Privacy Policy — BeMyTalent

Version: 1.8 Last updated: October 13, 2026 Effective date: October 13, 2026 Data controller: Ekylibr SA (Switzerland)

This policy describes how BeMyTalent collects, uses and protects your data in accordance with the Swiss Federal Act on Data Protection (FADP/revFADP) and, where applicable, the European General Data Protection Regulation (GDPR).

🇨🇭 Where your data is stored and processed. Since August 8, 2026, BeMyTalent's database, authentication and files (accounting documents, invoices, payroll documents) have been stored in Zurich (Supabase, AWS region eu-central-2). The server functions that process your requests also run in Zurich when the request is sent from Switzerland; this is not a general guarantee: a request coming from abroad (travel, notification from a provider) may be processed outside Switzerland. Files may be cached temporarily close to the person viewing them, and backups and technical logs are managed by Supabase, whose region is not confirmed in writing to date. Some specific tasks are entrusted to service providers, several of them outside Switzerland (reading of documents, e-mails, voice dictation, integrations you enable): they are named in §4, 4ter and 5.

---

1. Who are we?

Ekylibr SA publishes the BeMyTalent application ("BMT"), a financial management platform (forecasting, accounting, payroll, invoicing, CRM, quotes, inventory, mandates) intended for entrepreneurs, self-employed professionals and small businesses/SMEs based in Switzerland.

Data protection contact:

• Email: privacy@bemytalent.com
• Postal address: Ekylibr SA, Avenue du Mail 18, 2000 Neuchâtel, Switzerland
• UID: CHE-378.933.385

---

2. Data we process

2.1 Data you provide directly

Third-party data (employees, clients, contacts). When you enter into BMT data relating to persons other than yourself — your employees (Payroll module), your clients, your CRM contacts — you are the controller of that data within the meaning of the FADP/GDPR; BMT acts as a processor on your behalf. It is your responsibility to inform those persons and to have a legal basis for that processing.

2.2 Data collected automatically

We do not use advertising cookies or third-party marketing tracking (no Google Analytics, no Meta Pixel, no Hotjar).

2.3 Mobile applications (iOS and Android)

BMT is also available as an installable application (PWA, iOS application distributed via the App Store and Android application distributed via Google Play). The applications process the same data as the web version — no additional processing, with the following clarifications:

• Camera, microphone, photo library: used only when you scan a document, dictate a voice message to the built-in assistant or attach a photo. Capture takes place on your device; only the file you confirm is transmitted to our servers (a dictated message is transcribed by OpenAI, see §4ter). No background access.
• No advertising tracking: the applications contain no advertising SDK, no advertising tracking identifier (IDFA) and no cross-app tracking.
• Account deletion: available directly in the applications (Settings → Account), with the same effects as from the web (see §6).
• In-app purchase (App Store): on iOS, the subscription can be purchased through Apple's in-app purchase. Payment is processed exclusively by Apple — we never see your payment method. To link the subscription to your account, our provider RevenueCat processes your user identifier (UUID), the Apple transaction identifier, the purchased product and the subscription status (see §5).
• Android: the Android application does not offer in-app purchase; the subscription is purchased on the website.

---

3. Why we process this data

• Providing the Service: bookkeeping, payroll, forecasting calculations, CRM management, generation of quotes and invoices, statutory exports.
• Security: audit trail, anomaly detection, authentication.
• Legal compliance: Swiss accounting obligations (Art. 957–963 CO), VAT, archiving.
• User support: responding to your requests, debugging where you explicitly authorize us to do so.
• Billing: Stripe (website) and Apple (in-app purchase in the iOS application) for subscription management (see §5).

We never process your data for third-party marketing, resale, automated decision-making profiling or AI model training. This commitment applies to BeMyTalent, subject to the reservation concerning the built-in assistant (§4ter.1); the external AI assistants that you choose to connect are described in §4ter.

---

4. OCR — Mistral as processor

Read carefully if you use the assisted Accounting module. Automatic reading (OCR) starts for every document dropped into Accounting, including by photo, by sharing from your phone or by e-mail; for a document dropped in the application it cannot be switched off, and only the e-mail drop address has settings that stop it (see §4.3). To read the document, we send Mistral AI (EU) a temporary download link (valid for 5 minutes). Mistral is our only document-reading provider: no other service receives the document as a fallback. Since October 11, 2026, no document is sent to OpenAI any more. If Mistral cannot read the document or is unavailable, it is declared unreadable and you enter it by hand: we never invent an amount.

