Privacy policy

Nullsaldo is offered by Alnerive (Anna Blanca Torres Rivas und Joy-Kevin Maldini), Lorzenparkstrasse 25, 6330 Cham. Data protection contact: anna@alnerive.com.

Your business is responsible for its data (sales, counts, receipts, names of shift leads). We process it only on its behalf and only to run the app (data processing under Art. 9 FADP). We are responsible for the data of your login (email, sign-in).

Business: name, settings, account numbers and VAT codes for the accounts.

Till: daily sales per VAT rate and payment method, tips, counted amounts, cash expenses with a photo of the invoice, differences and answers to them.

People: first name, language and optionally an email (for reminders) of shift leads; name, email and role of owner, managers and accountant. PINs and passwords are stored only as a secure hash, never in plain text.

Connections: access keys for bexio, SumUp, Lightspeed, Payrexx or wallee, stored encrypted. We only read what is needed for the reconciliation.

Technical: a sign-in cookie (strictly necessary, no tracking) and a log of important actions (who booked what and when). We do not store IP addresses in the app and use no advertising or analytics tools.

To reconcile the till with the till system, the card terminal and TWINT, send reports and alerts, and pass the day to your accounting once you approve it. We use the data for nothing else, do not pass it on and do not sell it.

Server and backups: Infomaniak Network SA, Genf, Schweiz.

Only if you set it up: your accounting (bexio, Switzerland) or your accountant; your payment providers (SumUp, Lightspeed, Payrexx, wallee); your own storage for the paperless archive (Google Drive or Dropbox), where we save the approved days with the receipt photos.

Invoice photos of cash expenses: Anthropic PBC (USA), to suggest the amount and supplier. Only the photo, without the name of the business or of any person. Anthropic does not use it for training; the transfer is covered by a data processing agreement with standard contractual clauses. The owner can turn reading off in the settings.

Emails: Resend Inc. (USA). Phone notifications go through the browser’s service (Apple, Google, Mozilla); their content is end-to-end encrypted.

As long as your account exists. We delete in-app notifications after 13 months and expired sign-ins continuously. If you delete the account (Settings → Data), everything is gone immediately, and from the backups after 30 days at most.

The legal retention of the accounts (10 years) happens in your accounting or with your accountant, not in this app. Before deleting, download the months you still need.

Encrypted connection only (HTTPS). Encrypted access keys, hashed passwords and PINs, single-use sign-in links, lock after too many failed attempts. Each role sees only what it needs: shift leads count without seeing the expected amounts.

If a data breach poses a high risk, we inform you and the FDPIC as quickly as possible.

You can ask what data we hold, have wrong data corrected, have data deleted or receive it in a common format. Write to anna@alnerive.com. Shift leads contact their business or us directly.

You can complain to the Federal Data Protection and Information Commissioner (FDPIC, www.edoeb.admin.ch).

Version: 2026-11-04b. If we change this policy significantly, we inform owners by email.