Privacy policy

Language. This Policy is published in English, French, German and Italian. The English text is the reference version; the translations state the same processing and do not restrict any right you have under data protection law.

This Privacy Policy explains what personal data ToupieSoft collects through the website https://toupiesoft.ch (ToupieSoft) and the officepress product, why it is collected, how long it is kept, and what rights you have. It is written to be read, not to be skimmed past.

1. Summary

• The software itself sends us nothing. It runs on your infrastructure, has no telemetry, and never transmits your documents to us.
• We collect what an account, an order and a support conversation require, and little else.
• Documents you upload to the demo are deleted automatically, by default after 180 minutes.
• We use no advertising, no third-party trackers, no CDN and no social plugins. There are no tracking cookies, which is why you see no cookie banner.
• Data is hosted in Switzerland. The only routine transfer abroad is to Stripe for payments.

2. Controller and contact

2.1 The controller responsible for the processing described here is:

ToupieSoft

Switzerland E-mail: noreply@toupiesoft.ch

Represented by ToupieSoft. Enterprise identification number where registered.

2.2 For all privacy matters — requests, questions, complaints — please write to **. We answer in English, French or German — please write to us in one of those three languages.

2.3 We are not required to appoint a data protection officer under Swiss law and have not appointed one. Requests are handled by ToupieSoft.

3. Applicable law

3.1 Our primary framework is the Swiss Federal Act on Data Protection (FADP / nLPD) and its ordinance.

3.2 Where the EU General Data Protection Regulation (GDPR) applies to a particular processing operation — in particular where we offer goods or services to persons in the EU or EEA — we also comply with it, and the legal bases in Article 6(1) GDPR referred to below apply.

3.3 Where the two frameworks differ, we apply the standard that gives you more protection.

4. What we collect, why, and on what legal basis

4.1 Account data

What: e-mail address, name, company name, country, the use case you state when registering, your language, password (stored hashed only), and — if you tick it — your marketing opt-in.

Why: to create and operate your account, authenticate you, give you access to the demo, tickets, downloads and licences, and to understand who the product is for.

Legal basis: performance of the contract and pre-contractual steps (Art. 6(1)(b) GDPR); for the stated use case, our legitimate interest in understanding demand (Art. 6(1)(f) GDPR); for marketing e-mail, your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time.

Retention: for as long as the account exists, then deleted, subject to clause 4.5.

4.2 Demo uploads

What: the document files you upload to the online demo, the converted result, the watermarked preview images, and technical metadata (file name, size, format, conversion duration, errors).

Why: to convert your document and show you the result, so you can judge conversion quality on your own documents before buying.

Legal basis: performance of a pre-contractual measure at your request (Art. 6(1)(b) GDPR) and our legitimate interest in demonstrating the product (Art. 6(1)(f) GDPR).

Retention: uploaded files, converted output and previews are deleted automatically after the retention period configured on the site, by default 180 minutes. The retention period in force is displayed on the demo page. You may delete a conversion earlier at any time from the demo interface.

Details: see clause 5.

4.3 Bug reports and their attachments

What: the ticket you write, and any file you choose to attach — typically the document that converted incorrectly and, if you provide one, a reference PDF showing the expected result. Also the technical details you supply (version, platform, error message).

Why: to reproduce, diagnose and fix the defect.

Legal basis: performance of the contract and our legitimate interest in maintaining the product (Art. 6(1)(b) and (f) GDPR).

Retention: attachments to a bug report are kept for as long as the ticket requires and in any event no longer than 60 days after the ticket is closed, then deleted automatically. The text of the ticket may be kept longer as part of the support history (clause 4.4).

Important: attaching a document is always voluntary. If your document contains personal, confidential or regulated data, please redact it, or send a reduced sample that still reproduces the problem. We look at attachments only to the extent needed to diagnose the reported defect. We do not use your documents to train anything, and we do not share them.

4.4 Support tickets and correspondence

What: subject, message content, attachments other than bug-report files, ticket status and history, and the e-mail correspondence relating to it.

