Privacy Policy

Last updated: October 30, 2026

The purpose of this policy is to inform data subjects about the processing of personal data carried out by ark.swiss sàrl, in accordance with Article 19 of the Swiss Federal Act on Data Protection (FADP, revised and in force since 1 September 2023) and Article 13 of the General Data Protection Regulation (GDPR).

1. Data controller

ark.swiss sàrl
Chemin de la Duchesne 13, 1806 St-Légier, canton de Vaud, Suisse
General email: [email protected]
Data protection email: [email protected]

2. Data subjects and data collected

• Visitors to arkstock.ch: technical server logs (truncated IP, user agent, page visited, date and duration).
• Audience measurement on arkstock.ch: random visitor identifier, pages viewed, origin of the visit (utm_* campaign parameters, referring site, landing page), language, screen width, browser and a hash of the IP address. Details are in the Cookie Policy.
• Google Ads tag on arkstock.ch (with your consent): advertising click identifier, Google cookie identifiers, page viewed, IP address, browser and, after a Starter sign-up or a quote request, its random identifier. Details are in the Cookie Policy.
• Prospects (signup form): first name, last name, email, optional phone number, organisation name, desired subdomain, chosen product and plan. For a Starter trial, the origin of the visit (utm_* parameters and referring site) is attached to the signup.
• Customers: login credentials, preferences, billing history, support correspondence.
• Customer Content hosted in the Instance (any third-party data): item records, containers, rental projects, the business's own customers and related documents, processed on behalf of the Customer, which is the data controller; ark.swiss sàrl acts as data processor.

3. Purposes of processing

• Performance of the subscription contract and provision of the Service.
• Billing and collection.
• Technical support and transactional communication.
• Security, fraud prevention and Service integrity.
• Service improvement on the basis of aggregated statistics.
• Knowing which campaigns and sites bring visits and trials, trial by trial.
• Compliance with applicable legal obligations (accounting, tax, retention of records).
• Measuring how well our Google ads work, with your consent.

4. Legal basis

• Performance of the contract (Art. 6 §1 lit. b GDPR; Art. 31 §2 lit. a FADP) — account, billing, support data.
• Legal obligation (Art. 6 §1 lit. c GDPR; Art. 958f CO) — accounting retention of invoices for 10 years.
• Legitimate interest (Art. 6 §1 lit. f GDPR; Art. 31 §1 FADP) — Service security, abuse prevention, aggregated product improvement, measuring where visits and trials come from.
• AI features — performance of the contract and legitimate interest (Art. 6 §1 lit. b and f GDPR; Art. 31 FADP): the Customer is informed of the providers used (section 16) and may ask for these features to be disabled.
• Consent (Art. 6 §1 lit. a GDPR; Art. 31 §1 FADP) — for non-strictly contractual communications and for the Google Ads tag on arkstock.ch, which you can decline or withdraw at any time.

5. Recipients and subprocessors

ark.swiss sàrl does not use any third-party commercial behavioural analytics service (no Google Analytics, no Meta Pixel, no LinkedIn Insight, no Hotjar, no Intercom). AI providers are used under their API terms, which in principle exclude training their models on the data sent.

Internal measurement. Visit events and the origin of trials are recorded in the app.ark.swiss central system. This system belongs to ark.swiss sàrl, which operates it itself. This data is not sold. Only one item leaves it: for a trial started after a click on a Google ad, the click identifier and the time of the signup are sent to Google Ads, without any name or email address.

Google Ads tag. If you accept it, arkstock.ch loads the Google Ads tag described in the Cookie Policy. The ark.stock application uses neither this tag nor any other advertising tracker.

6. International transfers

Our application infrastructure, its business continuity and its backups are hosted exclusively in Europe. Primary production is operated by netcup GmbH in Vienna (Austria, European Union), with a standby copy of the databases continuously replicated to Infomaniak Network SA in Geneva and independent historical Borg backups on ark.swiss-owned infrastructure in Switzerland. Data strictly necessary for payment processing transits through Stripe Payments Europe Ltd. (Ireland, European Union) under applicable adequacy decisions. AI requests are processed by the chosen provider: in Switzerland for Infomaniak; OpenAI, Anthropic, Google and OpenRouter may process them outside Europe, in particular in the United States. Transfers to the United States (Cloudflare) are governed by the EU-U.S. Data Privacy Framework and, subsidiarily, by the European Commission's standard contractual clauses. With your consent, the Google Ads tag sends data to Google LLC in the United States, certified under the EU-U.S. and Swiss-U.S. Data Privacy Framework.

