Your privacy is important to us. This privacy policy explains how we collect, use, and protect your personal information when you use our site.

This policy covers the tobill.ch website; section 5 also describes the artificial intelligence in the application. The To Bill application (app.tobill.ch, the mobile app and the fiduciary cockpit) has its own privacy policy: app.tobill.ch/legal/privacy

Last updated: 19 October 2026

1. Information Collection

We collect information such as your name, email address, and other data that you voluntarily provide when registering or using our services.

2. Use of Information

The collected information is used to provide and improve our services, personalize your experience, and communicate with you.

3. Data Protection

We implement security measures to protect your information from unauthorized access or misuse.

4. Recipients and Sub-processors

We do not sell your personal data. We only disclose it:

• to the providers who help us deliver our services (hosting, file storage, e-mail delivery, payments, artificial intelligence, notifications, website analytics), on our instructions and only as far as necessary;
• to authorities, where the law requires it;
• to other third parties, with your consent.

Some of these providers are located outside Switzerland, in particular in the United States. Their list, role, country and the safeguards that apply are on the page Sub-processors

5. Artificial Intelligence

Some features of the To Bill application (app.tobill.ch, the mobile app and the fiduciary cockpit) use the Claude artificial intelligence (AI) models of Anthropic PBC, in the United States; the model depends on the feature. This section states what is sent to them, why, for how long, and how to switch AI off, as the duty to inform in art. 19 of the Federal Act on Data Protection (FADP, SR 235.1) requires. Version of this information: 19 October 2026.

Purposes

AI is used only to deliver the feature you are using: reading a receipt or an invoice, proposing an account, a category or a bank match, explaining a check, answering a question about your figures, preparing an import or a draft. It suggests, you decide: only the autopilot books a receipt on its own, when your history or one of your rules confirms the proposal; you can undo the entry and switch this automatic booking off in Settings › AI, under “Autopilot”. AI takes no decision about a person (art. 21 FADP). Anthropic never uses this data to train its models.

One switch, on by default

Every AI feature depends on one setting, Settings › AI. AI is switched on there by default for every company. An administrator of the company can switch it off at any time, for all features or, under “Advanced settings”, for a single one; a company that switched it off stays off until an administrator switches it on again. When it is off, no data is sent to the provider any more; importing customers and items and reading the Swiss QR code keep working without AI. Payroll data has its own switch, “AI for payroll”, off by default (see “Payroll”). Every switch on or off is recorded: who, when, and the version of this information.

What is sent

The features that work on your books (booking and categorising receipts, bank line proposals, the night check, explanations of checks, review of entries and, for your fiduciary, the monthly summary and the receipt request) send only what they need: chart of accounts, amounts and VAT, dates, cleaned-up descriptions, names of suppliers that are companies, legal form and VAT method, results of consistency checks, unmatched bank lines and candidate open invoices. Before sending, To Bill removes IBANs and account numbers, AHV/AVS numbers, e-mail addresses, phone and payment card numbers, and replaces the names of people (customers, suppliers or employees) with a code.

The features that read what you hand them send that content as it is, without cleaning it up:

• reading a receipt, dropped into “To review” or attached to an expense (web and mobile app): the file (photo or PDF) and, for an expense, the names of your categories; everything printed on it, an IBAN or a name included, is read by the model; the Swiss QR code is read in To Bill, and the IBAN always comes from it;
• importing invoices already issued: the full PDF file, including the customer's name and address;
• importing customers or items (CSV or Excel file): the first five rows of the file and the column mapping; for customers, this includes names, addresses, e-mails, phone numbers and VAT numbers;
• shortening an address too long for the QR-bill: the customer's address line;
• a quote or an invoice from a description, and the document editor assistant: your messages, your company's name and town, the currency, the selected customer's name and the state of the document (reference, dates, title);
• a layout template: the description of the style you want.

For each call, To Bill logs the feature, the model, the estimated cost and the categories of data sent, never the content.

