← Back to the homepage

Privacy Policy for LevantiqOne

Self Service for Cloud Basic and Cloud 100% Swiss

v 1.0

Contents

This Privacy Policy describes the processing of personal data by Levantiq AG in connection with the website https://levantiqone.ch/, the app https://app.levantiqone.ch/ and the LevantiqOne Self Service offering. The offering is intended for businesses and persons acting in a professional capacity in Switzerland. It is based on Swiss data protection law; mandatorily applicable foreign data protection law remains reserved.

1 Controller and contact

Levantiq AG, Feldpark 17, 6300 Zug, Switzerland, is the controller for the processing carried out for its own purposes as described below. Please send data protection enquiries and requests for access or deletion to support@levantiq.ch or in writing to the above address marked “Data Protection”.

2 Our role regarding Customer data

We process account, contract, billing and contact data as a controller insofar as we determine the purposes and means ourselves. This concerns, in particular, prospective customers, business contacts and users of LevantiqOne.

By contrast, we generally process content that customers enter into LevantiqOne or have collected through integrations on their behalf. This includes, in particular, contact and customer data, emails, messages, conversation recordings and transcripts, documents, project, task and time data, and inputs and results of AI functions. The relevant customer is generally the controller; its privacy notices and Annex 1 to the Terms on data processing apply. If the customer is itself a processor, the allocation of roles depends on the respective processing chain.

3 Data and purposes of processing

During registration and subscription management, we process the identity, company and contact data provided, the number of users, subscription configuration and permissions, and the accepted contractual version and time of consent. This data serves to conclude, evidence and perform the contract and to manage access and the contractual relationship.

We use Stripe to bill LevantiqOne subscriptions. Card numbers and CVCs are processed exclusively by Stripe and are not stored by Levantiq. We process the data necessary for invoicing, allocating payments and performing the contract.

When you contact us, we process your contact details, the content of your enquiry and the information necessary to respond. The support mailbox and automatic system emails, such as invitations and account management messages, are operated through Infomaniak; emails are sent via Infomaniak SMTP. Support access to content that we process on behalf of customers is subject to the data processing agreement.

Where necessary, we process technical connection, access and log data for secure operation, troubleshooting and investigating misuse.

We receive data from you, your organisation or its account administrators, and the services involved in the processes described. When processing data on behalf of customers, data may also come from authorised integrations, Internet actions instructed by the user and the respective third-party systems.

We also process necessary data to comply with legal obligations and to establish, exercise or defend legal claims. Registration and billing information identified as required is necessary to conclude the contract or provide the service. Without it, we cannot provide the service concerned.

4 Marketing and product updates

Infomaniak is the planned delivery service for optional marketing messages and product updates. Once this function is introduced, we will use the account and contact data required for it only if you activate the relevant option during onboarding or in your account. The option is disabled by default. You can disable it in your account at any time and thereby withdraw your consent to future messages.

You receive necessary contractual, security and system messages and replies to support enquiries independently of this optional subscription, insofar as they are required to perform the contract or handle your enquiry.

5 AI processing and storage

Cloud · Basic: the application, database, files and backups are located entirely with Infomaniak in Switzerland. LLM processing takes place via OpenRouter and Microsoft Azure within the European Union.

Cloud · 100% Swiss: the application, all the storage mentioned and LLM processing are located with Infomaniak in Switzerland.

For both subscriptions, Zero Data Retention applies at the level of the LLM services. Inputs and outputs are not retained there beyond the provision of the service. The AI providers are contractually obliged not to use the data to train models or for other purposes of their own.

However, inputs and results are stored within LevantiqOne as Customer data in the system at Infomaniak. This also applies to information users submit in instructions to Levi Work. The Zero Data Retention commitment at the LLM service therefore does not mean that inputs and results are immediately deleted from LevantiqOne. The deletion rules are set out in Section 8.

