Privacy Policy

At a glance

Quoven is operated by Mathieu Mafille from Switzerland. We process personal data to deliver the service, bill you, keep the product secure, and communicate with you. We never sell personal data and we do not run advertising on the service.

This policy explains, in plain terms, what we collect, why, how long we keep it, and what control you have. It is written for users in the European Union, Switzerland, the United Kingdom, and elsewhere, and is governed primarily by the EU General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP / nLPD).

It applies to personal data we process when you visit quoven.io, create an account, use the Quoven service (including dossiers, briefs, and exports), receive emails from us, or contact us. It does not apply to third-party services we link to, which have their own privacy practices.

Who is the data controller

The data controller for the processing described in this policy is:

What personal data we collect

Why we process your data and on what legal basis

The lawful bases we rely on, under GDPR art. 6(1):

Contract — art. 6(1)(b)

Creating and maintaining your account, providing access to dossiers and exports, processing your subscription, and providing customer support.

Legal obligation — art. 6(1)(c)

Keeping invoicing and accounting records for ten years under article 958f of the Swiss Code of Obligations; responding to lawful requests from authorities.

Legitimate interests — art. 6(1)(f)

Operating the service securely (abuse prevention, fraud detection, rate-limiting); maintaining and improving product quality (debugging, error tracking, product and usage analytics); sending onboarding and service-related emails after you sign up; protecting our legal rights.

Consent — art. 6(1)(a)

Setting optional product-analytics cookies and recording masked session replays through PostHog, and sending optional marketing or research emails where applicable. You can withdraw consent at any time — for cookies and replay from the Cookie Policy page, and for emails from the email itself — or by writing to privacy@quoven.io.

When we rely on legitimate interests, we balance our need against your rights and freedoms. You can object to processing based on legitimate interests at any time.

How long we keep data

Account data

For as long as your account is active. Deleted within 30 days of account closure, unless a longer retention is required by law.

Briefs, dossiers, and exports

For as long as your account is active. Deleted within 30 days of account closure.

Billing records and invoices

Ten years from the end of the financial year in which the transaction occurred (art. 958f of the Swiss Code of Obligations).

Inactive accounts

Accounts with no sign-in or activity for 24 consecutive months are deleted automatically. We will send a warning email before deletion.

Server and security logs

Up to 30 days, then deleted or aggregated. Security incidents may be retained for longer where necessary to investigate or respond.

Product analytics and error events

Usage and error events collected through PostHog (hosted in the EU) are retained per the PostHog retention policy; we review and prune what we no longer need.

Email correspondence

Up to 24 months from the last message in the thread, unless we need to keep it longer to resolve a dispute.

Backups

Encrypted database backups are rotated; deleted data may persist in backups for up to 30 days before being overwritten.

Who we share data with

We do not sell personal data. We share it only with the parties listed below.

International transfers

Several of our sub-processors are based in the United States. When personal data is transferred outside the European Economic Area or Switzerland, we rely on the European Commission’s Standard Contractual Clauses (SCCs) and, where applicable, the EU–US Data Privacy Framework and the Swiss–US Data Privacy Framework. We assess each transfer for additional safeguards and document our analysis where the law requires it.

Your rights

Subject to local law, you have the right to access the personal data we hold about you, to ask us to correct it, to ask us to delete it, to ask us to restrict or object to processing, and to receive a portable copy of data you have given us. You can also withdraw consent at any time where we rely on it.

To exercise any of these rights, write to privacy@quoven.io. We respond within 30 days and may ask for information needed to confirm your identity before acting.

If you believe we have not handled your data correctly, you can complain to a supervisory authority. In Switzerland, this is the Federal Data Protection and Information Commissioner (FDPIC). In the European Union, this is the data protection authority of your country of residence.

How we secure your data

We rely on industry-standard safeguards: TLS in transit for every request; encryption at rest at the database, storage, and backup layers; access controls and audit logs; the principle of least privilege for everyone with operational access; and security patches applied through our providers’ managed services. We review our sub-processors’ security posture before onboarding and at regular intervals.

No method of transmission or storage is fully secure. If a breach affects your personal data and is likely to result in a risk to your rights, we will notify the relevant supervisory authority within 72 hours and notify affected users without undue delay.

Cookies

Quoven always sets the cookies needed to keep you signed in and to process payments, and never uses advertising cookies. Our analytics are cookieless by default; optional analytics cookies and session replay are set only with your consent and can be withdrawn at any time. See the Cookie Policy for details.

Automated decision-making

We do not make decisions that produce legal or similarly significant effects about you using solely automated means. The dossiers Quoven generates are decision support, not automated decisions: a human (you) is always in the loop.

Children

Quoven is not directed at children. You must be at least 18 years old to create an account. If you believe a child has provided us personal data, please contact privacy@quoven.io and we will delete it.

Changes and contact

We may update this policy from time to time. We will give you reasonable advance notice by email of any material change before it takes effect; minor changes, such as clarifications, may take effect immediately. The Last updated date at the top of this page always reflects the current version.

For any question about this policy or your personal data, write to privacy@quoven.io or to the postal address in our Legal Notice.