The Copilot

The Copilot is the side panel that, on every page of the application, answers your questions about your company's figures (invoices, quotes, customers, expenses, payments received, time, accounting) and, on request, prepares draft quotes and invoices. It reads only what the person asking may see in To Bill: it goes through the same access checks as the application. It cannot send, book, pay or delete anything; a draft it prepares waits for you to review it in the editor. Every answer cites its sources, and an amount no source confirms is flagged.

It sends your question, the last 12 messages of the conversation, the reference of the screen you ask from, and what its reads return: references, amounts, dates, statuses, accounts, cleaned-up descriptions and the town of customers that are companies, never a customer's contact details. Before sending, the names of the customers, suppliers and employees recorded in To Bill are replaced with a code (CLIENT_12, for example), in your question too, as are your colleagues' names in what the Copilot reads, and IBANs, AHV/AVS numbers, e-mail addresses and phone numbers are removed. The real names are put back only in the answer, at To Bill. For a draft, it also sends your company's name and town and the description of the work, without the customer's name.

Conversations are kept at To Bill (with the real names, and in the coded version sent to the model) and only their author can see them: neither a colleague nor an administrator can read them. A conversation without a new question for 180 days is deleted; you can delete one at any time, and all of them go with your user account or with the company.

Payroll

By default, no AI feature reads the payroll module (employees, contracts, payslips and salary certificates, AHV/AVS numbers, withholding tax). There are two exceptions, both behind one switch, “AI for payroll” (Settings › AI, administrators only), off by default even when AI is on:

• the Copilot may then read, for a person who has access to payroll, the totals of each payroll run: month, status, payment date, number of employees, gross and net salary, amount paid out and employer cost. Never a payslip, a name, church tax, absences, an AHV/AVS number or an IBAN;
• the AI drafts a work certificate from the job title, the tasks, the employer's ratings and own words (cleaned up), the months of entry and exit, the activity rate, the person's sex (for the grammar), the reason for leaving if it is to be stated, and the language. The name is replaced with a marker; never the salary or the AHV/AVS number.

In every case, salary payments on your bank statements and salary entries are held back: neither the bank proposals, nor the Copilot, nor the night check send them. Only accounting totals, for example the balance of account 5000 (salaries), may be sent. Every switch of “Payroll in the Copilot” on or off is recorded, like those of AI.

Never sent

No feature sends your passwords, the name and e-mail address of your user account, or the files in your Drive. Only what is printed on a file you submit yourself may contain such data: a payslip dropped as a receipt would be read like any receipt.

Retention

At Anthropic, the data sent and the answers are kept for 30 days at most, then deleted; they are never used to train its models. The only exception Anthropic provides for: content that its automated checks flag as violating its usage policy may be kept for up to two years, and longer where the law requires it. At To Bill, the result of a feature (amounts read, proposals accepted) and the files you drop are kept with your other data; the call log never contains the content. Copilot conversations are deleted after 180 days without a new question (see “The Copilot”).

Disclosure abroad

Anthropic PBC processes this data in the United States. The Federal Council recognises an adequate level of protection in the United States only for companies certified under the Swiss-U.S. Data Privacy Framework (art. 16 para. 1 FADP and annex 1 of the Data Protection Ordinance). For this data, the disclosure relies on the European Commission's standard contractual clauses, adapted to Swiss law and recognised by the FDPIC (art. 16 para. 2 let. d FADP), contained in Anthropic's data processing agreement; for Switzerland, the contracting party is Anthropic Ireland, Limited.

AI assistants you connect

You can connect an AI assistant of your choice to the application (for example Anthropic's Claude or OpenAI's ChatGPT) through the MCP protocol, or a tool through a personal API key. You authorise it yourself, for one company only, read-only or read and modify, and it never has more rights than your account. On your instruction, To Bill then sends that assistant the data it asks for to answer you or act for you, as your rights let you see it in that company; it is not pseudonymised as it is for the Copilot.

