Privacy Policy

1. Controller

Fabian Traub / CELVENO
Mühlenstrasse 40
8200 Schaffhausen
Switzerland
Email: info@celveno.com

2. Scope and legal framework

This Privacy Policy applies to the public CELVENO website, contact, demo and price/subscription requests, and the CELVENO web app. The primary legal framework is the Swiss Federal Act on Data Protection (FADP). Where other privacy laws apply in a specific case, their mandatory requirements are additionally observed.

3. Categories and sources of personal data

Depending on use, CELVENO may process names, business email addresses, usernames, company affiliation, roles and permissions, login/session/security information, technical connection data, company profiles, customer/contact data, addresses, projects, quotes, line items, prices, catalogue data, invoice data, uploaded files, images, documents, support requests, feedback, usage/audit information and, where AI is enabled, the data required for AI inputs and outputs.

Data normally comes from the user or the relevant business customer. Additional data may originate from documents, emails, spreadsheets, images, catalogues or other sources deliberately imported by the customer.

4. Purposes of processing

Personal data is processed to provide CELVENO, manage users, authenticate access, enforce tenant separation, create and manage quotes, perform calculations, manage invoices, process catalogues and files, provide support, troubleshoot, secure the service, prevent abuse, handle billing, improve and develop the service and – where enabled and consciously used – provide AI functions.

Depending on the circumstances, processing supports contract performance or preparation, legitimate operational and security interests, legal obligations, or another basis permitted by applicable law.

5. Public website and forms

For contact, demo or price/subscription requests, CELVENO processes the contact details required by the relevant form and any voluntarily provided information to handle the request, contact the sender and prepare a possible offer or access. A form request is not a newsletter subscription and generally does not automatically create a contract.

The current CELVENO theme code does not embed its own analytics, advertising, Meta Pixel, Google Analytics, YouTube, Google Maps or reCAPTCHA scripts. Technically necessary WordPress, hosting or security functions may still process technical data and necessary storage mechanisms. If non-essential tracking is later enabled, this Policy will be updated and a consent mechanism will be used where required.

6. Accounts and CELVENO web app

CELVENO processes the account and security data required for login, session management, roles, permissions and tenant assignment. Business content is processed only to the extent required for functions used by the business customer. Where CELVENO processes such personal data on behalf of a customer, the Data Processing Agreement may additionally apply.

7. CELVENO AI and AI data

CELVENO AI is available only where the relevant plan and server-side permissions enable the function. Storing data in CELVENO does not automatically send all content to an AI provider. Only when an authorised user invokes an AI function may the texts, document contents, images, voice data and context required for that function be transmitted to the AI provider.

Under the current technical setup, CELVENO may use the OpenAI API. AI requests are sent server-side and the API key is not exposed in the browser. OpenAI's published business terms state that API business data is not used to train or improve models by default unless the customer expressly opts in. CELVENO currently uses store: false for Responses requests. This is not the same as an account-wide Zero Data Retention configuration; technical abuse/security logs may be processed for a limited period under the provider's current data controls.

Files temporarily uploaded by CELVENO for AI-supported document analysis are deleted again on CELVENO's side after the intended processing; provider-side technical processing remains subject to the provider's current terms. AI output is a suggestion and must be reviewed before business use. See AI & Data Processing.

8. Technical providers and international transfers

CELVENO uses technical providers for hosting/delivery, backend, database, authentication, storage, email and AI. The current list of essential providers is available under Subprocessors.

Depending on the provider, personal data may be processed outside Switzerland or disclosed to other countries. Where a recipient country does not provide an officially recognised adequate level of protection, CELVENO uses appropriate safeguards where required, such as recognised standard contractual clauses with Swiss adaptations or other lawful transfer mechanisms.

9. Cookies, local storage and tracking

Technically necessary cookies or local storage mechanisms may be used for WordPress, login, security or app functions. The current public theme code contains no proprietary marketing or analytics tracking. If non-essential analytics, ads, pixels or similar technologies are later activated, they will only be enabled after the required choice where legally necessary, and this Policy will be updated.

10. Retention and deletion

Personal data is retained only as long as required for the relevant purposes, the customer relationship, security, evidence or legal obligations. Contract and business data may remain after contract end where statutory or contractual retention duties apply. Accounting records and certain business books may be subject to statutory retention periods. Security and audit data is kept only as long as required for operations, traceability and abuse prevention.

Customers should export required data before contract end. At the customer's request, or where a later reactivation of the CELVENO subscription is intended, the related customer data may be archived for up to 12 months. If the subscription is not reactivated, the data is deleted or anonymised after that period unless statutory retention duties or technically necessary backup periods require otherwise. Without such a reactivation request, data may be removed earlier under the applicable deletion and backup rules.

11. Data security

CELVENO applies technical and organisational measures appropriate to the risk. Under the current product design, these include server-side tenant and role checks, protection of credentials, server-side handling of AI secrets, transport encryption provided by the underlying platforms, and logging, backup and restore mechanisms depending on function and plan. Absolute security cannot be guaranteed for internet-based systems.

12. Rights of data subjects

Under applicable law, individuals may in particular request information about personal data processed about them and correction of inaccurate data. Depending on the circumstances, further rights may apply, such as deletion, restriction of processing or export/transfer of certain data. Requests may be sent to info@celveno.com or support@celveno.com.

13. Automated individual decisions

CELVENO is designed so that material AI suggestions are reviewed and approved by authorised users. In the intended product flow, CELVENO should not make solely automated individual decisions about natural persons that have legal or similarly significant effects. If a customer uses CELVENO outside that intended scope, the customer is responsible for assessing any additional legal obligations.

14. Changes and versioning

This Privacy Policy may be updated when functions, providers or legal requirements change. Material new versions are versioned. Where a renewed consent or confirmation is legally or contractually required for existing users, it is obtained through the intended product process.