Privacy policy

The controller for the processing of your personal data on numi.fi and in the numi application is:

Name

Weise GmbH

Address

Am Mattenhof 16A 6010 Kriens Switzerland

Email

contact@numi.fi

This policy covers Account data: the data numi processes for its own purposes when you visit the website, open an account and sign in. The accounting data a firm uploads to numi is covered by the data processing agreement (see below).

We only process what running numi requires:

• Account: your email address, your password (as a hash only, never in plain text), the times you sign in, and the firm you belong to and your role in it.
• Session cookie: after you sign in, numi sets a cookie that holds your session so that you stay signed in.
• Page views: Vercel Web Analytics counts page views without cookies. Before a page view is sent, numi removes query strings and fragments from the address and replaces IDs in the path with “[id]”. What is sent is the cleaned address, the referring page, browser, operating system, device type and country.
• Loading times: Vercel Speed Insights measures Core Web Vitals, also without cookies. What is sent is the metric, the route pattern (for example /app/m/[mandateId], never the ID), the device type and the country.
• Appearance: when you choose light or dark, your browser stores that choice locally under “numi-theme”. It never leaves your device.
• Server logs: every request produces technical details (IP address, time, requested address, browser) that our hosting provider logs for a short time.

We do not build profiles, show ads or sell data.

We process Account data for these purposes:

• Providing your account and sign-in so that you can use numi (performance of the terms of use).
• Keeping numi secure and running, detecting abuse and fixing errors (overriding legitimate interest).
• Producing anonymous usage and loading-time statistics to improve the website (overriding legitimate interest).
• Proving who accepted which version of the terms of use and the data processing agreement, and when (legitimate interest and legal obligations).

numi uses the following processors. They process data only on our behalf and on our instructions. The data processing agreement uses the same list for Customer data.

Supabase

Supabase, Inc., USA Database, file storage, sign-in (authentication) and Vault for access keys Location: Zurich, Switzerland (region eu-central-2) Transfer basis: Stored in Switzerland. For any access by the US provider: standard contractual clauses

Vercel

Vercel Inc., USA Running the application (compute), Web Analytics, Speed Insights and AI Gateway (routing AI requests) Location: Frankfurt, Germany (region fra1) Transfer basis: EU, recognised as adequate (Annex 1 DPO). For the US provider: Swiss-U.S. Data Privacy Framework and standard contractual clauses

Anthropic

Anthropic, PBC, USA AI inference through the Vercel AI Gateway, with no retention of requests (zero data retention) Location: USA Transfer basis: Swiss-U.S. Data Privacy Framework and standard contractual clauses

Account data is stored in Zurich and processed in Frankfurt. The FADP recognises the European Union as providing adequate data protection. Anthropic receives no Account data, only minimised extracts of Customer data without IBANs, addresses or account numbers.

Beyond that, we only disclose personal data where the law or an authority requires it.

• We keep Account data for as long as your account exists. If you ask by email to privacy@numi.fi, we delete your account within 30 days.
• The session cookie lasts until you sign out or the session expires.
• Server logs are deleted after 30 days at most.
• Page views and loading times contain no identifier that leads back to you. Vercel keeps them only as aggregated statistics.
• Records of accepted terms and agreements, and audit log entries, are kept for 10 years, also after your account is deleted. They contain your user ID, not your email address. When your account is deleted, the acceptance records remain without your user ID; audit log entries keep it.

Statutory retention obligations remain reserved.

Under the Swiss Data Protection Act (FADP) you have, in particular, the right to:

• Access the personal data we process about you (Art. 25 FADP).
• Receive your data, or have it transferred, in a common electronic format (Art. 28 FADP).
• Have incorrect data corrected (Art. 32 FADP).
• Have your data deleted and object to processing (Art. 30 and 32 FADP).
• Lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC).

To exercise these rights, email privacy@numi.fi, ideally from your account's email address. If we cannot verify your identity otherwise, we will ask. We reply within 30 days, normally free of charge.

numi uses exactly one cookie and one entry in local storage:

• The Supabase session cookie (its name starts with “sb-”). It is set only when you sign in and is technically necessary for signing in.
• The “numi-theme” entry in your browser's local storage. It is created only when you choose light or dark, and removed when you go back to the system setting.

Web Analytics and Speed Insights set no cookies and store nothing on your device. Because numi uses no other cookies and no tracking technology, there is no cookie banner.

Where the General Data Protection Regulation (GDPR) applies to you, we base processing on the performance of a contract (Art. 6(1)(b) GDPR), our legitimate interests in security, operation and anonymous statistics (Art. 6(1)(f)) and legal obligations (Art. 6(1)(c)). The European Commission recognises Switzerland as providing adequate data protection.

You have the rights under Art. 15 to 21 GDPR (access, rectification, erasure, restriction, data portability, objection) and may lodge a complaint with a data protection supervisory authority in the EU. Send requests to privacy@numi.fi.

Bank statements, QR-bills and Bexio documents that a firm processes in numi are Customer data. The firm is their controller, and numi processes them only on the firm's behalf, as set out in the data processing agreement (DPA).