Security and privacy

Who is behind breaco

breaco is a service operated by A. Knöpfel, a sole proprietorship under Swiss law, in 1442 Montagny-près-Yverdon. A. Knöpfel is the data controller within the meaning of the Swiss Federal Act on Data Protection (FADP).

For any question about your data: contact@breaco.app.

Where your data is

The app's database, authentication, file storage and server functions are hosted by Supabase in Frankfurt, Germany, in the European Union. Germany is recognised as providing adequate protection by the Swiss Federal Council.

The breaco.app website and the app served on app.breaco.app are hosted by Infomaniak Network SA (Geneva / Zurich, Switzerland).

breaco never sells personal data and never uses it for advertising. The website sets no advertising cookie and no cross-site tracker. Audience measurement relies on Umami, a cookieless tool that cannot identify you.

What the admin sees

Data is isolated at the level of each database row, with no exception for administrators. Your company's admin sees what is posted in their scope, like any colleague. Nothing more.

Your company receives a monthly adoption summary. It is exclusively aggregated, produced only from ten people upwards, and never says who posted, who reacted, or who did nothing. The same summary is published to all employees.

A personal participation indicator exists in the app. Only you see it; it is never used for any ranking.

Processors

breaco uses the following providers, all named in the privacy policy:

• Supabase: database, authentication, file storage and server functions (Frankfurt, Germany).
• Infomaniak Network SA (Geneva / Zurich, Switzerland): hosting of the website and the app.
• Resend: transactional emails, such as account confirmation (United States).
• Formspree, Inc.: routing of the website contact forms (United States).
• Umami Software, Inc.: cookieless website audience measurement (data hosted in the European Union).
• GIPHY: search and display of animated GIFs in the app (United States).
• Browser push notification services (Google, Apple, Mozilla, Microsoft): delivery of the notifications you turned on, never their content.
• OpenStreetMap / Nominatim: city suggestions when entering a place in the app (EU and United Kingdom).

Retention and deletion

Your data is kept for as long as your account is active. You can delete it from Settings, or simply by asking.

Deletion happens in two stages: the account is deactivated immediately, then erasure becomes definitive after 14 days, which leaves you time to change your mind.

Your identity is erased: name, photo, job title, date of birth, contact details. Content shared with others, such as your posts or the messages you sent, remains for its recipients under the label "Deleted account". The history of company membership is kept as evidence.

Your rights

You have a right of access, rectification, deletion and data portability, the right to withdraw your consent and the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC).

These rights are exercised free of charge, in writing to contact@breaco.app. A reply is provided within 30 days.