Privacy Policy

This translation is for information purposes only. The German original version is legally binding.

Last updated: 30.10.2026  ·  Controller: Baurapport — builtbyselimi, 9470 Buchs SG

1. Data controller

The data controller for processing your personal data within the meaning of the Swiss Data Protection Act (DSG) is:

For data that a business records in Baurapport about its employees, customers or third parties (e.g. working hours, absences, daily reports), the business itself is the controller. We process this data on its behalf (Art. 9 DSG) and only to operate the platform. Please address questions about it first to the business you work for; we support it in answering.

2. What data is collected?

We collect the following categories of personal data:

• Registration data: Company name, name and first name of bosses/workers, email address, phone, role (boss / worker), password (hashed).
• Site and report data: Data about your sites (name, address, client, period, status), tracked working time, material, photos and notes, documents/plans, status history.
• Location data: Coordinates of sites (via OpenStreetMap geocoding) and — only with your consent — your current position on the device for distance calculation.
• Payment data: For paid subscriptions, credit card data is processed exclusively by Stripe Inc. and never stored on our servers. We only see the subscription status and transaction IDs.
• Technical data: IP address, browser type, operating system, visited pages, timestamps, language preference — within the scope of server operation by Infomaniak.
• Personnel data on behalf of the business: Working hours and absences, where applicable with a medical certificate (health data, visible only to authorised persons), personal photo and voluntary details such as date of birth, emergency contact and AHV number.

3. Purpose of data processing

• Provision and operation of the SaaS platform baurapport.ch (site management, time tracking, reports, warehouse)
• Handling of subscriptions and payments (via Stripe, after the trial)
• Geocoding of site addresses to coordinates via OpenStreetMap/Nominatim
• Distance calculation between worker location and site (with consent, client-side)
• Communication by email (invitations, password reset, service messages). Whether a button in a service message is clicked is recorded per company so that we can improve these messages. We do not use a tracking pixel to detect opens.
• Security and abuse prevention (e.g. account blocking on Terms breaches)
• Compliance with statutory retention obligations

4. Legal basis

Switzerland (DSG)

We process personal data in accordance with the principles of the Swiss Data Protection Act (Art. 6 DSG). Where a justification is required, we rely on the performance of the contract (Art. 31 para. 2 lit. a DSG), on our overriding interest in the secure operation of the platform (Art. 31 para. 1 DSG) and, where we expressly ask for it (e.g. for your location), on your consent.

EU (GDPR)

For users based in the EU/EEA, the GDPR applies. Processing is based on Art. 6(1)(b) GDPR (contract performance), Art. 6(1)(a) GDPR (consent) and Art. 6(1)(f) GDPR (legitimate interest).

5. Third parties & data transfers

6. Storage period

We only store your data as long as required for the stated purposes:

• Account data: as long as your account exists. When access ends (cancellation, trial expiry without a subscription, dissolution of the company), the data remains available for download for 30 days and is then deleted after a warning by email. A transitional provision applies to former customers (Terms section 6).
• Daily reports, construction sites, inventory, photos and documents: as long as the account exists; afterwards deleted completely and irrevocably as above, including all uploaded files.
• Our invoices: 10 years under the Swiss Code of Obligations (Art. 958f CO), also after the account has been deleted. The business keeps its own business records in the app (e.g. its invoices to customers, working-time records) itself; we delete them with the account.
• Log files: max. 90 days
• Backups: no more than 30 days; after that, deleted data no longer exists there either.

7. Your rights

You have the following rights at any time:

• Right of access: What data we have stored about you
• Rectification: Have incorrect data corrected
• Erasure: Have data deleted, unless a statutory retention obligation applies
• Data portability: Download your data in a common format (PDF, CSV, Excel) — even after access ends, until deletion, on the «Your data» page
• Withdrawal: Withdraw a granted consent
• Complaint: File a complaint with the FDPIC (edoeb.admin.ch)

Please send requests by email to info@baurapport.ch or via contact form.

8. Cookies & local storage

We only use technically necessary cookies and local storage:

• Session cookie: To keep you signed in (Laravel session)
• CSRF token: Protection against cross-site request forgery
• Preference cookie: e.g. card or table view for sites
• Service Worker / PWA cache: For offline functionality of the mobile app
• Google Analytics (GA4): For anonymised reach measurement. Cookies like _ga and _ga_* help us understand how our site is used. IP addresses are anonymised. You can disable tracking at any time via the Google Opt-out add-on.

We do not use advertising cookies and no cross-site tracking for advertising.

9. Data security

We protect your data through technical and organisational measures: HTTPS encryption of all connections, hashed passwords (bcrypt), regular security updates, hosting in Switzerland (Infomaniak, ISO 27001 certified data centre) and strict separation of companies: all companies share one database, and every access is restricted to the user's own company.

10. Voice input (dictation feature)

In the app you can optionally dictate report text by voice instead of typing. The dictation feature uses the speech recognition built into your browser or operating system. As soon as you tap the microphone, the spoken audio is sent for transcription to the respective provider – to Google on Chrome/Android, and to Apple on Safari/iPhone. Baurapport itself neither records nor stores the audio; only the resulting text that you insert into the field is processed and stored. The feature is optional and only active while you deliberately start the microphone. The privacy policies of Google and Apple additionally apply.

11. Changes to this policy

We reserve the right to adapt this Privacy Policy at any time to reflect changed legal or technical conditions. In case of material changes we inform active users by email or in the app. The latest version is always available on this page.