Privacy Policy

Last updated: 19 October 2026

This translation is provided for information only. In case of any discrepancy, the Italian version prevails.

1. Controller

ElaraTeq Sagl
Carrale di Mezzo 10, 6533 Lumino, Switzerland
UID: CHE-251.226.490
Email: delibera@ticinohub.ch

For any questions regarding data protection or to exercise your rights, please contact us at the address above.

2. Legal framework and legal bases

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP/revFADP), in force since 1 September 2023, and, where applicable, the EU General Data Protection Regulation (GDPR).

The legal bases for processing are:

• Performance of a contract (Art. 6(1)(b) GDPR; cf. Art. 31 para. 2 let. a FADP): provision of the Delibera services.
• Consent (Art. 6(1)(a) GDPR; Art. 31 para. 1 FADP): optional features such as AI summaries and any non-essential cookies.
• Legal obligation (Art. 6(1)(c) GDPR): retention of accounting and tax records.
• Legitimate interest (Art. 6(1)(f) GDPR; Art. 31 para. 1 FADP): security, prevention of abuse and improvement of the service.

3. Data processed

3.1 Account data

Name, email address, password (stored only as a bcrypt hash), time zone, preferred language and, if enabled, two-factor authentication. Provided by you upon registration or in your profile settings.

3.2 Content and usage data

Groups and members, meetings, agendas, live notes, decisions, minutes, tasks, uploaded documents, votes, scheduling polls and electronic signatures of minutes. This data is generated by users in the course of using the platform.

3.3 Technical data

IP address, browser type, operating system and date/time of access. Collected automatically for security, diagnostic and abuse-prevention purposes.

3.4 Payment data

For paid subscriptions: billing details and payment status. Credit card data is processed exclusively by Stripe and is not stored by us.

3.5 Cookies

See our Cookie Policy.

4. Purposes of processing

• Provision and management of the Delibera service (meetings, minutes, tasks, scheduling, voting).
• Authentication and account security.
• Sending transactional emails (notices of meeting, reminders, confirmations, password resets).
• Simple electronic signature of minutes (SHA-256 hash, signatory's identity, date/time and IP address).
• Optional generation of meeting summaries using artificial intelligence (see section 6).
• Billing and subscription management.

5. Recipients and service providers

The content of meetings, notes, minutes and tasks is visible to the members of the respective group. We do not sell or rent personal data and do not disclose it to third parties for marketing purposes.

We use the following service providers (Art. 19 para. 2 let. c and para. 4 FADP):

The website's fonts are served directly from our own servers: no requests are sent to external font services.

6. AI summaries (optional feature)

The automatic summary feature is disabled by default. It is only activated if the owner of a group enters their own Anthropic API key in their profile settings and requests a summary to be generated. In that case, we transmit the following meeting data to Anthropic PBC (USA), using the customer's own key and account: title, group name, date, names of participants, agenda items, live notes and decisions, tasks with the name of the assignee and due date.

Processing by Anthropic is governed by the terms agreed between the customer and Anthropic. The group owner who enables the feature is responsible for informing the participants. The API key is stored in encrypted form and can be removed at any time.

7. Disclosure of data abroad

The core application data and the database are hosted in Switzerland by Infomaniak. The ancillary services listed in section 5 may process data abroad (EU/EEA and USA). According to the Swiss Federal Council, Ireland and the other EU/EEA states provide an adequate level of data protection. For transfers to the USA, we rely on the recipient's certification under the Swiss-U.S. Data Privacy Framework (and the EU-U.S. Data Privacy Framework) or, failing that, on standard contractual clauses recognised by the FDPIC and the European Commission.

8. Retention period

• Account data: for the lifetime of the account; after deletion, backup copies are overwritten within 30 days.
• Minutes and electronic signatures: for the period determined by the group, taking into account applicable retention obligations (e.g. Art. 958f CO: 10 years for certain records).
• Technical logs: 90 days.
• Accounting and billing data: 10 years (Swiss statutory obligations).

9. Your rights

Within the limits of the FADP and, where applicable, the GDPR, you have the right to:

• Access: obtain information about and a copy of your personal data.
• Rectification: have inaccurate data corrected.
• Erasure: request deletion, subject to statutory retention obligations.
• Data portability: receive your data in a structured, commonly used format.
• Objection and restriction: object to processing based on legitimate interest.
• Withdrawal of consent: at any time, with effect for the future.

To exercise your rights: delibera@ticinohub.ch. We do not make automated individual decisions within the meaning of Art. 21 FADP.

10. Security

We implement appropriate technical and organisational measures, including TLS encryption in transit, AES-256-GCM tokens for scheduling and voting links, bcrypt password hashing, encryption of particularly sensitive data (e.g. 2FA secrets and API keys), SHA-256 hashes for electronic signatures, role-based access control, daily backups and access logging. Further details are available on the Security page.

11. Changes

We may update this privacy policy. The version published on this website applies; material changes will be communicated to registered users by email.

12. Supervisory authority

You have the right to lodge a complaint with the competent supervisory authority:
FDPIC — Federal Data Protection and Information Commissioner (EDÖB)
Feldeggweg 1, 3003 Bern, Switzerland
www.edoeb.admin.ch

If you reside in the EU/EEA, you may also contact the supervisory authority of your country of residence.