Governance

Articles about Governance

Insights and best practices for organisational governance.

No articles in "Governance"

There are no articles in this category yet. Come back soon for new content.

See all articles

Stay up to date

Follow our blog for guides, product updates and insights on digital governance.

Create your account → Discover Delibera

Legal information

Privacy Policy

Last updated: 19 October 2026

This translation is provided for information only. In case of any discrepancy, the Italian version prevails.

1. Controller

ElaraTeq Sagl
Carrale di Mezzo 10, 6533 Lumino, Switzerland
UID: CHE-251.226.490
Email: delibera@ticinohub.ch

For any questions regarding data protection or to exercise your rights, please contact us at the address above.

2. Legal framework and legal bases

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP/revFADP), in force since 1 September 2023, and, where applicable, the EU General Data Protection Regulation (GDPR).

The legal bases for processing are:

Performance of a contract (Art. 6(1)(b) GDPR; cf. Art. 31 para. 2 let. a FADP): provision of the Delibera services.
Consent (Art. 6(1)(a) GDPR; Art. 31 para. 1 FADP): optional features such as AI summaries and any non-essential cookies.
Legal obligation (Art. 6(1)(c) GDPR): retention of accounting and tax records.
Legitimate interest (Art. 6(1)(f) GDPR; Art. 31 para. 1 FADP): security, prevention of abuse and improvement of the service.

3. Data processed

3.1 Account data

Name, email address, password (stored only as a bcrypt hash), time zone, preferred language and, if enabled, two-factor authentication. Provided by you upon registration or in your profile settings.

3.2 Content and usage data

Groups and members, meetings, agendas, live notes, decisions, minutes, tasks, uploaded documents, votes, scheduling polls and electronic signatures of minutes. This data is generated by users in the course of using the platform.

3.3 Technical data

IP address, browser type, operating system and date/time of access. Collected automatically for security, diagnostic and abuse-prevention purposes.

3.4 Payment data

For paid subscriptions: billing details and payment status. Credit card data is processed exclusively by Stripe and is not stored by us.

3.5 Cookies

See our Cookie Policy.

4. Purposes of processing

Provision and management of the Delibera service (meetings, minutes, tasks, scheduling, voting).
Authentication and account security.
Sending transactional emails (notices of meeting, reminders, confirmations, password resets).
Simple electronic signature of minutes (SHA-256 hash, signatory's identity, date/time and IP address).
Optional generation of meeting summaries using artificial intelligence (see section 6).
Billing and subscription management.

5. Recipients and service providers

The content of meetings, notes, minutes and tasks is visible to the members of the respective group. We do not sell or rent personal data and do not disclose it to third parties for marketing purposes.

We use the following service providers (Art. 19 para. 2 let. c and para. 4 FADP):

Provider	Service	Country
Infomaniak Network SA, Geneva	Application hosting, database, document storage, backups and email delivery	Switzerland
Stripe Payments Europe Ltd (Dublin) and Stripe, Inc. (San Francisco)	Payment processing and subscription management	Ireland / USA
Anthropic PBC, San Francisco	AI meeting summaries — only if enabled (see section 6)	USA
Google LLC / Microsoft Corporation	Sign-in with a Google or Microsoft account (OAuth) — only if you choose this sign-in method; we receive your name, email address and account identifier	USA

The website's fonts are served directly from our own servers: no requests are sent to external font services.

6. AI summaries (optional feature)

The automatic summary feature is disabled by default. It is only activated if the owner of a group enters their own Anthropic API key in their profile settings and requests a summary to be generated. In that case, we transmit the following meeting data to Anthropic PBC (USA), using the customer's own key and account: title, group name, date, names of participants, agenda items, live notes and decisions, tasks with the name of the assignee and due date.

Processing by Anthropic is governed by the terms agreed between the customer and Anthropic. The group owner who enables the feature is responsible for informing the participants. The API key is stored in encrypted form and can be removed at any time.

7. Disclosure of data abroad

The core application data and the database are hosted in Switzerland by Infomaniak. The ancillary services listed in section 5 may process data abroad (EU/EEA and USA). According to the Swiss Federal Council, Ireland and the other EU/EEA states provide an adequate level of data protection. For transfers to the USA, we rely on the recipient's certification under the Swiss-U.S. Data Privacy Framework (and the EU-U.S. Data Privacy Framework) or, failing that, on standard contractual clauses recognised by the FDPIC and the European Commission.

