Privacy Notice

1. Controller and contact

The controller within the meaning of Art. 5 lit. j revFADP is dekla GmbH (in formation), Zürich, Switzerland, UID: [PENDING_HR_REGISTRATION]. The definitive registered office and postal address will be published here once the company has been entered in the Commercial Register of the Canton of Zürich.

For all data-protection matters, in particular requests for access, rectification, or erasure, please contact:

E-mail: [email protected]

dekla GmbH is appointing an external, independent data protection advisor under Art. 10 revFADP ([PENDING_APPOINTMENT]). The appointment is voluntary; it allows dekla to forgo consulting the FDPIC under Art. 23 para. 4 revFADP after a data protection impact assessment. The name and contact details will be published here as soon as the appointment is formally concluded.

2. Architecture and processing model

dekla is a static client-side single-page application. Once the application bundle has been loaded into your browser, all tax calculations are performed exclusively on your device. In default mode, the application establishes no outbound network connections after loading, with one exception: only after you click “Show QR code” for the optional phone scan, your browser connects to our pairing relay (see Sec. 14). This can be verified at any time in your browser's network tab and through the publicly published end-to-end tests (`tests/e2e/privacy.spec.ts`, `tests/e2e/privacy-phone-scan.spec.ts`, `tests/e2e/privacy-offline.spec.ts`). A service worker on this same site stores the app so it can open without a connection. It does not contact any other host and it does not send vault contents. A check for a newer copy runs only when you ask for it. The browser may revalidate dekla's own files when you open the site.

dekla provides two privacy modes, selected when the vault is first created and locked into the vault thereafter:

(a) Anonymous mode: no name, postal address, or AHV-Nr. (Swiss social-security number) is collected in the application. The calculation is performed using numerical inputs only; identity details are written onto the exported worksheet offline.

(b) Full mode: you enter name, postal address, and AHV-Nr. so that the worksheet can be produced in fully populated form. Even in full mode, this information never leaves your devices unencrypted: it is encrypted immediately upon entry using XChaCha20-Poly1305 (AEAD) within an Argon2id-derived key envelope (KEK/DEK) and stored locally. With the optional phone scan, scanned pages pass an encrypted relay (see Sec. 14).

The operator (dekla GmbH) has no access to your tax data at any time — neither in anonymous nor in full mode. The relay used by the phone scan cannot read scanned pages.

3. Categories of personal data processed

The operator processes only the following categories of personal data:

(a) Connection metadata when the page is loaded: IP address, user agent (browser and operating-system identifier), date and time of access, and the URL requested. These data necessarily arise when the static bundle is served by our hosting provider's content delivery network (Vercel Inc.). The legal basis is the overriding legitimate interest in the operation, security, and abuse prevention of the website (Art. 31 para. 1 revFADP).

(b) Voluntary correspondence: if you contact us by e-mail (e.g. [email protected] or [email protected]), we process the information contained in your message in order to respond to your enquiry.

(c) E-mail addresses voluntarily submitted to the "Notify me when available" function: we store your e-mail address and the feature you requested in a separate system (Listmonk, self-hosted in the EU/Switzerland), distinct from the vault, to inform you when the feature becomes available. You can unsubscribe at any time via the link in every e-mail.

(d) Relay metadata, only if you use the optional phone scan: to establish and operate the connection, the relay processes the IP addresses and user-agent strings of your two devices, the time and duration of the session and the number and size of the transmitted messages (see Sec. 14). We do not use these data for analytics or advertising and do not link them to any person. The legal basis is your request (you click and scan) and our overriding interest in operating a secure connection (Art. 31 revFADP).

No tax data is processed by the operator: tax data, including AHV-Nr., wage statement particulars, asset schedules, supporting documents, and calculation results, are under no circumstances transmitted to the operator or any of its sub-processors in readable form. Scanned pages that you send with the optional phone scan pass the relay only end-to-end encrypted, and neither the relay nor its infrastructure provider can read them. These data remain encrypted on your device.

4. Recipients and processors

Connection metadata under Sec. 3(a) is delivered through Vercel Inc., 340 S Lemon Ave #4133, Walnut, CA 91789, USA. A data-processing agreement and the Swiss Standard Contractual Clauses Addendum (CH-SCC) recommended by the FDPIC have been executed with Vercel. Vercel is certified under the Swiss-US Data Privacy Framework; the certification status is reviewed prior to each production release.

