Last updated: October 26th, 2026
BePaid SA, Rue des Jordils 40, 1025 St-Sulpice, Switzerland (“BePaid”, “we”), is responsible for the processing described here. It concerns the bepaid.ch website and the BePaid application (the “Service”). For any question about your data: hello@bepaid.ch.
We apply the Swiss Federal Act on Data Protection (FADP). Where the European Union's General Data Protection Regulation (GDPR) applies, you also have the rights it provides.
The documents and data a business records in BePaid (invoices, receipts, bank statements, data on its customers and suppliers) remain its own. For this data, BePaid acts on the business's behalf and on its instructions, as set out in the terms of use (section 11). If you received an invoice or a message from a business that uses BePaid, that business is responsible for your data: contact it, and we will help it answer you.
Your account. Name, email address, profile picture, phone number if you provide it, language, the organizations you belong to and your role in each. Sign-in is handled by Clerk: BePaid never knows your password. If you sign in with a third-party account offered on the sign-in page, we receive your name, email address and picture.
Your business. Company name, address, UID and VAT numbers, bank details, logo, chart of accounts and VAT settings. We complete them from the Swiss public registers (the commercial register through Zefix, the UID register).
Your documents and accounting. The invoices, quotes and reminders you issue; the receipts you upload or forward to us by email (supplier invoices, till receipts, bank statements); the entries, reconciliations, VAT returns, accounting exports and payment files. These documents often contain data about other people: your customers and suppliers, their contact details, their bank accounts, and sometimes your employees (expense claims).
Emails received. Your organization has an inbound address. We record the emails that arrive there (sender, recipient, subject, text and attachments) and the result of the sender check. An email from an unknown sender is processed only after you approve it.
Exchanges. The messages exchanged in BePaid between a fiduciary and its client, requests for missing documents, the emails sent from BePaid to your customers and contacts, and their replies.
Support. When you write to support from the application: your message, your files and, if you take one, a capture of the page you are on. Each message is sent with technical information that helps us understand the problem: the page you are on and the last pages visited, the errors that occurred in your browser and the requests that failed, your browser and system, the screen size, the time zone, the active organization and, in the fiduciary space, the client being viewed. Sensitive values in page addresses (tokens, codes) are masked before they are stored.
Payments. Your customer identifier at Stripe, the plan chosen, the amounts, dates and status of payments and subscriptions, and the subscription invoices we send you. Card details stay with Stripe.
Where your visit came from. The site you came from, the landing page, campaign parameters (utm) and ad click identifiers (gclid, gbraid). Your browser keeps them until you sign up; we then store them with your account.
Use of the Service. The pages viewed, clicks and, for some visits, a recording of how they unfolded (section 7). The text of clicked elements is never captured, and in the application the text of the pages is masked in these recordings.
Technical data. IP address, browser, device and our hosting providers' logs, used in particular for security. When an error occurs on our servers, we record its technical description, the page address (sensitive values masked) and the identifier of your account and organization, to fix the problem.
Contact form. Your name, email address, company, phone number if you provide it, and your message.
We do not ask you for any sensitive data within the meaning of the law, such as data on health or opinions. If your documents contain any, we process it like the rest of your documents, to provide the Service.
| Purpose | Legal basis (GDPR) |
|---|---|
| Provide the Service: account, organizations, documents, accounting, emails sent for you, fiduciary space, support | Performance of the contract |
| Read your documents and emails with artificial intelligence, propose entries and reconciliations | Performance of the contract |
| Check and improve the quality of this reading, for example by comparing two models on the same documents | Legitimate interest |
| Collect subscriptions and keep our accounts | Performance of the contract; legal obligation |
| Send the Service's emails, reminders and summaries | Performance of the contract |
| Send welcome emails, tips on using the Service and information about our offers | Legitimate interest; you can object at any time |
| Measure the audience, understand how the Service is used, improve it and fix its errors | Legitimate interest |
| Measure the effectiveness of our advertising campaigns | Legitimate interest |
| Protect the Service against abuse (reCAPTCHA on the contact form, checks on email senders) | Legitimate interest |
| Compile anonymous, aggregated statistics, publish them or pass them on | Legitimate interest |
| Comply with our legal obligations | Legal obligation |
The FADP does not require a legal basis for each processing; the right-hand column applies to the GDPR. We may derive from the Service's data anonymous, aggregated statistics that identify neither a person nor a business, and use, publish or pass them on, including for a fee. Beyond these statistics, we use your business's documents only for the purposes described here.
BePaid reads your documents with artificial intelligence models: it extracts the text, amounts, dates, VAT, supplier or customer, classifies the emails received, matches bank transactions with receipts and suggests accounts. These models are provided by:
The document, or its text, is sent to them for this task only. The text sent and the answer received are stored on our side to check quality and fix errors, then deleted after 90 days. AI can make mistakes: you check what it proposes before using it, as the terms of use provide. It makes no decision about you within the meaning of the law.
