Privacy Policy — BeMyTalent

Version: 1.4 Last updated: August 21, 2026 Data controller: Ekylibr SA (Switzerland)

This policy describes how BeMyTalent collects, uses and protects your data in accordance with the Swiss Federal Act on Data Protection (FADP/revFADP) and, where applicable, the European General Data Protection Regulation (GDPR).

🇨🇭 Data hosted in Switzerland. Since August 8, 2026, all of your application data — database, authentication, files (accounting documents, invoices, payroll documents) and server functions — has been hosted in Switzerland (Supabase, Zurich region eu-central-2). Antivirus scanning of attachments also runs in Zurich (Google Cloud Run europe-west6).

---

1. Who are we?

Ekylibr SA publishes the BeMyTalent application ("BMT"), a financial management platform (forecasting, accounting, payroll, invoicing, CRM, quotes, inventory, mandates) intended for entrepreneurs, self-employed professionals and small businesses/SMEs based in Switzerland.

Data protection contact:

• Email: privacy@bemytalent.com
• Postal address: Ekylibr SA, Avenue du Mail 18, 2000 Neuchâtel, Switzerland

---

2. Data we process

2.1 Data you provide directly

Third-party data (employees, clients, contacts). When you enter into BMT data relating to persons other than yourself — your employees (Payroll module), your clients, your CRM contacts — you are the controller of that data within the meaning of the FADP/GDPR; BMT acts as a processor on your behalf. It is your responsibility to inform those persons and to have a legal basis for that processing.

2.2 Data collected automatically

We do not use advertising cookies or third-party marketing tracking (no Google Analytics, no Meta Pixel, no Hotjar).

2.3 Mobile application (iOS)

BMT is also available as an installable application (PWA and iOS application distributed via the App Store). The application processes the same data as the web version — no additional processing, with the following clarifications:

• Camera, microphone, photo library: used only when you scan a document, dictate a note or attach a photo. Capture takes place on your device; only the file you confirm is transmitted to our servers. No background access.
• No advertising tracking: the application contains no advertising SDK, no tracking identifier (IDFA) and no cross-app tracking.
• Account deletion: available directly in the application (Settings → Account), with the same effects as from the web (see §6).

---

3. Why we process this data

• Providing the Service: bookkeeping, payroll, forecasting calculations, CRM management, generation of quotes and invoices, statutory exports.
• Security: audit trail, anomaly detection, authentication.
• Legal compliance: Swiss accounting obligations (Art. 957–963 CO), VAT, archiving.
• User support: responding to your requests, debugging where you explicitly authorize us to do so.
• Billing: Stripe for subscription management (see §5).

We never process your data for third-party marketing, resale, automated decision-making profiling or AI model training.

---

4. OCR — Mistral, Mindee and OpenAI as processors

Read carefully if you use the assisted Accounting module. When you upload a receipt or an invoice for automatic extraction, the content of the document is transmitted to one or more third-party processors, in the order described below (each tier is called upon only if the previous one fails or returns a low-confidence extraction).

4.1 Mistral AI — primary OCR provider (since 2026-08-11)

• Identity: Mistral AI SAS, France (EU)
• Role: processor within the meaning of Art. 28 GDPR and Art. 9 revFADP
• Data transmitted: the binary content of the document (PDF/JPG/PNG) that you upload via the "Upload a document" or "Expense report" feature
• Purpose: extraction of structured fields (supplier, date, amounts excl./incl. VAT, VAT, currency, payment method)
• API used: api.mistral.ai/v1/ocr (model mistral-ocr-latest)
• Retention at Mistral: under their DPA, data submitted via the API is not used for model training; temporary retention for processing and abuse monitoring, then deletion. Check their policy: https://mistral.ai/terms/#privacy-policy
• Server location: EU
• Transfers outside the EU: none in the configuration used.

4.2 Mindee — OCR fallback

• Identity: Mindee SAS, France (EU)
• Role: processor within the meaning of Art. 28 GDPR and Art. 9 revFADP
• Data transmitted: the binary content of the document, only if the Mistral extraction fails or returns a confidence level below 60%
• Purpose: extraction of the same structured fields
• APIs used: mindee/expense_receipts/v5 and mindee/invoices/v4
• Retention at Mindee: under their DPA, temporary retention for processing, then deletion. Check their policy: https://mindee.com/legal/privacy-policy
• Server location: France / EU (EU hosting available)
• Transfers outside the EU: none if the EU option is enabled. Otherwise, transfers to the USA governed by standard contractual clauses.

4.3 OpenAI — last-resort OCR fallback (vision)

• Identity: OpenAI, L.L.C., United States
• Role: processor within the meaning of Art. 28 GDPR and Art. 9 revFADP
• Data transmitted: the binary content of the document, only if neither Mistral nor Mindee produced a usable extraction (confidence < 60%)
• Purpose: extraction of the same structured fields, model gpt-4o
• Endpoint: api.openai.com (USA)
• Retention at OpenAI: OpenAI states that it does not train its models on data submitted via the API (by default since March 2023). Maximum 30-day retention for abuse monitoring, then deletion.
• Location: United States
• Transfers outside the EU/CH: governed by the Standard Contractual Clauses (SCC). For Swiss users, the revFADP recognizes the SCC as appropriate safeguards.