8. Retention period

Account data: for the lifetime of the account; after deletion, backup copies are overwritten within 30 days.
Minutes and electronic signatures: for the period determined by the group, taking into account applicable retention obligations (e.g. Art. 958f CO: 10 years for certain records).
Technical logs: 90 days.
Accounting and billing data: 10 years (Swiss statutory obligations).

9. Your rights

Within the limits of the FADP and, where applicable, the GDPR, you have the right to:

Access: obtain information about and a copy of your personal data.
Rectification: have inaccurate data corrected.
Erasure: request deletion, subject to statutory retention obligations.
Data portability: receive your data in a structured, commonly used format.
Objection and restriction: object to processing based on legitimate interest.
Withdrawal of consent: at any time, with effect for the future.

To exercise your rights: delibera@ticinohub.ch. We do not make automated individual decisions within the meaning of Art. 21 FADP.

10. Security

We implement appropriate technical and organisational measures, including TLS encryption in transit, AES-256-GCM tokens for scheduling and voting links, bcrypt password hashing, encryption of particularly sensitive data (e.g. 2FA secrets and API keys), SHA-256 hashes for electronic signatures, role-based access control, daily backups and access logging. Further details are available on the Security page.

11. Changes

We may update this privacy policy. The version published on this website applies; material changes will be communicated to registered users by email.

12. Supervisory authority

You have the right to lodge a complaint with the competent supervisory authority:
FDPIC — Federal Data Protection and Information Commissioner (EDÖB)
Feldeggweg 1, 3003 Bern, Switzerland
www.edoeb.admin.ch

If you reside in the EU/EEA, you may also contact the supervisory authority of your country of residence.

General Terms of Use

Last updated: 19 October 2026

This translation is provided for information only. In case of any discrepancy, the Italian version prevails.

1. Scope

These terms govern the use of the Delibera platform (the "Service"), provided by ElaraTeq Sagl, Carrale di Mezzo 10, 6533 Lumino, Switzerland (the "Provider").

By accessing or using the Service, the user accepts these terms in full.

2. Description of the Service

Delibera is a platform for managing the entire meeting lifecycle: scheduling, notices of meeting, agendas, live sessions with minute-taking, generation of minutes, simple electronic signatures, task board and analytics.

3. Registration and account

Access to the Service requires the creation of an account with truthful information.
The user is responsible for keeping their credentials confidential.
Each account is personal and non-transferable.
The Provider reserves the right to suspend accounts that breach these terms.

4. Plans and billing

The Service is offered in the following plans: Free (no charge), Team (CHF 15/month), Pro (CHF 39/month) and Institutional (CHF 79/month).
The Free plan includes 1 group, up to 8 members and 3 meetings per month (document management is included in paid plans). The limits and features of each plan are shown on the pricing page at the time of subscription.
Paid plans include a 14-day free trial.
Payments are processed by Stripe. The Provider does not store credit card data.
Billing is monthly. The user may cancel at any time; the Service remains active until the end of the paid period.
The Provider reserves the right to change prices with 30 days' notice.

5. Intellectual property

The software, design, trademarks and content of Delibera are the exclusive property of ElaraTeq Sagl.
Content entered by the user (minutes, notes, documents) remains the property of the user or their group.
The user grants the Provider a limited licence to process such content for the sole purpose of providing the Service.

6. Acceptable use

The user undertakes not to:

use the Service for unlawful activities or activities contrary to public policy;
attempt to access data of other users or groups without authorisation;
intentionally overload the infrastructure (DoS, mass scraping);
share access credentials with unauthorised third parties;
upload unlawful or defamatory content or content that violates the dignity of others.

7. Availability

The Provider aims for an availability target of 99.5% of the Service on a monthly basis (best effort, without any contractual guarantee), excluding scheduled maintenance windows, which are normally announced at least 48 hours in advance. No compensation is provided for service interruptions.