4.1 Mistral AI — OCR provider (since 2026-08-11)

• Identity: Mistral AI SAS, France (EU)
• Role: processor within the meaning of Art. 28 GDPR and Art. 9 revFADP
• Data transmitted: a signed download link, valid for 5 minutes, to the document (PDF/JPG/PNG) that you upload; Mistral downloads the document to read it
• Purpose: extraction of structured fields (supplier, date, amounts excl./incl. VAT, VAT, currency, payment method)
• API used: api.mistral.ai/v1/ocr (model mistral-ocr-latest)
• Retention and training: our calls go through a paid, professional-plan Mistral account on which the option allowing API calls to be used to train the models is disabled (checked on October 12, 2026). Under their DPA, temporary retention for processing and abuse monitoring, then deletion. Check their policy: https://mistral.ai/terms/#privacy-policy
• Server location: EU
• Transfers outside the EU: none in the configuration used.

4.2 No fallback provider

• Mistral is the only provider that receives your documents to read them: no other reading service takes over.
• If Mistral is unavailable, cannot read a document or only produces a reading that is too uncertain, the document is declared unreadable: it stays in your Accounting, you enter it yourself or run the reading again later, and we never invent an amount.

4.3 Your OCR-specific rights

• Opting out: for a document dropped in the application (upload, photo, sharing), OCR is automatic and cannot be switched off. For the e-mail drop address, setting "Documents read per month" to 0 stops the automatic reading of the documents received, and the "Project members only" setting does not read documents sent by anyone else: those documents are kept, but not read. If you do not want a document to be transmitted, do not drop it into Accounting and do not send it to the e-mail drop address: the Accounting module remains fully usable with manual entry.
• Deletion: deleting an attachment in BMT triggers deletion of the file from our Storage. The link sent to Mistral expires on its own after 5 minutes; any temporary copy held by Mistral follows its policy (see §4.1).

---

4bis. Bexio migration and synchronization (processor)

Read this if you enable the Bexio integration. The Bexio integration is optional but, if enabled, it involves bidirectional transfers of accounting data between BMT and Bexio AG.

4bis.1 Bexio AG — processor

• Identity: Bexio AG, Pulverstrasse 11, 3063 Ittigen, Switzerland
• Role: processor within the meaning of Art. 9 revFADP and Art. 28 GDPR (equivalent)
• Legal framework: Switzerland — EU → Switzerland adequacy decision in place (GDPR-compatible)

4bis.2 Use cases and data concerned

Initial connection with a personal token: you create a personal API token ("Personal Access Token") yourself at Bexio and paste it into BeMyTalent. The rights of that token are the ones you give it at Bexio: BeMyTalent does not control their scope, and you can revoke the token at Bexio at any time. The token is encrypted by our server functions with AES-256-GCM before it is stored, with a key kept outside the database (§8).

Outbound synchronization BMT → Bexio (quotes, Shopify invoices, etc.):

• Quotes and customer invoices that you create in BMT and choose to push to Bexio
• Product lines, amounts, VAT, due dates
• Associated contacts (customers) at the time of the push

Outbound migration Bexio → BMT (Accounting module, opt-in):

• Tier 1 (opening balances): pull of the chart of accounts + non-archived contacts + balances as at the cut-over date. Volume: ~200 accounts + ~500 contacts + 200 balances for a typical project.
• Tier 2 (aggregated history): pull of monthly balances per account over 1 to 10 years, at your discretion. Volume: N accounts × M months.
• Tier 3 (detailed entries): pull of all Bexio accounting entries over 1 to 10 years, at your discretion. Volume: potentially several thousand entries, with descriptions, accounts, amounts, dates.

4bis.3 Direction of the data and purpose

• Bexio → BMT pulls: the imported data becomes your data in BMT, subject to the 10-year retention period (Art. 958f CO). Bexio remains the historical source, but BMT becomes a copy of it.
• BMT → Bexio pushes: the pushed data is stored at Bexio under your contract with Bexio, independently of BMT.
• No third-party use: we do not consult your Bexio accounting data for any other purpose (statistics, recommendations, etc.). The migration pipeline is purely transitory.

4bis.4 Rate limit and Bexio API plan

To respect the Bexio API limits (free ~100 req/min, pro ~500 req/min), you declare your plan in BMT when launching each migration. This information is used solely to adjust throttling on the BMT side and is not transmitted to Bexio.

4bis.5 Post-migration verification

At the end of each Bexio → BMT migration, BMT automatically compares the imported balances with the Bexio balances (a control re-pull) to detect any discrepancies. This double read does not create an additional transfer: it involves the same data already imported.

4bis.6 Retention at Bexio

Bexio applies its own retention policy. See: https://bexio.com/fr-CH/dpa

4bis.7 Disabling the integration

You may revoke the Bexio connection at any time via Settings → Bexio → Disconnect. Disconnecting:

• Deletes the encrypted personal Bexio token on our side (it stays valid at Bexio until you revoke it there yourself)
• Does not erase the data already imported into BMT (that data has become yours)
• Does not erase the data pushed into Bexio (your contract with Bexio governs that data)

---

4ter. Built-in assistant, voice dictation and external AI assistants

Optional. This section concerns you only if you use the AI Agents module (built-in assistant) or voice dictation, or if you yourself connect an AI assistant to your data. Otherwise, no data is sent to these services.