4.4 Your OCR-specific rights

• Opting out: if you do not wish to use OCR, simply do not upload any documents. The Accounting module remains fully usable with manual entry.
• Deletion: deleting an attachment in BMT triggers deletion of the file from our Storage. The temporary copy held by Mistral/Mindee/OpenAI follows their respective policies (deletion within 30 days at most).
• No OpenAI fallback: if you wish to prohibit the transmission of your documents to OpenAI even where the Mistral/Mindee extraction is poor, let us know and we will disable the fallback for your project (accepting a loss of quality for atypical documents).

---

4bis. Bexio migration and synchronization (processor)

Read this if you enable the Bexio integration. The Bexio integration is optional but, if enabled, it involves bidirectional transfers of accounting data between BMT and Bexio AG.

4bis.1 Bexio AG — processor

• Identity: Bexio AG, Pulverstrasse 11, 3063 Ittigen, Switzerland
• Role: processor within the meaning of Art. 9 revFADP and Art. 28 GDPR (equivalent)
• Legal framework: Switzerland — EU → Switzerland adequacy decision in place (GDPR-compatible)

4bis.2 Use cases and data concerned

Initial OAuth connection: the Bexio access token is stored encrypted on the Supabase side (AES-GCM, scope limited to the accounting / contact / kb_offer / kb_bill / journal endpoints).

Outbound synchronization BMT → Bexio (quotes, Shopify invoices, etc.):

• Quotes and customer invoices that you create in BMT and choose to push to Bexio
• Product lines, amounts, VAT, due dates
• Associated contacts (customers) at the time of the push

Outbound migration Bexio → BMT (Accounting module, opt-in):

• Tier 1 (opening balances): pull of the chart of accounts + non-archived contacts + balances as at the cut-over date. Volume: ~200 accounts + ~500 contacts + 200 balances for a typical project.
• Tier 2 (aggregated history): pull of monthly balances per account over 1 to 10 years, at your discretion. Volume: N accounts × M months.
• Tier 3 (detailed entries): pull of all Bexio accounting entries over 1 to 10 years, at your discretion. Volume: potentially several thousand entries, with descriptions, accounts, amounts, dates.

4bis.3 Direction of the data and purpose

• Bexio → BMT pulls: the imported data becomes your data in BMT, subject to the 10-year retention period (Art. 958f CO). Bexio remains the historical source, but BMT becomes a copy of it.
• BMT → Bexio pushes: the pushed data is stored at Bexio under your contract with Bexio, independently of BMT.
• No third-party use: we do not consult your Bexio accounting data for any other purpose (statistics, recommendations, etc.). The migration pipeline is purely transitory.

4bis.4 Rate limit and Bexio API plan

To respect the Bexio API limits (free ~100 req/min, pro ~500 req/min), you declare your plan in BMT when launching each migration. This information is used solely to adjust throttling on the BMT side and is not transmitted to Bexio.

4bis.5 Post-migration verification

At the end of each Bexio → BMT migration, BMT automatically compares the imported balances with the Bexio balances (a control re-pull) to detect any discrepancies. This double read does not create an additional transfer: it involves the same data already imported.

4bis.6 Retention at Bexio

Bexio applies its own retention policy. See: https://bexio.com/fr-CH/dpa

4bis.7 Disabling the integration

You may revoke the Bexio connection at any time via Settings → Bexio → Disconnect. Disconnecting:

• Deletes the encrypted OAuth token on our side
• Does not erase the data already imported into BMT (that data has become yours)
• Does not erase the data pushed into Bexio (your contract with Bexio governs that data)

---

5. Other processors (sub-processors)

This list is kept up to date. For any material update, we will notify you by email at least 15 days before it takes effect.

---

6. Retention periods

---

7. Your rights

Under the Swiss FADP/revFADP and, where applicable, the European GDPR, you have the following rights:

• Access: obtain a copy of your data — "Export all data" button in Project settings.
• Rectification: modify your data via the application or by email request.
• Erasure ("right to be forgotten"): subject to statutory retention obligations (10 years for accounting). Account deletion available in Settings → Account (web and iOS application).
• Restriction: request the suspension of a processing operation.
• Portability: retrieve your data in a structured format (CSV, Excel, PDF — already available via the native exports).
• Objection: object to processing based on legitimate interest.
• Withdrawal of consent: at any time for processing based on consent (OAuth integrations, OCR).
• Complaint: you may lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland, or with the supervisory authority of your EU country of residence.

To exercise these rights, send your request to privacy@bemytalent.com. Response time ≤ 30 days.

---

8. Security

• TLS 1.3 encryption in transit, at-rest encryption on Supabase Storage and Postgres.
• Private attachment buckets — access only via short-lived signed URLs (15 minutes).
• Hashed passwords (bcrypt via Supabase Auth).
• OAuth tokens encrypted in the database with a server-side key.
• Postgres RLS (Row-Level Security) enforced on all tables — a user can never read another project's data.
• Full audit trail on sensitive accounting actions.
• Strict MIME whitelist on uploads (PDF/JPG/PNG only, 10 MB max).
• Antivirus scanning: every uploaded attachment is scanned (ClamAV on Google Cloud Run, Zurich). Download and preview remain blocked until the scan is complete, and permanently if the file is flagged as infected.

---

9. Changes to this policy

We may update this policy. Material changes (a new processor, a new processing purpose, more restrictive terms) will be communicated:

• By email to your contact address ≥ 15 days before they take effect.
• In-app via a persistent banner until accepted.

The version in force and its change log are permanently published at https://www.bemytalent.com/en/privacy.

---

10. Change log

---

This policy is written in French. The French version prevails.