Privacy Policy
Version of 12 March 2026 — Compliant with the Swiss FADP 2023 and EU GDPR 2016/679.
1. Data Controller
Vincent CLAIVAZ
Av. du Mont-d'Or 13, 1007 Lausanne, Switzerland
Contact: dailybudget{at}clebs.ch
2. Data Collected
We collect only the data strictly necessary for the operation of the Service:
| Data | Source | Nature |
|---|---|---|
| Email address | Registration / login | Required |
| First name / Last name | User profile | Optional |
| Postal address | User profile | Optional |
| Budget data (amounts, labels, categories, dates) | Use of the Service | Necessary for the service |
| IP address and server logs | Automatic (technical) | Technical — 90 days |
| Payment information | Stripe Inc. (third party) | If Premium subscription |
No banking data is collected directly by DailyBudget.ch. Payments are processed entirely by Stripe Inc. under its own privacy policy.
3. Legal Basis for Processing
- Swiss FADP 2023: Art. 31 para. 2 lit. a — performance of a contract; Art. 31 para. 2 lit. b — overriding legitimate interests of the Operator.
- EU GDPR 2016/679: Art. 6(1)(b) — performance of a contract; Art. 6(1)(f) — legitimate interests of the Operator.
4. Purposes of Processing
- Provision, maintenance and improvement of the Service
- Passwordless authentication (Magic Link by email)
- Billing and subscription management
- Security, fraud prevention and prevention of unauthorised access
- Compliance with legal and regulatory obligations
Your data is never used for advertising purposes and is never sold or transferred to third parties for commercial purposes.
5. Retention Periods
| Category of data | Retention period |
|---|---|
| Account data (email, profile) | Until account deletion by the User |
| Budget data (expenses, categories, periods) | Until account deletion |
| Server logs (IP addresses) | 90 rolling days |
| Billing data (managed by Stripe) | 10 years (legal accounting obligations) |
| Audit log (security actions) | 12 months |
| Post-deletion cryptographic fingerprint (see § 7) | Indefinite (pseudonymous data, non-personal) |
6. Sub-processors and International Transfers
| Provider | Country | Role | Safeguards |
|---|---|---|---|
| Stripe Inc. | United States | Payment processing | EU–US Data Privacy Framework (DPF, 2023) and standard contractual clauses |
| SMTP provider | Switzerland | Sending transactional emails (Magic Link) | Data processing agreement compliant with FADP / GDPR |
7. Rights of Data Subjects
In accordance with the FADP 2023 (Art. 25 et seq.) and the GDPR (Art. 15–22), you have the following rights:
- Right of access: obtain confirmation of the processing of your data and receive a copy.
- Right of rectification: correct inaccurate data from the application settings.
- Right to erasure: delete your account and all your data (email, profile, expenses, categories, periods) directly in the app: My info → Danger zone → Delete my account. Deletion is immediate and irreversible. To prevent abuse of the free plan, a non-reversible cryptographic fingerprint of your address (SHA-256 with secret key) is retained. This fingerprint is pseudonymous data under GDPR Art. 4(5) and Swiss FADP Art. 5 lit. a: it cannot be used to recover the email address without the secret key. Former Premium subscribers may re-register freely.
- Right to data portability: export your budget data in CSV format (Premium Plan).
- Right to restriction: request suspension of processing in cases provided for by law.
- Right to object: object to processing based on legitimate interest.
To exercise your rights: dailybudget{at}clebs.ch — response within a maximum of 30 days.
8. Cookies and Trackers
DailyBudget.ch uses two types of cookies:
| Cookie | Type | Duration | Purpose | Consent |
|---|---|---|---|---|
Session cookie (db_sess) | Strictly necessary | 24 hours | Maintain your login | No — Art. 6(1)(b) GDPR |
Google Analytics 4 (_ga, _ga_*) | Analytics | 13 months | Anonymised audience measurement | Yes — only after consent |
The session cookie is strictly necessary and configured with HttpOnly, SameSite=Lax and Secure (HTTPS) attributes.
Google Analytics 4 is configured with IP anonymisation and Consent Mode v2: no personal data is transmitted without your consent. Data is processed by Google LLC (United States) under the EU–US Data Privacy Framework (DPF, 2023). You may withdraw consent at any time via the "Manage cookies" link at the bottom of the page.
No advertising cookies or retargeting tools are used.
9. Data Security
- Encrypted transmission via HTTPS (TLS 1.2+)
- Passwordless authentication — no password hash stored (Magic Link)
- CSRF protection on all mutating requests
- Rate limiting on authentication endpoints
- Audit log of sensitive accesses and modifications
- Strict access control: each user can only access their own data
Data is hosted by Kreativemedia GmbH, Switzerland. In the event of a personal data breach, we undertake to notify the competent authorities and individuals within the legal deadlines.
10. Contact and Complaints
For any question: dailybudget{at}clebs.ch
If you believe processing does not comply with applicable law, you may lodge a complaint with:
- Switzerland: Federal Data Protection and Information Commissioner (FDPIC) — www.edoeb.admin.ch
- EU: the supervisory authority of your Member State (e.g. CNIL in France, BfDI in Germany, Garante in Italy).