Privacy policy

Version of October 11, 2026. Data controller: Impulse Orbite (Alexandre Gertsch), L'Ancienne Route 77A, 1218 Le Grand-Saconnex, Switzerland, contact@supercalcula.ch.

This policy is written in accordance with the Swiss Federal Act on Data Protection (nFADP) and, for customers established in the European Union, the General Data Protection Regulation (GDPR).

1. Data processed and purposes

Data	Purpose	Legal basis	Retention
Email, password (hashed), name, company, country, language, currency	Creating and managing the account, authentication, service-related communication	Performance of the contract	Life of the account + 30 days
Stripe customer ID, subscription history, amounts	Billing, payment tracking	Performance of the contract, accounting obligations	10 years (Swiss legal requirement) for invoices, kept by Stripe
API keys (hashed), key names	Authenticating calls	Performance of the contract	Until revocation + 30 days
Call metadata: date, endpoint, status, duration, size, hash of the IP address	Quota counting, dashboard, security, abuse detection	Performance of the contract, legitimate interest	90 days (detail), 13 months (daily aggregates)
Content of requests (texts, addresses, documents)	Providing the result	Performance of the contract	Not stored: processed in memory then deleted
Contact form messages	Answering the request	Legitimate interest	12 months
Host server logs (IP, timestamp, URL)	Security, diagnostics	Legitimate interest	Depends on the host, usually 30 days

Note: for endpoints called with GET (email verification, currencies, units), the parameters appear in the URL. Supercalcula API does not store them, but the hosting provider's server logs may record the full URL. For sensitive data, prefer endpoints called with POST, whose content does not appear in the URL.

2. Processors and recipients

• Infomaniak Network SA (Geneva, Switzerland): hosting and email delivery.
• Stripe Payments Europe Ltd. (Ireland): payment and invoicing. Stripe may transfer data outside Switzerland/the EU under its contractual safeguards (standard contractual clauses).
• Public data providers queried during a call (DNS servers for email verification, the European Central Bank for exchange rates): only the strictly necessary information is sent (domain name, currency), never the customer's personal data. No data is sold or passed on for advertising purposes.

3. Cookies

The website only uses strictly necessary technical cookies: login session, CSRF protection, language and theme preference. No third-party advertising or audience-measurement cookies are set; a consent banner is therefore not required.

4. Security

Encrypted connections (HTTPS), hashed passwords (Argon2id), API keys stored as hashes, administrative access protected by a second factor, encrypted backups. In the event of a data breach likely to present a high risk, the individuals concerned and, where applicable, the Federal Data Protection and Information Commissioner (FDPIC) are informed.

5. Your rights

You may request access to your data, its rectification, erasure, restriction of processing and portability, and object to processing based on legitimate interest. The account can be deleted directly from the settings. For any request: contact@supercalcula.ch. You may contact the FDPIC (Switzerland) or the supervisory authority of your country (EU).

6. International transfers

Data is hosted in Switzerland, a country recognised by the European Union as providing an adequate level of protection. Transfers made by Stripe are covered by its contractual safeguards.

7. Changes

This policy may be updated; the version date appears at the top. Significant changes are announced by email to account holders.