Framework where the company participates, and otherwise on standard contractual clauses.

YESbusiness undertakes to verify regularly that its processors comply with these requirements and to update the protective measures in line with developments in legislation and case law.

12. Security measures

YESbusiness implements appropriate technical and organisational measures to ensure the confidentiality, integrity and availability of data, in particular:

• Encryption of communications (HTTPS/TLS)
• Access to data restricted according to the principle of least privilege
• Hosting of the main data on servers located in Switzerland
• Automatic daily backups allowing data restoration
• Separation of the development, test and production environments
• Logging of critical operations and system monitoring
• Internal procedures for handling security incidents

Access to the account is protected by a password for which the user is responsible; two-factor authentication is not offered at this time.

13. Data retention period

Personal data is retained for as long as is necessary to provide the services, to comply with legal obligations and to protect the rights of YESbusiness.

At the end of a subscription or of a trial period, the company concerned is archived and its data is not deleted: it remains retained so as to allow later reactivation, in accordance with the general terms and conditions. Conversations with the AI assistant are retained in accordance with article 9.5. Marketing attribution data stays on the analytics profile as long as it exists and is deleted with it on request. The lifetimes of advertising cookies are given in art. 8.4.

The user may at any time request the definitive deletion of their data by writing to support@yesbusiness.ch. Such a request is acted upon subject to statutory retention obligations, to the data required for invoicing and evidence, and to technical backups, which are overwritten automatically within a limited period.

Statutory retention obligations relating to the user’s own accounting, in particular the ten-year period under art. 958f CO, are incumbent on the user and are not assumed by YESbusiness.

14. Rights of data subjects

In accordance with the FADP and, where applicable, the GDPR, every user has the following rights in respect of their personal data:

• Right of access: to obtain confirmation that YESbusiness processes their data, and to request a copy of it
• Right to rectification: to have inaccurate or incomplete data corrected
• Right to erasure: to request the deletion of their data, subject to legal obligations
• Right to restriction of processing: to object to certain processing or to limit its scope
• Right to data portability: to receive their data in a structured and readable format, in order to transmit it to another provider
• Right to object: to refuse the processing of their data for marketing or audience measurement purposes
• Right to withdraw consent at any time, in particular for the AI assistant, connected AI assistants, the newsletter and the advertising tags (through the footer link on the website), without affecting the lawfulness of processing carried out before the withdrawal

The Platform does not currently offer a self-service function for a global export or for deleting the account. These rights are exercised by e-mail to support@yesbusiness.ch; YESbusiness undertakes to reply within a reasonable period in accordance with the applicable regulations.

Every data subject also has the right to contact the Federal Data Protection and Information Commissioner (FDPIC).

15. Profiling and automated decisions

YESbusiness does not take decisions based exclusively on automated processing that produce legal effects or significantly affect the user.

The AI assistant’s answers are non-binding suggestions, which the user verifies and validates themselves; they do not constitute an automated decision. Usage analytics and attribution data (art. 8.2 and 8.4) measure channels and campaigns; they are not used to target or evaluate an individual. The advertising platforms may use what their tags collect for their own advertising, under their own policies (art. 8.4).

16. Handling of personal data breaches

In the event of a confirmed personal data breach, YESbusiness undertakes to:

• Assess the nature and seriousness of the breach promptly
• Take all corrective measures necessary to limit the impact
• Inform, where necessary, the competent authorities in accordance with the legal obligations in force
• Notify the data subjects where the breach is likely to result in a high risk to their rights and freedoms

YESbusiness keeps a register of security incidents and operates an incident response plan.

17. Amendments to the privacy policy

YESbusiness reserves the right to amend this policy at any time. Any amendment will be communicated to users via the Platform or by e-mail, taking effect at the earliest 30 days after notification.

18. Contact

For any question or request relating to data protection, please contact: support@yesbusiness.ch