4ter.1 Built-in assistant (AI Agents module) — Ekybot

• Role: processor that operates the assistant built into BMT (optional module, enabled project by project)
• Data transmitted: the messages you write to the assistant, the conversation history, signed links to attachments, and the technical identifiers of the user, the project and the channel
• Location: Ekybot's hosting and the AI model used are being confirmed; we will update this policy as soon as they are. Until then, entrust to the assistant only what you accept to see processed outside Switzerland. Until the model used is confirmed, we cannot guarantee that your messages to the built-in assistant are not used to train an AI model; the commitment in §3 applies in full as soon as it is confirmed.

4ter.2 Voice dictation — OpenAI

• Identity: OpenAI, L.L.C., United States
• Role: processor within the meaning of Art. 28 GDPR and Art. 9 revFADP
• Data transmitted: the audio file of the message you dictate to the built-in assistant, only when you use dictation. No accounting document is sent to OpenAI.
• Purpose: transcription of the message into text (Whisper model)
• Endpoint: api.openai.com (USA)
• Retention at OpenAI: OpenAI states that it does not train its models on data submitted via the API (by default since March 2023). Maximum 30-day retention for abuse monitoring, then deletion.
• Location: United States
• Transfers outside the EU/CH: governed by the Standard Contractual Clauses (SCC). For Swiss users, the revFADP recognizes the SCC as appropriate safeguards.

4ter.3 External AI assistants that you connect

You can give an AI assistant of your choice (for example Claude or ChatGPT) limited access to your data, by means of an API key that you create in Settings. These assistants are services of their providers, which you choose and connect: what they read, in the areas you open to them, is transmitted to their provider (often in the United States), at your initiative and under its terms. Each key is limited to the areas you choose and can be revoked at any time; sensitive operations remain reserved for a human action in the application.

---

4quater. Google user data (Gmail)

Please read if you connect Gmail. This section only concerns you if you click "Authorize Gmail" (Settings → CRM & communication → Gmail card). Otherwise, BeMyTalent receives no data from Google. It completes the "Google" row of §5.

4quater.1 What BeMyTalent asks Google for

With BeMyTalent's Google application ("Authorize Gmail" button), BeMyTalent asks Google for three permissions, and only these:

• Send e-mails on your behalf (gmail.send): to send, from your Gmail address, the e-mails you write or send from BeMyTalent, including your quotes, invoices and payment reminders (with their PDF);
• Know the e-mail address of your Google account (userinfo.email): to show it in the application and use it as the sender address;
• Identify you (openid): so that Google's response designates the account you authorized.

BeMyTalent does not ask for permission to read, modify or delete your Gmail mailbox: it cannot read your received or sent e-mails, your drafts, your labels or your Google contacts.

"Your own Google application" option. If you also want to read your e-mails in BeMyTalent (Inbox, synchronization of the exchanges with your CRM contacts), you create your own application at Google and entrust us with its Client ID and Client Secret; you then grant it permission to read your mailbox in addition to sending. In this mode, BeMyTalent goes through your recent e-mails and reads the list of your sending addresses (aliases); it keeps only the e-mails exchanged with the addresses of your CRM contacts (sender, recipient, subject, text, date; not attachments) and stores them in your Inbox and your CRM. The rest of this section also applies to this mode.

4quater.2 Data received from Google, use and retention

Single purpose. BeMyTalent uses this data only to send, from your address, the e-mails that you write in BeMyTalent and whose sending you trigger yourself (CRM message, draft that you review and then send, bulk send that you start, reply from the Inbox, sending a quote, an invoice or a payment reminder, following up a quote from a dossier). No e-mail leaves through Gmail without this action on your part. If Gmail refuses the sending of a quote, an invoice or a payment reminder, the e-mail goes out from BeMyTalent's address, as it would without Gmail.

4quater.3 Where and how this data is kept

The tokens and the address are kept in BeMyTalent's database, in Zurich (see the notice at the top of this policy for the exact scope of that commitment). The tokens are kept in a private vault, not reachable from the browser or by other users, which only our server functions read at the moment of sending; they are never returned to the application. Each token is also encrypted with AES-256-GCM, with a key kept outside the database (§8). Exchanges with Google go through TLS; encryption at rest is that of our hosting provider (§8).