8. Limitation of liability

The Service is provided "as is". The Provider does not warrant that the Service is free of errors.
To the extent permitted by law, the Provider is not liable for indirect damage, loss of data or loss of profit.
The Provider's aggregate liability is limited to the amount paid by the user in the preceding 12 months.
Liability for wilful misconduct or gross negligence remains unaffected (Art. 100 CO).

9. Simple electronic signature (SES)

Delibera's simple electronic signature (SES) feature links to the approved minutes the identity of the signatory, authenticated via their account, the date and time, the IP address and a SHA-256 hash computed over the content, which makes it possible to detect subsequent changes.

The SES is not a qualified electronic signature within the meaning of the Swiss Federal Act on Electronic Signatures (ZertES) and is not equivalent to a QES: it therefore does not satisfy the written form requirement under Art. 14 para. 2^bis CO. Its evidential value is freely assessed by the court (Art. 157 CPC). Where the law or the articles of association require written form, a qualified electronic signature (QES) or a handwritten signature is necessary; Delibera does not currently offer QES.

10. Deletion and portability

The user may request deletion of their account at any time by email to delibera@ticinohub.ch.
Before deletion, the user may export their data in a standard format (e.g. JSON, CSV or PDF).
Signed minutes may be subject to statutory retention obligations; in that case, their deletion may be deferred until such obligations expire.

11. Changes

The Provider may amend these terms with 30 days' notice. Continued use of the Service after the amendments take effect constitutes acceptance.

12. Governing law and place of jurisdiction

These terms are governed by Swiss law. The place of jurisdiction is Bellinzona, Canton of Ticino, Switzerland, subject to mandatory statutory places of jurisdiction (in particular for consumers).

13. Contact

ElaraTeq Sagl
Carrale di Mezzo 10, 6533 Lumino, Switzerland
delibera@ticinohub.ch

Cookie Policy

Last updated: 19 October 2026

This translation is provided for information only. In case of any discrepancy, the Italian version prevails.

1. What are cookies?

Cookies are small text files stored in your browser. They allow the website to recognise you from one request to the next and are essential for many web features to work, such as signing in to your account.

2. Cookies we use

2.1 Strictly necessary cookies

These cookies are essential for the platform to function and cannot be disabled. They are all first-party cookies, transmitted over HTTPS only.

Name	Purpose	Duration
`delibera-session`	User session (sign-in, session settings). Encrypted and not accessible via JavaScript.	Until the browser is closed; expires after 2 hours of inactivity
`XSRF-TOKEN`	Protection against cross-site request forgery (CSRF) attacks	2 hours
`remember_web_*`	Persistent sign-in, set only if you select "Remember me" when signing in	Up to 400 days or until you sign out

2.2 Local storage (localStorage)

We use your browser's localStorage to store your cookie choice. This data remains on your device and is not transmitted to the server.

Key	Purpose	Duration
`delibera_cookie_consent`	Stores your cookie preferences	Until you delete it
`delibera_cookie_consent_date`	Date of your choice	Until you delete it

2.3 Analytics and marketing cookies

We currently do not use analytics, marketing or advertising tracking cookies, nor any third-party analytics services. Should we introduce such tools in the future, we would only activate them with your explicit consent and would update this policy accordingly.

2.4 No external services

The website's fonts and resources are served from our own servers: simply visiting the website does not result in any third-party cookies being set.

3. Managing cookies

3.1 Via our banner

On your first visit you can state your preferences. You can change them at any time:

3.2 Via your browser

You can configure your browser to refuse or delete cookies; in that case, you will not be able to sign in to your account. Instructions vary by browser:

Chrome: Settings → Privacy and security → Cookies
Firefox: Settings → Privacy & Security → Cookies and Site Data
Safari: Settings → Privacy
Edge: Settings → Cookies and site permissions

4. Further information

For information on the processing of personal data, please see our Privacy Policy.

5. Contact

For questions about this policy: delibera@ticinohub.ch

Imprint

This translation is provided for information only. In case of any discrepancy, the Italian version prevails.

