Privacy
What we do with your data.
Tax work needs personal data. This page says what we collect, why, where it goes, how long we keep it and what you can ask of us. Plain English, no surprises.
Last updated
Who is responsible
Swiss Consults GmbH, trading as SwissNRI, Chilestieg 21, 8153 Rümlang, Switzerland, is the controller for all data described here. Questions, requests and complaints go to info@swissnri.com. This policy follows the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation applies to you, you have the rights it grants in addition to those listed below.
What we collect, and why
We collect only what the service in front of you needs. By surface:
| Surface | Data | Purpose |
|---|---|---|
| Reading the site | Pages visited, device and browser type, approximate region, referrer, anonymous usage events, unhandled errors | Understand what helps readers, fix what breaks |
| Plan and account | Email address, name, Google account identifier if you sign in with Google, the services you put in your plan, referral code used or shared | Keep your plan across devices, sign you in, apply referral discounts |
| Checkout and invoice | Billing name, address and phone, order lines and amounts, order reference, payment status | Issue a Swiss QR-bill invoice, match your bank transfer, keep the accounting records the law requires |
| Household and documents | People in your filing (name, relation, birth date), canton and municipality, tax register number, PAN, Aadhaar, AHV number, and the documents you upload (PAN card, salary certificates, bank and broker statements, prior returns) | Prepare and file your Swiss and Indian tax returns, which is the mandate you give us |
| Consultation booking | Name, email, chosen time, and anything you write in the booking form | Hold the call and prepare for it |
| Webinar and waitlist forms | Name, email, the webinar or service you asked about | Send the link, the recording and the launch note you asked for |
| Delivery and open status of the emails we send you | Know that invoices and sign-in links arrived |
We do not take card payments on the site. Payment is by bank transfer or QR-bill, so your bank details stay with your bank. We never ask for your tax portal or e-banking passwords.
Legal basis
Under the FADP we may process data when it is needed for a contract with you, for a legitimate interest, or with your consent. For tax preparation the basis is the mandate you give us at checkout. For the dashboard, invoices and referral discounts it is the contract. For analytics and the webinar list it is our legitimate interest in running and improving the practice, and you can object at any time. Sensitive data such as identity numbers and income details is processed only for the filing mandate and with your explicit act of uploading it.
Where your data is processed
We run on a small set of providers under contract. Each one processes data only on our instructions.
| Provider | What for | Where |
|---|---|---|
| Google Firebase | Sign-in, database, document storage, server functions, hosting, basic app analytics | Zurich, Switzerland (region europe-west6); hosting edge worldwide |
| Resend | Sending sign-in links, invoices and notifications | United States |
| PostHog | Site and dashboard usage analytics, error capture | European Union (Frankfurt) |
| Zoho Bigin | Customer relationship records: contact, plan, orders, payment status | European Union (Amsterdam) |
| Cal.com | Consultation booking and calendar | United States |
| Our own automation server (n8n) | Relays webinar and waitlist forms to our CRM and mailing list | European Union |
| Google (sign-in) | Optional. Only if you choose "Continue with Google" | Google's data centres, under Google's privacy policy |
Fonts are served from our own hosting. No font or script is loaded from Google Fonts or similar CDNs when you read the site.
Transfers outside Switzerland
Switzerland recognises the European Union as offering adequate protection, so transfers to our EU providers need no further safeguard. Transfers to the United States (Resend, Cal.com, Google for sign-in) rest on the Swiss-US Data Privacy Framework where the provider is certified, and otherwise on the standard contractual clauses recognised by the Federal Data Protection and Information Commissioner.
Indian tax returns are prepared by chartered accountants in India who work with us under contract. India has no adequacy decision. For that transfer we rely on contractual data protection clauses with the preparer and on your explicit instruction when you order an Indian filing. The preparer sees only what the Indian return needs: your identity details, income and investment documents for India, and the prior-year return. Swiss-only filings are never sent to India.
Who sees your data
- Our team in Switzerland, for every mandate.
- Our contracted preparers in India, for Indian filings only.
- The providers above, as processors.
- Tax authorities, when we file on your behalf and with your authorisation.
- Nobody else. We do not sell data, share it with advertisers, or pass it to insurers or banks without a separate mandate from you.
Cookies and local storage
The site works without a cookie banner because we use only what is needed to run it and to measure it. Firebase keeps your sign-in session in your browser's local storage. PostHog sets a first-party identifier so that one visit is not counted as ten. Your plan is saved in your browser until you sign in, then on your account. Nothing here tracks you across other websites. You can clear all of it from your browser settings at any time; you will simply be signed out.
How long we keep it
| Data | Kept for |
|---|---|
| Account, plan, household | While your account exists. You can delete people and documents from the dashboard at any time, and ask us to close the account. |
| Uploaded documents | Until you delete them, or 12 months after the filing they belong to is complete, whichever comes first, unless you ask us to keep them for next year. |
| Invoices, orders, payments | 10 years, as Swiss accounting law requires (Code of Obligations art. 958f). |
| Filed returns and working papers | 10 years, so we can answer a query from a tax authority on your behalf. |
| Referral records | Until the referral is paid out and the accounting period has closed. |
| Webinar and waitlist list | Until you unsubscribe. Every email has an unsubscribe line. |
| Analytics | Aggregated after 12 months; raw events deleted. |
Your rights
You can at any time:
- Ask what data we hold about you and get a copy, in a common file format.
- Have errors corrected.
- Have data deleted, unless a retention duty above stops us. Then we lock it and delete it when the duty ends.
- Object to analytics or marketing, or withdraw consent you gave earlier.
- Complain to the Federal Data Protection and Information Commissioner (FDPIC), Bern.
Write to info@swissnri.com from the address on your account. We answer within 30 days. Requests are free unless they are plainly repetitive.
Security
Data travels encrypted. Documents sit in a private bucket that only you and our team can open; nothing on the site is public by link. Sign-in uses one-time email links or Google, so there are no passwords to leak. If a breach ever affects you, we tell you and the FDPIC as the law requires.
Children
The site and dashboard are for adults. Children appear in our records only as dependants in a parent's filing, entered by the parent.
Changes
When we add or drop a provider, or change how we use data, we update this page and the date at the top. For changes that matter to existing customers we also send an email.