Why: to answer you, keep a record of the case, and improve documentation.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR); legitimate interest in evidence of what was agreed (Art. 6(1)(f) GDPR).

Retention: normally for the duration of the customer relationship plus the applicable limitation period; then deleted.

4.5 Orders, invoices and licence data

What: company name, billing address, country, VAT number where supplied, order reference, plan, currency, amount, payment status, invoice, licence identifier, validity period, and the identifiers of the personalised package generated for you.

Why: to conclude and perform the contract, issue the licence, produce invoices, and comply with accounting and tax law.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and compliance with a legal obligation (Art. 6(1)(c) GDPR).

Retention: ten (10) years from the end of the financial year concerned, as required by Swiss accounting law (Art. 958f of the Swiss Code of Obligations). Data retained for this reason is blocked from other use. Note that this obligation prevails over a deletion request for the affected records (clause 12.4).

4.6 Payment data

What: we do not receive or store your full card number. Stripe processes the payment and returns to us the confirmation, the amount, the currency, the payment method type, the last four digits and the card brand, the billing name, country and VAT number, and the identifiers linking the payment to the order.

Why: to take payment, reconcile it and produce the invoice.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR) and legal obligation (Art. 6(1)(c) GDPR).

Retention: as for clause 4.5.

Recipient: Stripe — see clauses 9 and 10.

4.7 Transactional e-mail

What: your e-mail address, the message sent, and delivery status (accepted, delivered, bounced).

Why: to send e-mails you need — address verification, password reset, order confirmation, licence delivery, renewal and expiry notices, replies to tickets.

Legal basis: performance of the contract (Art. 6(1)(b) GDPR).

Retention: delivery logs for a short period for troubleshooting; the underlying records as for the relevant category above.

Note: transactional e-mail contains no tracking pixels and no click tracking.

4.8 Marketing e-mail

What: e-mail address and language, where you opted in.

Why: to send occasional product news.

Legal basis: your consent (Art. 6(1)(a) GDPR), and Art. 3(o) of the Swiss Unfair Competition Act.

Retention: until you withdraw consent. Every message contains an unsubscribe link, and you can change the setting in your account. Withdrawal has no effect on your account or licences.

4.9 Server logs

What: IP address, date and time, requested URL, HTTP status, referrer, user agent, and for security events the account concerned and the outcome.

Why: to operate the site, diagnose faults, and detect and mitigate abuse — brute-force attempts, scraping, denial of service.

Legal basis: legitimate interest in the security and stability of the service (Art. 6(1)(f) GDPR).

Retention: ordinary web server logs are kept for 30 days. Security-relevant records — failed logins, rate-limit hits, administrative actions in the audit log — are kept for up to 12 months, and longer where needed to pursue a specific incident.

4.10 Analytics

4.10.1 We do not use Google Analytics or any comparable third-party analytics service.

4.10.2 Where analytics is enabled at all, it is a self-hosted, privacy-friendly measurement running on our own infrastructure in Switzerland, which records aggregate page views, referrers and country without cookies, without cross-site identifiers, and without profiling. IP addresses are used only transiently to derive a country and are not stored in the analytics data.

4.10.3 No analytics data is shared with third parties, and it is not combined with your account data.

5. The demo in detail

5.1 Who can use it. The demo is available to registered users, which lets us prevent abuse and attribute conversions to a session.

5.2 How it runs. Your file is converted in an isolated sandbox with no access to other users' data. The result is shown to you as watermarked preview images, not as a downloadable PDF, so the demo cannot be used as a free conversion service.

5.3 Who looks at it. Nobody looks at your file as a matter of routine. Conversion is automated. A member of staff may inspect a file only where you have attached it to a bug report (clause 4.3), or where we investigate a specific technical failure or a suspected abuse of the service.

5.4 Deletion. Files, converted output and previews are removed by an automatic job after the retention period — by default 180 minutes. Deletion covers the uploaded file, the generated artefacts and the temporary working data. Backups of the demo storage, where they exist, are rotated within a short period.