The members of your organization, according to their role.
Your fiduciary, if it manages your organization in BePaid: it sees and processes your documents and accounting, and its staff access them according to the rights it grants them. If you are a fiduciary, you receive your clients' data for the mandate they give you and you are accountable to them for it.
The recipients of what you send. The invoices, quotes, reminders and messages you send from BePaid go by email to your customers and contacts, in your business's name.
Our team, according to its tasks. It opens your documents only to answer your request, fix a problem or check the quality of the Service.
Our service providers, which process data on our behalf and on our instructions:
| Provider | Use | Location |
|---|---|---|
| Vercel | Hosting of the website, the application and uploaded files; cookie-free audience and speed measurement (Vercel Analytics, Speed Insights) | United States |
| Neon | Database | European Union (Germany) |
| Clerk | Sign-in, accounts and organizations | United States |
| Stripe | Payments | Ireland, United States |
| Resend | Sending and receiving emails, tracking their delivery | United States |
| Inngest | Automated tasks, such as reading documents and scheduled emails | United States |
| Pusher | Real-time notifications in the application, without the content of messages | European Union (Ireland) |
| Mistral AI | Reading the text of documents (OCR) | European Union (France) |
| Reading documents with AI (Gemini), audience measurement (Google Analytics), advertising (Google Ads), address entry (Google Maps), contact form protection (reCAPTCHA) | Ireland, United States | |
| Anthropic | Second reading of documents with AI | United States |
| PostHog | Measuring use of the Service and recording visits | European Union (Germany) |
| Slack | Our team's internal notifications, with an excerpt of support messages, never the files | United States |
Authorities, where the law requires it, and any acquirer of BePaid or of the Service, who would remain bound by this policy.
Several providers process data in the European Union or in the United States. Switzerland recognizes the countries of the European Union as providing an adequate level of protection. For the United States, we rely on the provider's certification under the Swiss-U.S. Data Privacy Framework or, failing that, on the standard contractual clauses recognized by the Federal Data Protection and Information Commissioner (FDPIC).
The site uses cookies and your browser's storage:
The cookie banner lets you refuse them. If you refuse, Google Analytics, Google Ads and PostHog stop on the current page and no longer load on your next visits; only the cookies the site needs to work and Vercel's cookie-free measurement remain. You can change your mind at any time with the “Cookie settings” link at the bottom of the page. You can also block or delete cookies in your browser settings; without cookies, sign-in does not work.
Our emails are sent through Resend. We record their sending and delivery, and we stop writing to an address that rejects them or reports them as spam. Links to bepaid.ch may carry campaign parameters (utm).
As long as your account exists, you receive the emails the Service requires: account, invoices and payments, documents received, messages from your fiduciary or your client, support replies. A support reply you have not read in the application after ten minutes is sent to you by email; if you answer it, your answer joins the conversation. Welcome emails, tips on using the Service and information about our offers can be turned off from the preferences page linked in each of them, or by writing to hello@bepaid.ch.
The emails you send from BePaid to your customers and contacts carry your business's name; their replies reach you or join the conversation in BePaid.
We keep data as long as the purposes described and our legal obligations require. In particular:
When your account is deleted, we close your access, replace your email address with a technical address and stop all emails. Your name remains attached to the actions taken in your organization's records, whose history it forms. Database backups may keep deleted data for a limited time.
Exchanges with the site are encrypted (HTTPS). Uploaded documents are stored in a private space: they only open from the application, for authorized people. Access to data is limited by role, including between a fiduciary and its staff, and our providers are bound by data processing agreements. No system is infallible: report any incident to hello@bepaid.ch.
You can ask for access to your data, its correction or deletion, object to a processing, in particular to marketing, and receive your data in a common format. BePaid also lets you export your business's documents and accounting yourself. If a processing is based on your consent, you can withdraw it at any time.
Write to us at hello@bepaid.ch or through the contact page. We may ask you to prove your identity and generally answer within 30 days. Some data must be kept despite a deletion request, for example for our accounting obligations. A request about data managed by your business or your fiduciary is forwarded to them.
You can contact the Federal Data Protection and Information Commissioner (FDPIC) and, if you live in the European Union, the data protection authority of your country.
The Service is intended for businesses and adults. We do not knowingly collect data from minors.
We may change this policy. The version in force is the one published on this page, with its update date. In case of a significant change, we inform you by email or by a notice in the application.
BePaid SA, Rue des Jordils 40, 1025 St-Sulpice, Switzerland. Email: hello@bepaid.ch. Form: contact page.