Website operator

ElaraTeq Sagl
Carrale di Mezzo 10
6533 Lumino
Canton of Ticino, Switzerland

Commercial register entry

UID: CHE-251.226.490 (Commercial Register of the Canton of Ticino)
Legal form: limited liability company (Sagl/GmbH)

Contact

Email: delibera@ticinohub.ch
Website: delibera.ticinohub.ch

Data protection

Email: delibera@ticinohub.ch
See: Privacy Policy

Hosting

Infomaniak Network SA
Rue Eugène-Marziano 25, 1227 Les Acacias (Geneva), Switzerland
Data centres located in Switzerland.

Disclaimer

The content of this website has been prepared with the utmost care. However, ElaraTeq Sagl does not guarantee the accuracy, completeness or timeliness of the content. Use of the content is at your own risk.

Links to external websites are provided for information purposes only. ElaraTeq Sagl has no control over the content of third-party websites and accepts no liability in this respect.

Intellectual property

The name "Delibera", the logo, the design and all content of this website are protected by copyright and, where applicable, trademark law. Reproduction is permitted only with the written consent of ElaraTeq Sagl.

Platform Security

Last updated: 19 October 2026

This translation is provided for information only. In case of any discrepancy, the Italian version prevails.

Protecting our customers' data is a priority for Delibera. Below we describe the main technical and organisational measures we have adopted to secure the platform.

1. Data encryption

Data in transit: all communication between browser and server is protected by TLS (versions 1.2 and 1.3).
Scheduling and voting tokens: encrypted with AES-256-GCM, using a unique initialisation vector for each token, ensuring their confidentiality, authenticity and integrity. Scheduling and voting use separate keys.
Particularly sensitive data: session data, two-factor authentication secrets, recovery codes and API keys are encrypted with AES-256-CBC before being stored.

2. Credential protection

Password hashing: bcrypt algorithm with a cost factor of 12; passwords are never stored in plain text.
Two-factor authentication: available for accounts on plans that include it.
Reset tokens: password recovery links expire after 60 minutes and can only be used once.

3. Session security

Server-side storage: sessions are stored in Redis, separately from application data.
Protected cookies: session cookies are encrypted and signed, transmitted over HTTPS only (Secure flag) and not accessible from JavaScript (HttpOnly).
SameSite protection: SameSite=Lax policy as an additional defence against cross-site attacks.
Limited lifetime: sessions expire after 2 hours of inactivity or when the browser is closed.

4. Protection against attacks

Rate limiting: a maximum of 5 sign-in attempts per combination of IP address and email, followed by a temporary lockout.
CSRF tokens: every form includes a token verified on the server side.
XSS protection: output is systematically escaped by the template engine.
SQL injection prevention: database queries use bound parameters.
Server protection: firewall and automatic blocking of IP addresses making abusive attempts.

5. Hosting and data location

Provider: Infomaniak Network SA, Geneva, with data centres in Switzerland. According to the provider, its data centres are ISO 27001 certified and powered by renewable energy.
Data location: the application, the database, uploaded documents and backups are hosted in Switzerland.
Ancillary services: some ancillary services may process data abroad, in particular payments (Stripe, Ireland/USA) and, only if enabled, AI summaries (Anthropic, USA) and sign-in with Google or Microsoft. Details and the safeguards applied are described in the Privacy Policy.

6. Legal framework

FADP/revFADP: processing is based on the Swiss Federal Act on Data Protection, in force since 1 September 2023.
GDPR: we comply with the EU General Data Protection Regulation where applicable.
Data minimisation: we only process the data necessary to provide the service.

7. Operational security

Daily backups: automatic backup of the database every day.
Logging and monitoring: logging of access and relevant operations in order to detect anomalies.
Least privilege: access and permissions limited to what is necessary, with role-based access control within groups.

8. Vulnerability reporting

If you have identified a potential vulnerability in the Delibera platform, please report it responsibly to delibera@ticinohub.ch.

We ask you not to disclose the vulnerability publicly before we have been able to analyse and fix it. We undertake to respond within 5 business days of receiving the report.

ElaraTeq Sagl
Carrale di Mezzo 10, 6533 Lumino, Switzerland
Email: delibera@ticinohub.ch

Cookie settings

Necessary

Session, CSRF, cookie preferences. Required for the site to work.

Always on

Analytics

Anonymous usage statistics to improve the platform. No personal data shared with third parties.

Marketing

Cookies to show relevant content and ads. Currently not used.