5.5 What we ask of you. Please do not upload documents containing sensitive personal data, trade secrets of others, or data you are not authorised to share. If you need to test with such documents, run the library on your own machine instead, under a trial licence or a subscription licence: it converts entirely inside your own process and never sends anything to us. Nothing is distributed free of charge, so there is no unlicensed download to fall back on.

6. The software itself

6.1 officepress runs entirely on your own infrastructure. It contains no telemetry, does not phone home, does not require a network connection to validate a licence, and does not meter conversions. We receive no documents through it and have no visibility of how you use it.

6.2 Each package is individually fingerprinted so a leaked copy can be traced. The identifiers involved identify the licence, not the person using it, and are not transmitted anywhere by the software. They are also written into the metadata of the PDFs the software produces (/Producer and /ID); those identifiers contain no personal data about the document's author or content.

6.3 Because we act on no document data through the software, we are not your processor in respect of the conversions you run. You remain the controller of your own documents. Where we do process personal data on your behalf in a support context, we conclude a data processing agreement on request ().

7. Cookies

We use the smallest set of cookies that lets the site work. None of them tracks you, and none of them is shared with a third party.

7.1 There are no advertising cookies, no analytics cookies, no social media cookies and no third-party cookies. We embed no external fonts, no CDN and no social plugins, so no third party receives your IP address by way of the page loading.

7.2 For this reason we do not display a cookie consent banner. We say this plainly rather than showing a banner for appearance's sake: under Swiss law and under the ePrivacy rules as applied in the EEA, cookies that are strictly necessary or that merely store a preference you expressed do not require consent. If we ever add a cookie that does require consent, we will ask for it before setting it.

7.3 You can delete cookies in your browser at any time. Deleting the session cookie logs you out; deleting the language cookie resets the site to its default language.

7.4 We use browser local storage only for transient interface state (for example the state of the demo view). It contains no identifiers used to track you.

8. Recipients and processors

We do not sell personal data, and we do not disclose it except as described here.

8.1 Stripe — payment processing. Stripe Payments Europe, Ltd. (Ireland) and affiliated Stripe entities including Stripe, Inc. (United States) receive the billing and payment data necessary to process your payment. Stripe acts partly as our processor and partly as an independent controller for fraud prevention and its own regulatory obligations, under its own privacy policy.

8.2 Hosting provider — the site, the database, the demo sandbox and the backups are hosted in Switzerland. Our hosting provider acts as our processor under a written agreement and has no right to use the data for its own purposes. The provider is named in our Legal Notice at https://toupiesoft.ch/legal/imprint, and we identify it on request at .

8.3 E-mail provider — outgoing e-mail (verification, orders, licences, ticket replies) is transmitted through our e-mail provider, acting as our processor. The provider processes the recipient address, the message and the delivery status.

8.4 Professional advisers and authorities — our accountant and auditor where required for bookkeeping, and courts or authorities where we are legally obliged to disclose. We disclose only what is required, and we tell you where we are permitted to do so.

8.5 Business transfer — if the business is transferred to a company formed to continue it, or to a successor, customer data may be transferred with it. The recipient is bound by this policy, and you are informed.

8.6 All processors are bound by written agreements containing confidentiality and security obligations, and process data only on our instructions.

9. International transfers

9.1 Data is stored and processed in Switzerland. We do not routinely transfer it elsewhere.

9.2 The exception is Stripe, whose group includes entities in the United States. Transfers to Stripe entities outside Switzerland and the EEA take place on the basis of the European Commission's Standard Contractual Clauses, recognised by the Swiss Federal Council with the Swiss addendum, together with Stripe's supplementary measures, or on another lawful transfer mechanism relied on by Stripe.

9.3 Transfers necessary to perform a contract with you, or to establish or exercise legal claims, may also be based on Art. 17 FADP and Art. 49 GDPR.

