Privacy Policy

1. Data controller

rombro ag, Volketswil (Switzerland). Contact: hello@quintio.ch. quintio is independent and has no affiliation with bexio AG.

2. What data we process

• Account and contact data (email address, company name).
• bexio access tokens and metadata of the documents we mirror into your Google Drive (file names, date, document type — never the file content).
• Google OAuth tokens for accessing the folder quintio creates in your Drive.
• Usage events of the «quintio für bexio» browser extension: event name, time, and version number, associated with your account (section 7).
• Technical log data for operating the service and troubleshooting.

3. Use of Google user data

quintio requests only the smallest permission from Google that makes a sync like ours possible at all. It also keeps us, technically, exactly where we belong:

We can see and modify only the files that quintio itself places in your Drive. quintio creates its own folder in your Drive on the first sync and mirrors only into it. Everything else in your Drive stays invisible to us — whatever quintio did not create itself does not exist for us.

The use of information from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. quintio does not sell Google user data, does not use it for advertising, and does not pass it on to third parties, except where necessary to provide the service, legally required, or explicitly requested by you. No human review of this data takes place, except with your consent, for troubleshooting, or for security reasons.

4. Storage and security

Your documents are not stored with us. They flow directly from bexio into your Google Drive — quintio is pure pass-through. No document and no attachment ever resides on our servers. Our database contains only your account information and the technical metadata of the sync (such as file name and date) — never the content of a document.

Access tokens are stored with strong encryption (AES-256). The service runs on infrastructure in the EU. quintio is a Swiss provider (rombro ag, Volketswil) — this is a statement about the company's registered office, not about the hosting location.

5. Disclosure to third parties

We use processors where necessary to operate the service: Google (Drive storage), bexio (source data of your documents), Railway (application hosting, EU), Cloudflare (operation and delivery of the quintio.ch website and of our extension service ext.quintio.ch — hosting, CDN, DNS, and storage of the web analytics and usage data described in sections 6 and 7; Cloudflare, Inc., USA, certified under the Swiss-U.S. Data Privacy Framework), Resend (transactional emails), Stripe (payments). No disclosure beyond this takes place.

6. Web analytics and cookies

Technically necessary processing when the page is loaded. This website is delivered via Cloudflare. When you load it, Cloudflare processes, as a technical necessity, your IP address and connection data (such as the page requested, the time, and the browser identifier) in order to deliver the page and defend against attacks. This data remains in Cloudflare's security and operational logs; we ourselves do not store any IP addresses.

Anonymous statistics, without cookies. On quintio.ch we measure visits anonymously: page views, clicks on our sign-up and log-in buttons, country of origin, referrer, and a daily-rotating, non-reversible hash for counting unique visitors (Cloudflare Workers Analytics Engine). In the process, no IP address is stored and no one is recognized across multiple days.

A first-party cookie for recognition. In addition, we set our own cookie (q_vid, 12-month lifetime) to recognize returning visits and — if you later register for quintio or open a personalized link from one of our emails — to associate your earlier visits to quintio.ch with your contact record. That way we understand which content was useful to you. We store the pages visited, clicks on our sign-up and log-in buttons, the time, the acquisition channel, and the country, as well as device type, browser, and operating system — no IP addresses. We keep the page history for 12 months. The legal basis is our legitimate interest in understanding and improving our offering.

You have a choice. On your first visit you can decline this in the cookie notice, and change your decision at any time via «Cookie settings» in the footer. If you decline, we set no cookie and store no visit history — the anonymous, cookieless statistics remain unaffected. No advertising trackers and no third-party analytics services are used.

7. Browser extension «quintio für bexio»

Your bexio data stays in your browser. The «quintio für bexio» browser extension adds small helpers to bexio — such as the matching town for an entered postal code, or downloads like the VAT report and the chart of accounts. All processing happens entirely in your browser: form contents, amounts, and other bexio data never leave your browser and are not transmitted to us.

Locally stored data. If you sign in to the extension with your quintio account, it stores a sign-in token, a cache of the place directory, and a short queue of not-yet-transmitted usage events in your browser. This data serves only to operate the extension; your browser removes it when you uninstall.

Usage events. To understand which features are used, the extension records named events — for example «postal code filled in», «VAT report downloaded», or the display of a notice about a quintio feature. Only the name of the event, the time, and the version number of the extension are transmitted — no bexio content, no postal codes or town names, and no IP addresses. The events go to our own infrastructure (ext.quintio.ch, operated on Cloudflare) and are associated there with your quintio account (email address). The legal basis is our legitimate interest in understanding and improving our offering and in supporting you.

Retention. We keep individual usage events for 12 months, and aggregated usage counters (such as how often you have used a feature in total) until your account is deleted. When you delete your account, this data is deleted as well.

You have a choice. Without signing in, no usage events are transmitted. If you uninstall the extension, your browser also removes the locally stored data. In the extension, too, no advertising trackers and no third-party analytics services are used.

8. Retention and deletion

You can delete your account at any time. After that, we remove your tokens and metadata. The files already mirrored into your Google Drive belong to you and remain in your Drive. For the usage events of the browser extension, the retention periods in section 7 apply.

9. Your rights

Under the Swiss Federal Act on Data Protection (revised FADP) and, where applicable, the GDPR, you have the right to access, rectification, erasure, and withdrawal of consents you have given. You can revoke Google access at any time in your Google account settings.

10. Contact

Questions about data protection: hello@quintio.ch.