Privacy Policy

1. Scope and Swiss revFADP Compliance

This Privacy Policy outlines how Digintu Tech Ltd ("we", "our") collects and processes personal data. Our processing is strictly governed by the revised Swiss Federal Act on Data Protection (nFADP) and GDPR requirements. We act as a data processor for accounting data passing through our middleware, and as a data controller only for customer account management.

2. Zero-Retention Middleware Principle

Our core application logic is designed as a transient pass-through engine. Financial documents (invoices, statements, PAIN.001 exports) retrieved from external integrations are processed in volatile container memory. We do not permanently store your accounting files, contact lists, or transaction histories. Only cryptographic hashes are retained for duplicate prevention.

3. Data We Collect

We collect only what is strictly necessary to maintain your account: Identity Data (Name, email address), Authentication Data (Encrypted credentials at rest), and Billing Data (processed entirely by our sub-processor, Stripe Inc.).

4. System Audit Logs

To ensure non-repudiation and security, we maintain pseudonymized system audit logs (tracking IP addresses, execution timestamps, and success/failure states of API calls). These logs are exclusively accessible to Workspace Owners for diagnostic and due diligence purposes.

5. User Rights & Data Deletion

Under the nFADP, you hold the right to access, rectify, or erase your data. Users can invoke an immediate hard deletion of their Digintu workspace directly from profile settings. This action instantly drops all corresponding tokens, audit logs, and account configurations from our Swiss-hosted servers.

---

For detailed inquiries regarding our role as a processor, please refer to our Due Diligence Pack or contact our Data Protection Officer at pay@digintu.tech.