Relay metadata under Sec. 3(d), only if you use the optional phone scan, is processed on infrastructure of Cloudflare, Inc., USA (Cloudflare Workers and Durable Objects), as our processor under a data-processing agreement, and by its sub-processors. Cloudflare may keep operational and security logs of its network under its own retention rules. [DRAFT: confirm the data-processing agreement and the certification status before publication]

Beyond the data identified in Sec. 3, no data is disclosed to third parties. In particular, there are no advertising networks, analytics services, A/B-testing platforms, tag managers, font CDNs, or other third-party scripts. The application's Content Security Policy (`connect-src 'self'`, plus the origin of our pairing relay for the optional phone scan) technically prevents the transmission of data to any other origin.

Future optional features (Phase 5: "BYOK" using your own OpenAI/Anthropic API key; Phase 6: optional in-browser language model) will be provided on separate origins (app-byok.dekla.ch and models.dekla.ch) under a distinct, granular consent flow pursuant to Art. 17 revFADP. So long as you do not actively use those features on the dedicated origins, no such transfers take place.

5. Cross-border transfer (Art. 16/17 revFADP)

In default mode, connection metadata is transferred to Vercel Inc. in the United States of America. In the view of the Swiss Federal Council, the United States does not, in general, provide protection equivalent to that of Switzerland within the meaning of Art. 16 revFADP; the transfer is, however, lawful on the basis of the Federal Council's recognition of the Swiss-US Data Privacy Framework (in force since 15 September 2024). Vercel Inc. is listed as a certified organisation in the DPF register. In addition, the CH-SCC addendum executed with Vercel provides appropriate safeguards within the meaning of Art. 16 para. 2 lit. d revFADP that remain in force even should the DPF certification lapse.

If you use the optional phone scan, relay metadata under Sec. 3(d) is transferred to Cloudflare, Inc. in the United States and its sub-processors. Safeguards: the Swiss-US Data Privacy Framework and the standard contractual clauses (with Swiss adaptation) in Cloudflare's data-processing agreement [DRAFT: confirm certification status before publication].

Apart from the transfers described above, no personal data is transferred to any other third country in default mode.

6. Retention

Connection metadata: under our agreement with Vercel, access logs are stored for a maximum of 30 days in a rolling log buffer and are deleted automatically thereafter.

Relay (optional phone scan): the relay forgets a session after at most 60 minutes (10 minutes if no phone joins, 15 minutes when idle) and stores no content. Cloudflare may keep operational and security logs of its network under its own retention rules.

Contact e-mails: correspondence is retained for as long as necessary to respond and to handle any follow-up, but in any case no longer than twelve months after closure of the matter, subject to any longer statutory retention obligations (e.g. Art. 958f CO, Art. 70 MWSTG).

Data on your device: your tax data and supporting documents reside exclusively on your device. Keep your supporting documents for as long as the tax authority can ask for them (up to ten years in additional-tax proceedings); self-employed persons and legal entities must keep accounting records and documents for ten years (Art. 126 para. 3 DBG and § 135 StG ZH). This retention lies entirely with you; the operator cannot restore a lost vault. Please export the vault regularly and keep a backup copy in a safe, separate location.

7. Storage on your device (FMG Art. 45c)

Notice pursuant to Art. 45c of the Swiss Telecommunications Act (FMG): in order to perform the contracted service, dekla writes data to the browser-side storage of your device. Specifically, the following mechanisms are used:

— Origin Private File System (OPFS): storage of the encrypted vault, including supporting documents.

— IndexedDB: a redundant second copy of the vault, providing resilience against platform-specific storage eviction (e.g. Safari Intelligent Tracking Prevention).

— CacheStorage: caching of application code and fonts for offline availability.

The following are not used: cookies, tracking pixels, Local Storage used for identification or marketing purposes, Service Workers that send data to another country. A service worker on dekla.ch itself caches the app for offline use and does not send that cache anywhere, fingerprinting, session replay, or similar technologies.

The storage mechanisms identified above are technically necessary for the provision of the service; under FMG Art. 45c lit. b no additional consent is required. You may delete the data at any time via your browser settings ("clear site data"). Deletion without a prior export results in the irrevocable and unrecoverable loss of your tax data.

8. Your rights (Art. 25, 28 and 32 revFADP)

You have the following rights vis-à-vis the operator:

— Right of access (Art. 25 revFADP): you may obtain, free of charge, information about whether and which personal data we process concerning you. Because we essentially process only connection metadata, the access response will generally be limited to that data category.

— Right to data delivery and portability (Art. 28 revFADP): the right to data delivery in a commonly used electronic format is satisfied at application level through the vault export function (`.swisstax-vault`). You may trigger the export at any time without our involvement; it contains all data you have entered in machine-readable form.

