Privacy Policy

Last updated 14 October 2026. This policy covers the Concluded closed beta (the app) and this website.

Who is responsible

During the closed beta, Concluded is operated by Technical Administrator & Operator: Gabriel Kralicz, c/o JL Consulting Group GmbH#1697, Zürcherstrasse 84, 8852 Altendorf, Switzerland. Contact: hello [at] concluded [dot] ch.

Two roles matter here. For your account, sign-in, security, support and this website, we are the controller. For the content of a contract and the details of the people named in it, the account holder who created the contract decides what happens to it and is responsible for it; we process that data for them, on their instruction (see the Terms of Use, “Processing of contract data”).

What we process

• Account: email address, first and last name, company, optionally a mobile number and a company address. Sign-in runs through Amazon Cognito; your password never reaches our servers.
• Contracts: the uploaded document and every version of it, appendices, comments and change requests, the agreement and signature records, the signature marks people draw, the sealed PDF and the audit trail.
• People named in a contract (counterparty, co-signers): name, email address, mobile number (to send the access code by SMS) and the company they sign for. The counterparty does not need an account. Both sides see the names and email addresses of everyone who signs; a mobile number is shown only to the side that named it.
• IP address: recorded when someone passes the access gate and when they sign, kept as evidence, and shown to no user.
• Mail and SMS delivery: whether a message bounced or was reported as spam. A one-way fingerprint of the address is stored, not the address.
• Feedback you send us from the app.
• Technical logs: they name a record by its reference, not the customer, and contain no contract text.
• This website: anonymous visit statistics, described at the end.

The closed beta is free: we process no payment data.

Why we process it

To provide the service you asked for: negotiating a contract to agreement, signing it and keeping the record. To keep the service secure and to prevent abuse. To answer you. To meet legal obligations. We do not sell data, run advertising, or build profiles.

Who receives it, and where

Contract data is stored and processed in Amazon Web Services (AWS), Zurich region: database, document storage, the sign-in service, the document editor (which we host ourselves, so no third-party editor sees your text) and mail and SMS sending.

What is not in Zurich, and what it contains:

• Sign-in code emails are sent through AWS in Frankfurt (Germany). They carry an email address and a code, never a contract or a name.
• Two further AWS resources outside Zurich (a security certificate in the United States and a cost budget) hold no personal data.

AWS is part of a US-headquartered group. Storing data in Switzerland does not by itself rule out access requests under foreign law; we have taken the technical measures described below and no contract content is shared with any other third party.

The list of our sub-processors names each provider, its location and what it receives.

How long we keep it

While your account exists, nothing is deleted: a contract and its record are kept for as long as you keep the account. You can export everything and then delete the account on request.

If your access ends, your account stays fully usable for 30 days, then readable and exportable for 12 months, and we write to you before anything is removed (about 60, 30 and 7 days before). An account with no sealed contract is removed after 30 days. After a deletion we keep only a minimal proof record for each sealed contract: its reference, the seal date and two document fingerprints, with no names.

Swiss law obliges companies to keep business records for ten years (Code of Obligations, art. 958f). That duty is the account holder’s for their own contracts; export your records to keep your own copy.

How it is protected

We protect personal data with technical and organisational measures appropriate to the risk. Data is encrypted in transit and at rest, and contract documents and their versions, comment text, the contact details of the people named in a contract and signature marks are additionally encrypted by the application before they are stored. We treat contract content as confidential and access it only where you ask us to for support.

Cookies in the app

The app sets only strictly necessary cookies: your signed-in session and your language choice. There are no advertising or tracking cookies, and no third-party analytics in the app.

Your rights

You may ask us for access to your data, correction, deletion, a copy in a common format, restriction or objection. For data in a contract you did not create, we will refer you to its creator or help you reach them. We may have to verify your identity first. Write to hello [at] concluded [dot] ch. You can also contact the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU/EEA, your local supervisory authority.

This website

This site sets no cookies and loads no analytics scripts. We keep anonymous visit statistics: for each page served, our content delivery network records the date and time, the page, a country code, the referring site and the browser identifier. Your IP address is not stored; the country code is derived from it at the edge server before the entry is created. Stored in Switzerland (AWS, Zurich) and deleted after 90 days, these records serve only to count how many people read the site, and in which language. AWS processes your IP address and standard request details transiently to deliver and protect the site.

Changes

We will update this policy as Concluded develops, in particular when a company is formed or the closed beta ends, and change the date above. If a change affects how your data is used, we will tell account holders by email.