The provider of that assistant is not a sub-processor of To Bill: it is the recipient you choose, and its own terms and privacy policy apply between you and it, including for retention and any disclosure abroad. To Bill sends nothing to an assistant on its own initiative, and the Settings › AI switch does not concern these assistants. Every change an assistant makes is recorded in the company's activity log, with its name. For each connection, To Bill keeps the user, the company, the assistant's name, the access granted and the date of last use; of the access tokens, only a fingerprint.

You can revoke access at any time in Settings › AI and API connections; it stops immediately. A connection not used for 30 days expires by itself.

Roles

For the data of your customers, suppliers and employees that you record in To Bill, your company is the controller; To Bill acts as a processor (art. 9 FADP) and Anthropic as To Bill's sub-processor. To Bill's general terms authorise this sub-processor and provide that we inform you before adding or replacing a sub-processor, so that you can object (art. 9 para. 3 FADP, art. 7 DPO). It is up to you to inform these people (art. 19 FADP); you may refer them to this section.

The same information, in plain words: AI in To Bill

6. This website: hosting, audience measurement, advertising and forms

The tobill.ch website is hosted by Vercel Inc. (United States). Every visit goes through its network, which receives the IP address and the request headers; the forms are handled by a Vercel function running in Frankfurt (Germany) and then sent by e-mail. The site's fonts are served by the site itself: no request is made to Google Fonts.

The website's tools and what they receive

• Google Analytics 4 (Google LLC, United States; property G-QNZM3VGW9W, and G-NB0XWZ94FG on the "Swiss QR invoicing" page): audience measurement, loaded only if you accept audience-measurement cookies. Data: pages viewed, device, IP address, cookie identifiers. Google LLC states that it participates in the Swiss–U.S. Data Privacy Framework. Google Ads Data Processing Terms apply automatically to a business established in Switzerland.
• Google Maps (Google LLC, United States): map of the address on the accountant directory pages, loaded only if you click “Show the map”. Data: IP address, page viewed, Google cookies.
• OpenStreetMap (OpenStreetMap Foundation, United Kingdom): background of the accountant directory map, loaded only if you click “Show the map”. The map itself (Leaflet) is served by the site. Data: IP address, page viewed.
• PostHog (PostHog, Inc.; European instance, Frankfurt): audience measurement and session recording, only if you accept audience-measurement cookies. Data: pages viewed, clicks, course of the visit, cookie identifiers, IP address. PostHog states that it participates in the Data Privacy Framework (Swiss part).
• Meta Pixel (Meta Platforms Ireland Limited, Ireland): measuring advertising campaigns, loaded only if you accept marketing cookies. Data: IP address, pages viewed, events, cookie identifiers, also passed to Meta Platforms, Inc. (United States), which states that it participates in the Data Privacy Framework (Swiss part). Meta Platforms Ireland Limited is the contracting party for Switzerland; its Data Processing Terms are part of Meta's Business Tools Terms, accepted by using them.
• Vercel (Vercel Inc., United States): hosting of the website. Data: IP address, request headers, form content in transit. Vercel's DPA applies automatically, with standard contractual clauses covering Switzerland; Vercel states that it participates in the Data Privacy Framework (Swiss part).
• Resend (Plus Five Five, Inc., United States): sending the messages of the contact forms and newsletter sign-up. Data: name, e-mail, company, message; stored in the United States. DPA concluded at sign-up, with standard contractual clauses under the FADP.
• A technical provider that serves the crawlers of AI search engines an adapted version of the site and counts their visits; no data of human visitors is passed to it. It receives only requests that announce themselves as such a crawler (crawler name, page, user agent and IP address of the request), never a cookie.

You can change your choice at any time; the cookies are described on the page Cookie management

7. Your Rights

You have the right to access, modify, or delete your personal information. Contact us to exercise these rights at info@tobill.ch.