4quater.4 What we do not do with data received from Google

• We use it only to provide the sending feature described above, which is visible to you in the application.
• We do not sell it and do not use it for advertising (no targeting, no retargeting), nor to assess your creditworthiness or for lending purposes.
• We do not transfer it to anyone, except: to Google; to our technical processors when strictly necessary to provide this feature (hosting, §5); where the law requires it; for security (investigating an abuse or an incident); or in a merger or takeover of the company, with your prior explicit consent.
• Nobody on our side reads the content of your e-mails or the data received from Google, except with your explicit consent for a specific case (for example a support request), for security (investigating an abuse or an incident) or where the law requires it.
• We do not use it to develop, improve or train artificial-intelligence or machine-learning models of general use. Your Gmail address and your tokens are never sent to the built-in assistant or to external AI assistants (§4ter).
• The text of an e-mail you send, once copied into your CRM, is ordinary CRM data (§2.1): if you yourself connect an external AI assistant to your CRM (§4ter.3), you decide what it may read.

4quater.5 Disconnecting Gmail and revoking access

• In BeMyTalent: Settings → CRM & communication → Gmail card → "Disconnect Gmail". BeMyTalent asks Google to revoke the authorization, then erases your tokens and the address recorded for the connection. If the same Google account is still connected in another of your projects, revocation at Google is not requested (it would cut the other project): this project's tokens are erased, but the authorization stays valid for the other project. If Google does not answer, the disconnection still completes in BeMyTalent: check at Google in that case.
• At Google, at any time: https://myaccount.google.com/permissions → BeMyTalent → remove access. BeMyTalent can then no longer send anything.
• Deleting the project or the account: the tokens are erased together with the project when it is permanently deleted. That deletion does not ask Google to revoke: disconnect Gmail beforehand, or revoke access at Google.
• E-mail copies: they stay in your CRM until deleted under §6; to request their erasure, write to privacy@bemytalent.com (§7).

4quater.6 Compliance with Google's policy

BeMyTalent's use and transfer to any other app of information received from Google APIs will adhere to Google API Services User Data Policy, including the Limited Use requirements.

---

5. Other processors (sub-processors)

This list is kept up to date. For any material update, we will notify you by email at least 15 days before it takes effect.

---

6. Retention periods

---

7. Your rights

Under the Swiss FADP/revFADP and, where applicable, the European GDPR, you have the following rights:

• Access: obtain a copy of your data — "Export all data" button in Project settings.
• Rectification: modify your data via the application or by email request.
• Erasure ("right to be forgotten"): subject to statutory retention obligations (10 years for accounting). Account deletion available in Settings → Account (web, iOS and Android applications).
• Restriction: request the suspension of a processing operation.
• Portability: retrieve your data in a structured format (CSV, Excel, PDF — already available via the native exports).
• Objection: object to processing based on legitimate interest.
• Withdrawal of consent: at any time for processing based on consent (OAuth integrations). Automatic reading of documents (OCR) is based on the performance of the contract: to keep a document from being read, see §4.3.
• Complaint: you may lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) in Switzerland, or with the supervisory authority of your EU country of residence.

To exercise these rights, send your request to privacy@bemytalent.com. Response time ≤ 30 days.

---

8. Security

• TLS 1.3 encryption in transit, at-rest encryption on Supabase Storage and Postgres.
• Private attachment buckets — access only via short-lived signed URLs (15 minutes).
• Hashed passwords (bcrypt via Supabase Auth).
• The connection secrets of your integrations (access tokens for Gmail, Instagram, WhatsApp and Shopify, Bexio personal API token, Odoo API key, client secrets and webhook verification tokens) are encrypted one by one by our server functions, with AES-256-GCM, before they are stored, with a key kept outside the database, in the protected configuration of our server functions; each encrypted value is bound to its project, its provider and its purpose, and is decrypted only in memory, at the moment of the call to the service concerned. The data these integrations import or send (entries, invoices, messages) is not covered by this encryption: it falls under our hosting provider's encryption at rest and the access rights described above.
• Postgres RLS (Row-Level Security) enforced on all tables — a user can never read another project's data.
• Full audit trail on sensitive accounting actions.
• Strict MIME whitelist on uploads (PDF/JPG/PNG only, 10 MB max).
• Antivirus scanning: every attachment is scanned (ClamAV on Google Cloud Run, Zurich). A file found to be infected is quarantined and cannot be opened at all. Until a document has been cleared, it stays available to its owner but is never displayed inside the application: it is served as a download, so that a booby-trapped file cannot execute in the page.

---

9. Changes to this policy

We may update this policy. Material changes (a new processor, a new processing purpose, more restrictive terms) will be communicated:

• By email to your contact address ≥ 15 days before they take effect.
• In-app via a persistent banner until accepted.

The version in force and its change log are permanently published at https://www.bemytalent.com/en/privacy.

---

10. Change log

---

This policy is written in French. The French version prevails.