— Right to rectification (Art. 32 para. 1 revFADP): inaccurate data will be corrected upon your request. As tax data is held only on your device, you correct it directly in the application.

— Right to erasure (Art. 32 para. 2 lit. c revFADP): you may request erasure of the personal data we hold about you. Erasure requests concerning connection metadata are forwarded to Vercel within seven (7) days of receipt; full propagation is completed within Vercel's standard log-rotation window and no later than 30 days after receipt of your request.

— Right to object (Art. 30 para. 2 lit. b revFADP): you may, at any time, object to the processing of your data carried out on the basis of overriding legitimate interests.

Please address all requests to [email protected]. We verify the identity of the requester by appropriate means and respond within 30 days of receipt (Art. 25 para. 7 revFADP).

9. Automated processing (Art. 21 revFADP)

Tax calculations produced by dekla are the result of deterministic rules executing exclusively on your device. You may inspect, verify, and override every input and every intermediate result before filing your return. The legal determination of the tax liability is not made by dekla but by the competent cantonal tax authority in the ordinary assessment procedure.

Processing by dekla therefore expressly does not constitute an automated individual decision within the meaning of Art. 21 revFADP, because (i) the final determination of the tax factors lies with the cantonal tax authority, (ii) you may manually review and amend every input and every intermediate value, and (iii) the publication of the calculation result (worksheet) requires your active confirmation.

10. Data concerning minors

dekla is intended for adult, taxable individuals. To the extent that, as the legal representative of your children, you enter information about them in the context of your tax return (e.g. year of birth, any income relevant to family taxation), you do so in exercise of your parental authority (Art. 304 CC) and consistent with Art. 31 para. 2 lit. c revFADP. Such data likewise never leaves your devices unencrypted.

11. Representative in the European Union (Art. 27 GDPR)

Insofar as dekla may address persons established in the European Union, the operator is appointing a representative within the meaning of Art. 27 of Regulation (EU) 2016/679 (GDPR). The mandate is expected to be entrusted to Prighter Group, Vienna, Austria; the appointment is in progress. Status: [PENDING_EU_REP_APPOINTMENT — Prighter recommended]. The contact details will be published here as soon as the mandate has been concluded. Until the formal appointment, the service is directed at persons resident in Switzerland in accordance with Sec. 7 of the Terms of Service.

12. Right to lodge a complaint with the FDPIC

You are entitled at any time to file a report with, or request an investigation by, the competent supervisory authority. The competent authority is the Federal Data Protection and Information Commissioner (FDPIC / EDÖB), Feldeggweg 1, 3003 Bern, Switzerland, https://www.edoeb.admin.ch. We would recommend first contacting us at [email protected] so that we may consider and, where possible, remedy your concern directly.

13. Changes to this privacy notice

We reserve the right to amend this privacy notice as necessary in light of legal developments, changes to the technology used, or changes to our service. The current version, with its effective date, is available at dekla.ch/privacy. For material changes that meaningfully affect your rights or the legal basis of processing, we will provide at least 30 days' advance notice in a suitable form on the website (banner on the home page). Individual notification by e-mail is not available in default mode because no e-mail address is collected; where you have provided an address for the "Notify me when available" function, we will additionally inform you by that channel.

14. Phone scan (optional)

If you click “Show QR code”, your browser opens an encrypted connection to a relay operated by dekla GmbH on infrastructure of Cloudflare, Inc. (Cloudflare Workers and Durable Objects). Your phone then sends the scanned pages to your computer through this relay. The pages are end-to-end encrypted with a key that exists only in the QR code and the two devices; the relay and Cloudflare cannot read them, and the relay stores no content. To establish and operate the connection, the relay processes the IP addresses and user-agent strings of your two devices, the time and duration of the session and the number and size of the transmitted messages. Cloudflare processes these data as our processor under a data-processing agreement; it may keep operational and security logs of its network under its own retention rules. We do not use these data for analytics or advertising and do not link them to any person. The relay forgets the session after at most 60 minutes (10 minutes if no phone joins, 15 minutes idle). Legal basis: your request (you click and scan) and our overriding interest in operating a secure connection (Art. 31 revFADP). Recipient and country: Cloudflare, Inc., USA, and its sub-processors; data-protection safeguards: Swiss-US Data Privacy Framework and the standard contractual clauses (with Swiss adaptation) in Cloudflare's data-processing agreement [DRAFT: confirm certification status before publication]. Without clicking, no data is sent to the relay.