Privacy policy

01Who is responsible

Z83 AG, Hauptgasse 30, 4600 Olten, Switzerland (UID CHE-275.767.374) is responsible for the processing described in this policy.

For all questions about data protection and to exercise your rights, contact us at mail@z83.ch or by post at the address above.

We have not appointed a data protection advisor under the FADP. As a Swiss company we do not need a representative in Switzerland.

02Our two roles

Controller: your account, our customers and our website

We decide how and why we process the personal data of the people who use neoo (user accounts, logins, devices), of our customers' contact persons (contracts, billing, support) and of visitors to our website. This policy fully applies to that data.

Processor: the data our customers keep in neoo

Our customers use neoo to keep their books: customers, suppliers, contact persons, invoices, receipts, bank transactions, payment orders, expenses and employee data. For this data the customer is the controller and we act as processor. We process it only to provide neoo and according to the customer's instructions, as agreed in our terms and data processing agreement. We do not use it for our own purposes, do not sell it and do not use it to train AI models.

If you are a business partner or employee of one of our customers and want to know what data is held about you, please contact that company. If you contact us, we will forward your request to them.

03What data we process

Account and user data

• Name, email address, password (stored only as a one-way hash), language and display settings.
• Optional profile details: phone, address and bank details (IBAN, BIC) — used, for example, to reimburse your expenses.
• Two-factor authentication data and the roles and permissions you hold in each company (dataset).

Login, device and security data

• For each signed-in device: IP address, browser or app type (user agent), a device identifier and the time of sign-in and last activity.
• Failed login attempts (email address or IP address) to protect accounts against attacks.
• A record of changes made in neoo (who changed which entry, when and what) so that bookkeeping stays traceable.

Customer data (processed on our customers' behalf)

• Master data of customers, suppliers and contact persons: names, addresses, phone numbers, email addresses, tax numbers and bank details.
• Bookkeeping data: transactions, invoices, credit notes, receipts and the documents attached to them.
• Bank data: account statements, bank transactions (counterparty name, IBAN, payment reference) and payment orders.
• Expenses, including receipt photos and reimbursement details.
• Employee data where a customer maintains it in neoo, for example name, contact details, date of birth and AHV number.
• Documents and emails that customers or their suppliers send to a neoo inbox address.
• Questions asked in the AI chat and its answers.

Support data

The content of support requests and tickets, including attachments, the participants and the page in neoo from which a request was sent.

Customer and billing data

Company and contact details of our customers, contracts, invoices and payments.

04Why we process data

• Providing neoo: accounts and sign-in, bookkeeping, invoicing, banking and payment functions, document processing, expenses, notifications and integrations the customer activates.
• Security: protecting accounts and systems, detecting misuse, keeping backups and investigating incidents.
• Support: answering requests and solving problems. Authorised Z83 AG staff may access a customer's company data in neoo where this is needed for support, operations or a bookkeeping or review service the customer has commissioned from Z83 AG.
• Contract and billing: concluding and managing contracts with our customers and invoicing them.
• Information about neoo: emails about new features and changes. You can unsubscribe at any time using the link in each email or in your profile.
• Legal obligations: for example retaining our own business records.
• Improving neoo: we analyse technical information (for example error reports) to fix errors and make neoo more reliable.
• Website analysis: we analyse how visitors use our website neoo.ch to improve it and our communication (see “Website and cookies”).

05Artificial intelligence

neoo uses AI to read documents and to answer questions. This is how it works:

• Document processing: when a document is uploaded, photographed or sent to a neoo inbox, the document (PDF or image) is sent to an AI provider, which extracts the relevant information, for example supplier, amounts, VAT and payment details. To match the document correctly, the request also contains context from the company's data, such as its own company details and bank accounts, the names of its customers or suppliers and the chart of accounts.
• AI chat: questions asked in the AI chat, the relevant data from the company's bookkeeping and the conversation history are sent to an AI provider to produce the answer. Answers are generated by AI and may be wrong.
• Other assistance: AI also helps, for example, to recognise duplicate suppliers, to split scanned pages into individual receipts and to suggest expense categories (the latter only if you switch it on).

AI results are suggestions. Users check and approve them, and approval workflows decide who may post or pay what. neoo does not make decisions about individual people that have legal effect or similarly significant effects based solely on automated processing.

The AI providers we use are listed in section 7. Under their terms for business customers they do not use the data to train their models. They may keep requests for a limited time to detect misuse.

06Where the data comes from

Most data comes from you or from the company you work for. Further data comes from documents and emails sent to neoo, from banks and payment services the customer connects (account statements and transactions), from other systems the customer connects (for example shop or project management software) and from public registers (for example the Swiss commercial register, Zefix).

07Service providers and other recipients

We use carefully selected service providers. They process data only on our instructions or on behalf of our customers and are bound by contract to confidentiality and data security.

Services activated by the customer

If a customer connects them, data is exchanged with banks and payment services (for example KonfiPay, Wise, Revolut Business, Amnis) and with other software (for example Shopify, Microsoft Dynamics 365 Business Central, MOCO) to the extent needed for the function. Payment orders are released by the customer at the bank or payment service. These providers process the data under their own terms and privacy policies.

