Privacy Policy

1. Controller

The controller responsible for data processing is Henosis Ventures GmbH, Lindenstrasse 8, 6340 Baar, Switzerland ("Firmbase"). For questions about data protection, contact us at hello@firmbase.ch.

2. Data collected

We collect and process the following personal data:

• Registration and account data (name, email address, password in irreversibly encrypted form; for law-firm staff also the encrypted key for the second sign-in factor)
• Enquiry data (name, email address, telephone number and optional details about country of residence, services of interest and plans)
• Guide registrations (email address, selected language, registration purpose, date and time)
• Formation data (personal details, addresses, capital details of the persons involved)
• Business-address / domicile data (company name, UID, desired location, package, mail items)
• Call data (telephone number, recording and transcript of the call, callback note with name, concern and contact details; see section 6)
• When a mandate is accepted: time and IP address as evidence of the contract
• Usage data (access times, features used)
• Technical data (IP address, browser, operating system)

3. Purpose of data processing

Your data is used exclusively to provide our services: carrying out company formations, amendments and liquidations, document generation, communication with notarial offices and commercial register offices, and to improve our service. We use enquiry data to address your request and contact you. For a guide registration, we use your details to manage the registration and send the guide on a single occasion after publication; this does not subscribe you to a newsletter.

We also process data to protect your account and our service (sign-in, protection against abuse and automated access) and to call you back or reply by email after a phone call.

4. Recipients and service providers

We share personal data with third parties where necessary to perform the contract (e.g. notarial offices, commercial register offices, and postal and digital-mail partners for domicile and business-address services) or where there is a legal obligation. We do not sell personal data.

To operate our service we use service providers that process personal data on our behalf:

To search for companies and to check company data, we query the central business name index Zefix (Federal Commercial Registry Office) and the UID register (Federal Statistical Office). We transmit the company name or UID you entered. For a sole proprietorship, the business name may contain your name.

For companies certified under the Swiss-US Data Privacy Framework, the USA is considered a country with adequate data protection. Where such certification is missing, we base the disclosure on the standard contractual clauses of the European Commission recognised by the Federal Data Protection and Information Commissioner.

To measure the effectiveness of our advertising we transmit limited data to Google and Meta; details and the role of your consent are set out in section 7.

5. Storage location and retention

Your data is held in our database in the EU (Supabase, Frankfurt). Copies are made by the service providers listed in section 4 to the extent required for their tasks. We keep data for as long as the purpose requires or the law demands:

• Enquiries that do not lead to an order: deleted 24 months after they were last handled
• Client files (formation, amendment and mandate records, generated documents): for the statutory retention period, usually 10 years
• Call recordings and transcripts at ElevenLabs, and callback notes: 12 months
• Advertising click identifiers: no more than 90 days
• Unconfirmed registrations: 24 hours
• Guide registrations: until the guide has been sent and any related follow-up enquiries have been handled

You can request deletion of your data at any time by contacting hello@firmbase.ch. Statutory retention obligations take precedence over deletion.

6. Phone assistant

Calls to our telephone number are answered by an AI-based voice assistant. It records your concern and contact details so that we can call you back or reply by email. The call is recorded; the greeting says so. The call is routed via Twilio (USA) to the voice assistant of ElevenLabs (USA). ElevenLabs keeps the recording and transcript for 12 months. The call produces a callback note with name, telephone number, email address, concern and a summary. We store it in our database, send it to our mailbox and delete it after 12 months. If you prefer not to speak with the assistant, write to us at hello@firmbase.ch.

7. Cookies and audience measurement

Strictly necessary cookies. These are required for operation (sign-in, session management) and are set without consent. A sign-in is valid for no more than 7 days, for staff 12 hours. For technical error and stability monitoring we use Sentry; this is done in our legitimate interest in a secure, functional service and sets no advertising cookies. If an error occurs in the application or during sign-in, Sentry may capture the course of the session as a screen recording. All text and inputs are masked and no images are captured.

Google Analytics 4 (only with analytics consent). If Google Analytics 4 is configured for Firmbase, we use it on public pages to analyse page views and use of our services in aggregate. Page paths are transmitted without free-form URL parameters; names, email addresses, telephone numbers, company details, addresses, free text and internal lead IDs are not sent. An analytics-only funnel stores only sanitised service and campaign attributes in session storage and no advertising click IDs. The logged-in area is excluded. Without analytics consent, no page-view or funnel events are sent to Google Analytics.

Google Ads and Google Consent Mode. On our public pages, including sign-in, registration and the forms for formation, amendment and liquidation, we use Google Ads (Google Ireland Ltd., with possible transfer to Google LLC in the USA) to measure the effectiveness of our advertising. The Google tag runs in Google Consent Mode v2. Without your consent it sets no cookies, but it sends Google cookieless signals: the page view with technical details (IP address, browser, page address) and, when you send an enquiry, open an account or submit an order, that event with the order value in Swiss francs and an internal reference number. We do not send names, email addresses or other form details to Google. Only with your consent to marketing cookies does Google set cookies, and we additionally measure clicks on individual buttons. In the logged-in area (dashboard, onboarding, account settings) we load neither Google nor Meta services.

Ad-click attribution (only with consent). If you reach Firmbase through a registered paid campaign, we store allowlist-validated campaign details and Google click identifiers (gclid, gbraid or wbraid) for no more than 90 days. When you submit a domicile or contact enquiry, these details may be linked to the enquiry. Click identifiers in our database are automatically deleted within that period; withdrawing consent removes the related browser storage immediately.

Meta Pixel and Conversions API (only with consent). For our advertising on Facebook and Instagram we use — only with your explicit consent — the Meta Pixel and the Meta Conversions API (controller: Meta Platforms Ireland Limited; possible data transfer to Meta Platforms, Inc. in the USA under the Swiss-US Data Privacy Framework). This measures the effectiveness of our campaigns (conversion tracking). Meta uses its own consent signal: without your consent, no Pixel or Conversions API data is transmitted to Meta. It is not used in the logged-in area.

Withdrawing consent. You can withdraw your consent at any time with effect for the future — via the "Cookie settings" link in the footer or by deleting the cookies in your browser settings.

8. Your rights

You have the right to access, rectification, erasure and restriction of the processing of your personal data. To exercise these rights, contact us at hello@firmbase.ch. You may also lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC).

9. Applicable law

This privacy policy is governed by the Swiss Data Protection Act (DPA). The place of jurisdiction is Baar, Canton of Zug, Switzerland.