7. Retention periods

• Account data: duration of the subscription + 30 days after termination.
• Customer Content: duration of the subscription + 30 days (export window).
• Invoices and accounting records: 10 years (Art. 958f CO). This statutory obligation prevails over the right to erasure.
• Technical logs: 14 days in central logging; copies included in backups disappear with their rotation (24 months at most).
• Prospect data: 24 months maximum after last contact.
• Visitor identifier (ark_vid): renewed 13 months after it is created. You can clear it earlier from your browser.
• Origin of the visit in the browser: until the tab is closed.
• Visit events and first-visit origin in the central system: 13 months, then deleted automatically.
• Origin attached to a trial (source and campaign of the visit, advertising click identifier, referring site): 24 months after sign-up, or until the account is deleted if that comes first.
• Google Ads cookies on arkstock.ch (with your consent): 90 days; your choice (ark_consent): 6 months.

Audience measurement data is not passed on to any third party, except the Google Ads click identifier and, with your consent, the Google Ads tag data described in section 5. You can ask us to delete it before these dates (section 9).

8. Security

Technical and organisational measures include: encryption in transit (TLS 1.2 minimum, via Cloudflare), encryption at rest of credentials, tokens and sensitive settings in AES-256-GCM, a separate database for each customer, daily database export and encrypted Borg archives in Switzerland, two-factor authentication available for accounts, server access by SSH key only, a log of sensitive actions in each Instance, automatic security scans (Trivy, Semgrep) on every build, and monitoring of services and backups with alerts.

9. Data subject rights

In accordance with Art. 25 et seq. FADP and Art. 15 to 22 GDPR, you have the following rights:

• Right of access (Art. 25 FADP / Art. 15 GDPR).
• Right to rectification (Art. 32 FADP / Art. 16 GDPR).
• Right to erasure (Art. 32 FADP / Art. 17 GDPR), subject to the 10-year statutory retention for invoices.
• Right to portability (Art. 28 FADP / Art. 20 GDPR) — CSV or Excel export, with attached files.
• Right to object (Art. 30 FADP / Art. 21 GDPR).
• Right to withdraw consent at any time (Art. 30 FADP / Art. 7 §3 GDPR).

To exercise these rights, write to [email protected]. A response is provided within a maximum of 30 days. Identity verification may be requested in case of reasonable doubt.

10. Automated decisions and profiling

ark.swiss sàrl does not make any automated individual decisions producing legal effects within the meaning of Art. 21 FADP and Art. 22 GDPR. Proposals produced by AI models (item records, assistant answers) are subject to the user's validation; no record is changed without their approval.

11. Cookies

Cookies and trackers are described in the Cookie Policy.

12. Data breaches

When a data security breach is likely to result in a high risk to the personality or fundamental rights of the data subjects, ark.swiss sàrl reports it to the Federal Data Protection and Information Commissioner (FDPIC) as soon as possible (Art. 24 FADP). It informs the data subjects when their protection requires it or the FDPIC asks for it.

Where the GDPR applies, ark.swiss sàrl notifies the competent supervisory authority within 72 hours of becoming aware of the breach, unless it is unlikely to result in a risk to the data subjects (Art. 33 GDPR), and informs them if the risk is high (Art. 34 GDPR).

13. Supervisory authority

You have the right to lodge a complaint with a supervisory authority:

• Switzerland — Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch.
• European Union — supervisory authority of your country of residence (e.g. CNIL in France).

14. Data protection contact

ark.swiss sàrl is not legally required to appoint a Data Protection Officer (DPO). Requests are handled by a dedicated contact point: [email protected].

For B2B customers subject to the FADP or GDPR, a formal Data Processing Agreement (DPA), compliant with Art. 28 GDPR and Art. 9 FADP, is available and automatically accepted upon subscription. A PDF version signed by both parties can be provided upon request at [email protected].

15. Changes

This policy may be amended. Any material amendment is notified by email and an archived version remains available on request.

16. Artificial intelligence features

ark.stock offers AI features to complete an item record, analyse and classify uploaded documents, and search the inventory.

Providers. The Instance administrator chooses the model in the AI settings: "Sovereign" uses a model hosted in Switzerland by Infomaniak, "Performance" a model from OpenAI. Anthropic and Google models can also be configured; web search for an item record goes through Google. Classifying some documents may use a decision model reached through OpenRouter, when this routing is configured. Data sent then passes through the servers of the provider concerned, under its terms, including outside Europe.

The Customer may ask for the AI features of its Instance to be disabled by writing to [email protected].

In case of discrepancy between language versions, the French version prevails.