Privacy policy

1. Controller

restful GmbH, Engehaldenstrasse 20, 3012 Bern, Switzerland, is responsible for the processing described here. For all questions about data protection, write to privacy@commelia.com.

2. Conversations our customers hold with Commelia

Organisations use Commelia to talk to their visitors via web chat, email, WhatsApp or Threema. For this content, the organisation is the controller and we process the data on its behalf, based on a data processing agreement. If you wrote to an organisation via Commelia, please address requests about your data to that organisation. We will support it.

3. Visiting our website

When you visit commelia.com, commelia.ch or commelia.de, our servers process technical data that every browser sends: IP address, date and time, the page requested and browser information. We use it to deliver the website and protect it against misuse, and keep it only briefly.

We use no analytics, no tracking cookies and no advertising. We only store settings in your browser that you choose yourself:

• the language you chose (cookie “commelia_lang”, one year),
• the currency shown in the prices and the light or dark display (local storage).

4. Our website chat

You can write to us via the chat on our website. We process your messages, the email address if you give one, and a random visitor identifier stored in your browser. Our AI assistant may answer first; it uses the AI providers described in section 7. When you end the chat, you can have your messages deleted right away.

5. Your Commelia account

When you or your organisation register, we process the data needed to provide the service:

• name, email address and password (stored only as a hash),
• organisation, projects, roles and group memberships,
• sessions with IP address and browser, two-factor settings and notification preferences,
• records of important actions in the audit log,
• plan, subscription and invoicing data.

6. Purposes and legal bases

We process personal data to provide our website and service, communicate with you, keep the service secure, meet legal obligations and improve our offering. Where the GDPR applies, we rely on the performance of a contract (Art. 6(1)(b) GDPR), our legitimate interests in a secure and functioning service (Art. 6(1)(f) GDPR), legal obligations (Art. 6(1)(c) GDPR) and, where requested, your consent (Art. 6(1)(a) GDPR).

7. Artificial intelligence

AI features send the text needed for each request to AI models via OpenRouter. We use OpenRouter's EU routing and only providers that do not store the data or use it for training. Organisations can hide personal data from the AI provider, switch AI to suggestions only or turn it off. Knowledge suggestions and summaries are anonymized before they are stored.

8. Recipients and service providers

We do not sell personal data. We share it only with service providers that process it on our behalf, or where the law requires it:

• Infomaniak (Switzerland): hosting, database, files and backups,
• Sweego (France): delivery of emails,
• OpenRouter (EU routing) and the AI providers it routes to: AI features,
• Meta (WhatsApp) and Threema (Switzerland): only for organisations that connect these channels,
• browser push services (for example from Google, Mozilla or Apple): notifications for team members who enable them; the content is end-to-end encrypted.

9. Transfers abroad

We store data in Switzerland. Email delivery takes place in France, which offers adequate data protection according to the Swiss Federal Council and the EU. Where data is processed in a country without adequate protection, such as the USA, we use the standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC) and the European Commission, or another permitted safeguard.

10. Retention

We keep personal data as long as needed for the purposes described or required by law. Account data is deleted after the contract ends. When an organisation is deleted, its data is purged after 30 days. Customers set their own retention for conversations. Encrypted backups expire after at most twelve months. Accounting records are kept for ten years as required by Swiss law.

11. Security

We protect data with technical and organisational measures, including TLS encryption, AES-256-encrypted backups, encrypted storage of credentials, two-factor authentication, role-based access and a tamper-proof audit log. Our infrastructure runs in ISO 27001-certified data centres in Switzerland.

12. Your rights

Within the applicable law, you have the right to:

• access the personal data we hold about you,
• have incorrect data corrected,
• have your data deleted or its processing restricted,
• receive your data in a common electronic format,
• object to processing and withdraw consent at any time.

13. Complaints

Write to privacy@commelia.com first; we will do our best to help. You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch) or, in the EU, with the supervisory authority of your country.

14. Changes

We may update this privacy policy when our service or the law changes. The version published on this page applies.

Contact

restful GmbH
Engehaldenstrasse 20, 3012 Bern
privacy@commelia.com