Levantiq does not use Customer data processed on customers’ behalf to train AI models or for other purposes of its own, in particular analytics, benchmarking or product improvement. Self Service is not intended for processing secrets subject to statutory professional secrecy obligations, in particular under Article 321 of the Swiss Criminal Code.

6 Levi Work and disclosure to third parties

At the user’s instruction, Levi Work can act on the Internet, transmit information to third-party systems and attempt actions such as placing orders. The data used for the instructed action is transmitted to the websites, services or recipients concerned. Inputs are stored in the system; insofar as they are used for AI processing, they are subject to the processing described in Section 5. Users are responsible for the lawfulness and accuracy of their inputs and for their instructions and approvals. Levantiq’s own obligations remain in place.

Emails are sent automatically only to email addresses or domains approved by the user in the settings. For all other recipients, only drafts are created. The platform can therefore act automatically within the instructions and approvals given; the user does not necessarily review each action individually.

For activated integrations and instructed Internet actions, the third-party system’s terms and privacy notices apply to processing within that system. The location commitments for platform operation and LLM services do not extend to external recipients or websites chosen by the user. The Cloud · 100% Swiss subscription also does not prevent user-instructed transfers to foreign third-party systems.

Within Levantiq, the relevant persons receive access to the extent necessary. Infomaniak Network SA, Geneva, provides hosting, database, file and backup operation, email infrastructure and, under the Swiss subscription, LLM processing. Under the Basic subscription, OpenRouter, Microsoft Azure and the model providers used through them are also involved. Stripe processes data for payment of the subscription. The specific provider overview is available from our data protection contact.

Data may also be disclosed to authorities, courts or professional advisers insofar as required by law or necessary and permissible to protect legitimate legal claims.

6a Google user data

Where an organisation has chosen Google Workspace as its productivity suite, its users can connect their Google Account to LevantiqOne. The connection is optional and is granted by the user on Google's own consent screen. It can be withdrawn at any time by disconnecting the account in LevantiqOne or by removing access in the Google Account security settings.

We request only the following scopes, and use the data obtained through them only for the purposes stated:

Message content, calendar entries, contacts and documents obtained in this way are Customer data within the meaning of Section 2 and are stored in the system at Infomaniak as described in Sections 5, 7 and 8. Access and refresh tokens are stored encrypted and are used solely to carry out the actions described above. Where a user asks the assistant to work with this data, the content concerned is processed by the language-model services described in Section 5, under the Zero Data Retention terms set out there.

LevantiqOne's use of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. In particular, Google user data is not used to develop, improve or train generalised artificial intelligence or machine learning models, is not sold, and is not transferred to third parties except as necessary to provide or improve the features the user has requested, to comply with applicable law, or in connection with a merger or acquisition. Human access to Google user data takes place only with the user's explicit consent, where necessary for security purposes, to comply with applicable law, or on aggregated and anonymised data.

7 Countries of processing

Platform data and backups are stored in Switzerland with Infomaniak. The EU is the specified processing area for LLM processing under the Basic subscription; under the Swiss subscription, processing takes place in Switzerland.

For disclosures to countries without adequate statutory data protection, we ensure appropriate protection, in particular through recognised standard contractual clauses and necessary supplementary measures, unless a statutory exception applies. Information about these safeguards is available from our data protection contact.

8 Retention and deletion

We retain account and contract data for as long as needed to perform the contract, comply with legal obligations or protect legal claims. Accounting records and business documents subject to statutory retention obligations are generally retained for ten years from the end of the financial year concerned. This does not apply indiscriminately to all account data.

Support emails relating to closed enquiries are deleted 60 days after the enquiry is closed, unless a statutory retention obligation requires otherwise. Technical logs are retained only for as long as necessary for secure operation, troubleshooting and investigating misuse, and are deleted in regular cycles. Account data that is no longer needed is deleted once the purposes described in this Section no longer apply.