9.4 If a processor were to move data outside Switzerland or the EEA, we would ensure an equivalent safeguard applies first.

10. Security

We take the following measures, among others:

• Encryption in transit — the site is served exclusively over TLS, with HTTP Strict Transport Security.
• Password storage — passwords are stored only as argon2id hashes with a per-password salt and deliberately costly parameters. We cannot read your password, and we never send it by e-mail.
• Two-factor authentication for staff — administrative accounts require a second factor.
• Isolated conversion sandbox — demo conversions run in an isolated environment separated from the application and from other users' data.
• Automatic deletion — demo uploads and bug-report attachments are removed by scheduled jobs, so retention does not depend on someone remembering.
• Least privilege — access to production data is limited to the persons who need it; administrative actions are recorded in an audit log.
• Rate limiting and abuse detection on login, registration, uploads and ticket creation.
• Backups — encrypted, held in Switzerland, and rotated on a defined schedule.
• Upload restrictions — file type and size limits, and processing of uploads without executing their content.

No measure makes a system perfectly secure. If a data breach occurs that is likely to result in a high risk to your rights, we will notify the Federal Data Protection and Information Commissioner (FDPIC) and, where required, you, in accordance with Art. 24 FADP and Art. 33–34 GDPR.

11. Automated decision-making

We take no decision producing legal effects concerning you, or similarly significantly affecting you, based solely on automated processing. We do not profile you. Automated checks limited to fraud and abuse prevention (for example rate limiting or Stripe's fraud scoring during a payment) may block a specific action; you can always reach a human at .

12. Your rights

12.1 You have the right to:

• access the personal data we hold about you, and obtain information on the processing;
• rectify inaccurate or incomplete data;
• erase your data, subject to clause 12.4;
• restrict processing, and to object to processing based on our legitimate interest, on grounds relating to your situation;
• data portability — receive the data you provided in a common, machine-readable format, and have it transmitted to another controller where technically feasible;
• withdraw consent at any time, without affecting the lawfulness of processing before withdrawal;
• not be subject to automated individual decisions (clause 11).

12.2 How to exercise them. Write to * from the address registered in your account, or from another address with enough information to identify you. We reply within 30 days*. If a request is complex we tell you and explain the delay. We may ask for reasonable proof of identity where there is real doubt, and we ask for no more than is needed for that.

12.3 Self-service. You do not need to write to us for the most common cases. In your account you can:

• view and correct your name, company, country, use case and language;
• change your password and marketing preference;
• export your data — account details, orders, licences, tickets and demo history — in a machine-readable file;
• delete your account, which removes your account data, your demo history and your marketing subscription.

12.4 Limits. Deleting your account does not delete records we must keep by law — in particular orders and invoices, retained for ten years under Swiss accounting law (clause 4.5) — nor licence records needed to establish who holds a licence, nor data needed to establish, exercise or defend legal claims. Such data is blocked from any other use. We tell you what is retained and why when you request deletion.

12.5 Cost. Exercising your rights is free. We may charge a reasonable fee, or refuse, only where a request is manifestly unfounded or excessive, in particular because it is repetitive — and we explain why.

12.6 Complaints. You may lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland, or, if the GDPR applies to you, with the supervisory authority of your habitual residence, place of work or the place of the alleged infringement. We would appreciate the chance to resolve the matter first.

13. Children

The service is directed at businesses and professionals. It is not intended for children, and we do not knowingly collect data from persons under 16. If you believe a child has registered, write to and we will delete the account.

14. Changes to this policy

We may update this policy when the service or the law changes. The current version is always published at https://toupiesoft.ch/legal/privacy, with its version and effective date. Where a change materially affects you, we notify registered users by e-mail before it takes effect. Continued use after that constitutes acknowledgement; where a change requires your consent, we ask for it separately.

15. Contact

For any question about this policy or about your data:

ToupieSoft

Switzerland Privacy contact: General contact: noreply@toupiesoft.ch

Version 1.0 — effective 2026.