Privacy Policy

Controller

Benjamin Thomet, Walkeweg 34, 4053 Basel, Switzerland. Contact for data protection matters:info@milq.ch.

What data we process

Account data

Name, email address, and an encrypted password hash. This data is necessary to maintain your account and to authenticate you.

Bookkeeping data

All information you enter yourself: company data, entries, receipts, customers, and invoices. This data belongs to you. We do not analyse it, do not pass it on, and do not use it for advertising.

Technical data and visitor statistics

When you visit the website, IP address, timestamp, page accessed, referring page (referrer) and browser identification are recorded server-side. These logs are used for operation and security. We also evaluate them for our own visitor statistics: where visitors come from (for example a search engine, an AI assistant or a link), from which country and network (network operator or organisation, determined using an IP database fromDB-IP.com stored on our server and the public DNS name of the IP address) and with what type of device.

When you sign in to MILQ, the IP address is also stored for your login session. If it matches a website visit, we link that visit to your account — this shows us how customers found MILQ. We do this out of legitimate interest in improving our service and making it better known. The evaluation runs exclusively on our server in Switzerland; none of it is passed on to third parties.

IP address, browser identification and DNS name are deleted after no more than 30 days. After that, only coarse information (page, origin, country, network operator, device type) is kept for at most two years; a link to your account remains for as long as the account exists. You can object to this evaluation at any time — a short message toinfo@milq.ch is enough.

No trackers

MILQ uses no advertising or analytics cookies, no tracking scripts and embeds no third-party services on the site. There is therefore also no cookie banner. Only technically necessary cookies are set for your login session.

Data processors

• Hosting: Infomaniak Network SA, Geneva, Switzerland. Server location Switzerland. Storage of the database and receipts.
• Email delivery: Resend (Resend, Inc., USA), exclusively for verification and password emails. Name and email address are transmitted. As Resend is based in the USA, the transfer is based on standard contractual clauses and the Data Privacy Framework.
• Receipt recognition: OpenRouter (OpenRouter, Inc., USA) with models from Google (Gemini). Only when you have a receipt recognised automatically is that receipt transmitted to read out amount, date and category. The transfer to the USA is based on standard contractual clauses or the Data Privacy Framework. The receipt itself is stored exclusively in Switzerland.
• Payment processing: Stripe. Credit card and payment data are processed exclusively by Stripe — we do not see or store them.

Retention period

Account data is stored for as long as your account exists. Bookkeeping data is subject to the statutory retention obligation of 10 years under Article 958f of the Swiss Code of Obligations — we are therefore also not permitted to delete it early as long as you have not expressly requested deletion and the period has expired.

Your rights

Under Swiss data protection law, you have the right to:

• Information about the data relating to you that we process
• Rectification of inaccurate data
• Deletion, provided no retention obligation prevents it
• Portability of your data in a common format (data portability)

A complete export as PDF, CSV, and receipt archive can be triggered by you at any time from your account — you do not need to ask us for this.

Security

All transmission is encrypted via HTTPS. Passwords are stored only as hashes. The database is continuously backed up in encrypted form. Changes to entries are logged, as required by the Swiss Ordinance on Commercial Bookkeeping.

Changes

This policy may be amended if processing changes. The version published on this page is authoritative.