Deletion requests sent to support@levantiq.ch are handled manually. The relevant data is deleted from the active system within 30 days of receipt of the request; corresponding backup copies are deleted no later than 90 days after receipt of the same request. The statutory requirements for the right to deletion and statutory retention obligations remain reserved. If a request cannot be fulfilled in whole or in part, we inform the requesting person accordingly.

For Customer data processed on customers’ behalf, the following applies at the end of the contract where no separate deletion request has been made: 30 days to export the data, followed by deletion within a further 30 days and deletion or overwriting of backups within no more than another 30 days. An express deletion instruction from the customer during the export period takes precedence over continued availability for export for the data concerned. Upon request, we confirm deletion in writing. A deletion request does not replace cancellation of the subscription.

9 Cookies and technical storage

The website and app use technically necessary session cookies for login, session management and operation. No third-party analytics or tracking services are currently used. You can delete or block cookies through your browser settings; this may restrict login and other necessary functions.

9a Mobile applications and push notifications

LevantiqOne is also available as a native mobile application. The application gives access to the same Customer data as the web application and is subject to the same organisation permissions; it does not create a separate category of processing. The following points apply specifically to mobile use.

Recordings and transcripts. Users can start a microphone recording or upload audio in order to have a meeting transcribed and summarised. A recording is always started deliberately by the user; the application does not record in the background. Recordings, transcripts, summaries and any tasks derived from them are Customer data within the meaning of Section 2 and are processed as described in Sections 5 and 8. The user and the user’s organisation are responsible for informing meeting participants and for obtaining any consent required by law before a recording starts.

Files and photos. The application accesses files, photos and the camera only for the item a user deliberately selects or captures for upload. It does not read the device’s media library beyond that selection.

Push notifications. On Android, the application uses Google Firebase Cloud Messaging to deliver work-related notifications. After sign-in, the application initialises Firebase Messaging and may ask for notification permission. Firebase processes an installation identifier, the application version and the device or application metadata needed to provide the service. Where permission is granted, we associate the resulting registration token with the signed-in user and organisation and use it solely to deliver notifications. The token is removed when the user signs out and when Firebase reports that it is no longer valid. Google states that Firebase installation data is removed from live and backup systems within 180 days of a deletion request by the developer.

Advertising, analytics and crash reporting. The application contains no advertising SDK, and no personal data is processed for advertising purposes. No advertising identifier is collected. The application contains no analytics or crash-reporting SDK.

Payments. Subscriptions are managed on Stripe-hosted web pages. Card numbers and CVCs are processed exclusively by Stripe, as described in Section 3, and are not collected by the mobile application.

10 Data security

We implement appropriate technical and organisational safeguards. In particular, encryption in transit and at rest, tenant separation, personalised accounts, role-based access, logging, daily backups and confidentiality obligations are provided for the platform. Details of processing on behalf of customers and the safeguards are set out in Annex 1 to the Terms or are available on request.

11 Your rights

Subject to applicable law, you may request access to your personal data, its correction or deletion, and the cessation of unlawful processing. Where the statutory requirements are met, you may request that your data be provided to you or transferred. You may withdraw consent with effect for the future. Statutory obligations and overriding interests worthy of protection may limit individual requests.

Please send your request to support@levantiq.ch. We may ask for the information needed to verify your identity. If a request concerns data that we process exclusively on behalf of a customer, that customer is generally responsible; we assist it in accordance with the data processing agreement.

Where a solely automated individual decision produces legal effects concerning you or significantly affects you, the statutory information duties and rights apply, in particular the right to express your point of view and, in principle, to request review by a natural person. For decisions made on behalf of a customer, the request should generally be addressed to that customer.

You may contact the Swiss Federal Data Protection and Information Commissioner (FDPIC), https://www.edoeb.admin.ch/.

12 Changes

We update this Policy when actual processing practices or legal requirements change. The current version is made available on https://levantiqone.ch/ and in the app at https://app.levantiqone.ch/. We communicate material changes in an appropriate form. An update does not replace any consent that is required.

Terms and Conditions