Privacy policy

1Controller

LEC Group Sàrl, Chemin de l’Etang 5, 2812 Movelier, Switzerland, is the controller for the processing described here. For any question about your data, write to us via the contact form, choosing the topic “Data protection”.

2The data we process

• Your account: name, e-mail address, password (stored with irreversible encryption, never in plain text), language and display preferences.
• Your company: company name, address, VAT number, IBAN, logo and invoicing settings.
• Your documents: customers, items, quotes, invoices, reminders and payments that you enter.
• Your receipts: files and photos you upload, and the values extracted by the automatic analysis.
• Yoda Bill billing: number of invoices issued per month and history of charges. Payment details (card or TWINT) are entered with our payment provider: Yoda Bill never sees your full card number.
• Technical data: IP address, date and time of requests, browser type, error logs, needed for the operation and security of the service.
• Your messages: name, e-mail address and content of messages sent via the contact form.

3Why we process it

• Providing the service: creating, sending and storing your documents, analysing your receipts, sharing a financial year with your accountant when you ask.
• Charging for the use of Yoda Bill according to the published pricing.
• Ensuring security: authentication, abuse prevention, backups, error diagnosis.
• Replying to your messages and informing you of significant changes to the service.
• Meeting our legal obligations, in particular accounting obligations.

We do not sell your data or use it for advertising.

4Your customers’ data

Your customers’ details and the content of your documents are processed on your behalf: you remain responsible for them, and Yoda Bill acts as a processor. We only use them to provide you with the service.

The rules of this processing (data processing agreement within the meaning of art. 9 FADP) are set out in section 7 “Your customers’ data” of the terms of use.

5Processors and recipients

We use the following providers, bound by contract and required to keep data confidential:

• Hosting: the application and the database run in a data centre in Switzerland, where your data is stored.
• Anthropic (Anthropic Ireland Limited, Dublin): automatic reading of the receipts you upload, by the Claude artificial intelligence model. Receipts are read in the United States. Anthropic does not use them to train its models and deletes them within 30 days (longer only if abuse is suspected or the law requires it).
• Stripe (Stripe Payments Europe, Limited, Dublin): payment processing (card or TWINT) for the use of Yoda Bill.
• Infomaniak (Infomaniak Network SA, Geneva): sending of e-mails (invoices, reminders, account messages), from Switzerland.
• Google (Google Ireland Limited, Dublin): measuring visits to the website and the application, and how well our ads work (Google Tag Manager, Google Analytics and Google Ads), only if you accept. Google receives the address and title of the pages viewed (a title may contain the name of one of your contacts or the number of a document), never the content of your documents.

Your documents are only passed on to third parties when you decide: sending an invoice to a customer, a share link given to your accountant.

6Disclosure abroad

When a provider processes data outside Switzerland, we ensure that the country offers adequate protection or that appropriate safeguards are in place, for example standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC).

Anthropic reads your receipts in the United States, under the standard contractual clauses of the European Commission supplemented for Switzerland, which are part of its data processing agreement.

Your data is hosted in Switzerland. Stripe may process payment data in the United States, where Stripe, LLC is certified under the Swiss-US Data Privacy Framework; otherwise, the standard contractual clauses apply.

If you accept audience measurement, Google may process your browsing data in the United States, where Google LLC is certified under the Swiss-US Data Privacy Framework; otherwise, the standard contractual clauses apply.

7Retention period

• Account and company data: as long as your account exists. When it is deleted, your account (name, e-mail, password) is erased at once; a company of which you were the only member is closed, then erased with its documents 30 days later (time to undo a mistake).
• Backups: they keep a copy of the data for 30 days at most.
• Documents and receipts: the law requires you to keep them for ten years (art. 958f CO). Download them before deleting your account.
• Demo accounts: deleted automatically after a few days.
• Technical logs: 90 days.
• Contact messages: 12 months.
• Yoda Bill billing data: in line with our accounting obligations, as a rule ten years.

8Cookies

Yoda Bill uses cookies that are necessary for it to work: signing in to your account, protecting forms against request forgery, the language you chose, the display theme (light or dark) and your choice about audience measurement. They do not require your consent.

Only if you click “Accept”, we use Google Tag Manager, Google Analytics and Google Ads, on the public website as in the application, to learn how many people visit us, which pages they use and which ads brought them here. These tools set their own cookies (for example _ga or _gcl_au), kept for up to two years. Without your consent, nothing is loaded. You can change your mind at any time with the “Cookies” link at the bottom of every page of the public website.

When you save a payment method in the application, Stripe’s payment form may set its own cookies, which are necessary to prevent fraud.

9Security

Connections to Yoda Bill are encrypted (HTTPS), passwords are never stored in plain text, and access to a company’s data is restricted to its members. We take technical and organisational measures appropriate to the risk; however, no measure can rule out every risk.

10Your rights

You can ask at any time to access your data, have it corrected or erased, receive it in a common format, or object to processing. Many of these actions can be done directly in your settings; otherwise, write to us via the contact form.

If you believe your rights are not being respected, you can contact the Federal Data Protection and Information Commissioner (FDPIC).

11Changes

We update this policy when the service or the law changes. The date of the current version is shown at the top of the page; in the event of a significant change, we inform you in the application or by e-mail.