Privacy policy
This policy explains which personal data Sarun Desk processes, why, and what rights you have. It follows the Swiss Federal Act on Data Protection (FADP). Where the EU General Data Protection Regulation (GDPR) applies, the same principles apply.
1. Who is responsible
Marco Jost, Sarun Desk, Allmendstrasse 9, 6048 Horw, Switzerland, [email protected].
2. Visiting the website
The website is served by Cloudflare. When you visit it, Cloudflare automatically processes technical data such as your IP address, browser type and the time of the request, to deliver the pages and to protect them against attacks. This data is not used to identify you and is kept only briefly. The website sets no cookies, uses no analytics or advertising tools, and loads its fonts from our own server.
3. The demo
The demo runs entirely in your browser. The name and e-mail address you enter, and everything you change in the demo, are stored only in your browser's local storage on your own device. They are not sent to us. You can delete them at any time with «Sign out» in the demo or by clearing your browser data.
4. Contacting us
If you write to [email protected], we use your message and contact details to answer you and, if you wish, to prepare an offer. Our e-mail is forwarded by Cloudflare Email Routing to a mailbox hosted by Google. We keep the correspondence as long as needed for the conversation and for legal retention duties.
5. Using the Sarun Desk platform
When a firm uses Sarun Desk, two kinds of data are processed:
- Account data of the people who sign in (name, work e-mail address, role, sign-in times). We are responsible for this data and use it to provide the service, to secure it and to send the notifications a person has switched on.
- Data the firm enters about its clients and staff, for example company details, contact persons, documents, timesheets and leave. For this data the firm is responsible; we process it only on the firm's behalf and according to its instructions, as set out in the data processing terms (Terms, part B).
Each firm's data is separated in the database itself. Other firms cannot see it, and a firm's clients only see their own company in the client portal.
6. Service providers and countries
We use the following providers. They process data only to provide their service to us.
| Provider | Purpose | Location of data |
|---|---|---|
| Cloudflare, Inc. | Website and app delivery, e-mail forwarding, protection against attacks | Global network, company in the USA |
| Supabase, Inc. | Database, sign-in and file storage for the platform | Singapore (data centre of Amazon Web Services) |
| Google LLC | Our e-mail inbox | USA / EU |
| Resend, Inc. | Sending sign-in links and the morning brief by e-mail, if used | USA |
| Telegram | Morning brief in Telegram, only if a person connects it | Telegram's servers |
Some of these countries do not have data protection laws equivalent to Switzerland's. Where this is the case, we rely on the providers' standard contractual clauses recognised by the Swiss Federal Data Protection and Information Commissioner, or on other safeguards permitted by law.
7. How long we keep data
Account and firm data are kept for as long as the firm uses Sarun Desk. After a subscription ends, the firm can export its data; we delete it within 30 days, except where the law requires us to keep records (for example invoices, for 10 years under Swiss law). Backups are overwritten within a further 30 days.
8. Security
All connections are encrypted. Access to data is controlled by role, and the separation between firms is enforced in the database. Only a small number of people at Sarun Desk can access the systems, and only for support or maintenance.
9. Your rights
You can ask what data we hold about you, and have it corrected, deleted or handed over in a common format. You can object to processing. Write to [email protected]. If your data was entered by a firm that uses Sarun Desk, please contact that firm first; we will support it. You can also complain to the Swiss Federal Data Protection and Information Commissioner (FDPIC).
10. Changes
We may update this policy. The current version is always available on this page.