Other recipients

Emails a customer sends from neoo (for example invoices) go to the recipients chosen by the customer. We disclose data to authorities only where we are legally required to do so.

08Disclosure abroad

We store neoo, its databases and files in Switzerland. Some of the providers listed above process data abroad, in particular in the EU/EEA (France, Estonia) and the USA; Google processes data worldwide.

The EU/EEA countries provide adequate data protection under Swiss law. For the USA, we rely on the Swiss-U.S. Data Privacy Framework where the provider is certified (Google), and otherwise on the standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC), as included in the providers' data processing terms (Anthropic, OpenAI).

09How long we keep data

We keep personal data only as long as needed for the purpose, or longer if the law requires it or we need it to establish or defend legal claims.

Our customers are themselves obliged to retain their business books and accounting records for 10 years (Art. 958f of the Swiss Code of Obligations). Each customer remains responsible for archiving its data accordingly, for example by exporting it before the end of the contract.

10Data security

We protect data with technical and organisational measures appropriate to the risk, in particular:

• Hosting in Switzerland and encrypted transmission (HTTPS).
• A separate database for each customer company and permissions that control what each user may see and do.
• Passwords and access keys stored only as one-way hashes, optional two-factor authentication and protection against repeated login attempts.
• Sessions that can be viewed and signed out per device, a record of changes and encrypted backups.
• Integration credentials stored encrypted.

No system is completely secure. If a data security breach is likely to lead to a high risk for the people concerned, we inform the FDPIC and, where needed, the people affected.

11Mobile apps

• Camera and photos: the app asks for access only when you take or choose a photo of a receipt. Photos are cropped and converted on your device and then uploaded to neoo.
• Push notifications: only if you allow them. We then store a device token from Google Firebase Cloud Messaging. Notifications contain no amounts or personal names, only the type of event (for example a ticket reply) and, where relevant, the company name.
• On the device the app stores your sign-in key, a device identifier and your settings. Signing out removes the sign-in key. In the app you stay signed in until you sign out or end the session.
• Updates: the app receives updates through Capgo. Capgo processes the app version, an anonymous device identifier and technical information about the update and app errors.
• The apps contain no advertising or tracking and no analytics tools.

12Website and cookies

When you visit our website neoo.ch, the server automatically logs technical information (IP address, time, page, browser) to operate it securely. Fonts and videos are served from our own server.

Google Analytics

To understand how the website is used and to improve it, we use Google Analytics, a service of Google Ireland Limited and Google LLC (USA). Google Analytics sets cookies in your browser (_ga and _ga_…, kept for up to 2 years) and records, for example, which pages you visit and for how long, scrolling, clicks on links and on the demo booking, video views, the website you came from, your approximate location (country and city), and your device, browser and screen size. Google uses your IP address to determine the location but does not store it in Google Analytics.

We have also activated Google Signals. If you are signed in to a Google account and have allowed ad personalisation, Google can recognise your visits across your devices and provide us with aggregated information, for example on age groups, gender and interests. We only receive aggregated statistics and cannot identify individual visitors or Google accounts. How Google itself uses data linked to your Google account is governed by the Google privacy policy and your Google account settings.

Google processes the data in the USA and other countries (see “Disclosure abroad”). We keep Google Analytics data for 14 months.

How to opt out

• Use the switch below to turn off Google Analytics in this browser. We store your choice in your browser's local storage; if you clear it or use another browser or device, you need to opt out again.
• Install Google's browser add-on to opt out of Google Analytics.
• Turn off personalised ads in My Ad Center of your Google account; Google Signals then no longer links your visits to your account.
• Block or delete cookies in your browser settings.

neoo web application

The neoo web application uses no cookies and no analytics tools. It stores your sign-in key and settings in your browser's local storage, which is necessary for it to work. Signing out removes the sign-in key.

13Your rights

Within the limits of the applicable law you have the right to:

• request access to your personal data,
• have incorrect data corrected,
• have data deleted or its processing restricted,
• receive the data you provided to us in a common electronic format,
• object to processing and withdraw consent at any time with effect for the future.

To exercise your rights, write to mail@z83.ch. We may ask you to prove your identity. We generally reply within 30 days. Where we must keep data by law (for example accounting records), we cannot delete it, but we restrict its use to that purpose.

You can request the deletion of your neoo user account at any time by writing to mail@z83.ch. Data that a company has entered in its bookkeeping remains with that company.

You also have the right to lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC, edoeb.admin.ch).

14Users in the EU/EEA

Where the GDPR applies, we process personal data on the following legal bases: performance of a contract (Art. 6(1)(b) GDPR), legal obligations (Art. 6(1)(c)), our legitimate interests in providing a secure, functioning and improving service, in analysing the use of our website and in informing customers about neoo (Art. 6(1)(f)), and consent where we ask for it (Art. 6(1)(a)). You can also lodge a complaint with the data protection authority in your country.

15Children

neoo is intended for businesses and their staff. We do not knowingly process personal data of children.

16Changes to this policy

We may update this policy when our services or the law change. The version published on this page applies. If the German and English versions differ, the German version prevails.