Privacy Policy
Last updated: 7 October 2026 · New customers: from 7 October 2026 · Existing customers: from 26 October 2026
This version of our Privacy Policy applies to customers who sign up from 7 October 2026. For existing customers it takes effect on 26 October 2026; until then, the version of 5 October 2026 (effective 20 October 2026) applies. If you do not agree, you may end your subscription before 26 October 2026 and receive a pro-rata refund of prepaid fees. See every change: this version (PDF), previous version (PDF).
Changes in this version
- Section 6.1 now has two lists: sub-processors of customer data (the same list as Annex A of our Data Processing Agreement) and providers for this Website.
- Section 6.1 adds Microsoft 365 for support correspondence, and states the access condition for Grynn Advanced Pvt. Ltd. (India).
- New link to our Data Processing Agreement (tapr.ch/legal/dpa).
- Section 12: changes to this policy now take effect when we publish them; customers who do not agree may end their subscription within 30 days of our notice (Terms of Service, Section 18). This replaces the 14 days' advance notice.
1. Introduction
This privacy policy describes how Grynn GmbH ("TAPR AI", "we", "us", or "our") collects, stores, uses, shares, and processes personal information on https://www.tapr.ch, https://cloud.tapr.ch, and their subdomains (collectively, the "Website").
Grynn GmbH is a company registered in Beringen, Canton of Schaffhausen, Switzerland. We encourage you to read this policy alongside our Terms of Service and Cookie Policy.
2. Scope
This policy applies to personal data collected through our Website and Services. It does not cover anonymised or aggregated data, nor does it govern third-party websites, applications, or services linked from our Website. Third-party data collection is subject to their own privacy policies.
3. Information We Collect
Contact Information
Name, email address, phone number, and company name provided when you create an account, request a demo, or contact us.
Billing Information
Billing name, address, VAT/tax identification numbers. Payment card details are processed by third-party payment providers; we receive only limited information such as the last four digits, payment amount, and timestamp.
Technical Information
IP address, browser type and version, operating system, screen resolution, pages visited, referring/exit pages, visit timestamps, approximate location, and clickstream data.
Service Data
Data you upload or process through our Services, including invoices, ERP connection details, and configuration settings.
KYC Information
Where required for Peppol network access, we may collect identity verification documents and business registration details as part of our Know Your Customer (KYC) process.
4. How We Collect Information
- Directly from you: When you create an account, submit a form, book a demo, or contact us.
- Automatically: Through cookies and analytics tools when you interact with our Website (see our Cookie Policy).
- From third parties: Payment providers, ERP systems you connect, and Peppol network participants.
5. How We Use Your Information
To Provide Our Services
Processing invoices, managing your account, providing support, sending service-related communications, and fulfilling our contractual obligations.
For Legitimate Business Purposes
Improving our products and services, detecting fraud, enforcing our terms, ensuring security, and complying with legal obligations.
For Marketing
With your consent, we may contact you about products, services, and offers. You can opt out at any time via the unsubscribe link in any marketing email or by contacting us.
6. Sharing Information with Third Parties
We may share your information with:
- Service providers (sub-processors): The providers listed in Section 6.1, and payment processors.
- Peppol network: As required for e-invoice delivery and receipt through the Peppol network.
- ERP providers: As necessary to maintain your configured integrations.
- Legal authorities: When required by law, regulation, court order, or governmental request.
- Corporate transactions: In the event of a merger, acquisition, or sale of assets, with prior notification to affected users.
We do not sell your personal data.
6.1 Sub-processors
For customer data. These companies process personal data on our customers' behalf. This is the same list as Annex A of our Data Processing Agreement.
| Provider | Purpose | Location | Condition |
|---|---|---|---|
| Hetzner Online GmbH | Hosting of production systems, databases and backups | Finland (EEA) | — |
| Amazon Web Services, Inc. | Encrypted offsite backup storage (S3 server-side encryption) | EU | — |
| Microsoft Ireland Operations Limited | Support correspondence (Microsoft 365) | EU/EFTA | — |
| Anthropic PBC, OpenAI L.L.C., Google LLC (Gemini / Vertex AI) | AI-powered OCR and invoice data extraction | United States | Only for documents the Customer submits for AI-powered OCR; the whole document is sent; OpenAI and Google only once their data processing agreement is in place; no training on Customer data |
| Grynn Advanced Pvt. Ltd. | Development and support | India | Access to the Customer's invoice data only on the Customer's request or approval for a task, recorded with its scope and time limit, and only once contract, NDA and DPA/SCCs are signed. Safeguard: EU Standard Contractual Clauses with the Swiss addendum, being put in place |
For this Website. These providers handle data of Website visitors, for which we are the controller.
| Provider | Purpose | Location | Condition |
|---|---|---|---|
| Amazon Web Services, Inc. | Relay of Website contact and demo form submissions | United States | AWS data processing addendum with EU Standard Contractual Clauses and a Swiss addendum |
| PostHog Inc. | Cookieless Website analytics | EU | — |
| Microsoft Corporation | Demo booking (Microsoft Bookings) | See Microsoft's privacy statement | — |
If you connect your own AI provider, that provider is not our sub-processor. It processes your documents under your own agreement with it (see Terms, Section 6).
7. Your Rights
Under the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR), you have the right to:
- Access: Request a copy of the personal data we hold about you.
- Rectification: Request correction of inaccurate or incomplete data.
- Erasure: Request deletion of your personal data, subject to legal retention requirements.
- Data portability: Receive your data in a structured, commonly used format.
- Object: Object to processing based on legitimate interests or for direct marketing purposes.
- Restrict processing: Request temporary suspension of processing in certain circumstances.
- Withdraw consent: Where processing is based on consent, withdraw it at any time.
To exercise any of these rights, contact us at contact@grynn.ch.
8. Data Storage and Retention
Your data is hosted on Hetzner servers in Finland, within the European Economic Area. Offsite backups are stored with Amazon Web Services (see Section 6.1).
- Active accounts: Data is retained for the duration of your account and 180 days after termination.
- Billing records: Retained as required by Swiss tax and commercial law.
- KYC records: Retained as required by applicable anti-money laundering regulations.
- Backups: May be retained for up to six months for disaster recovery purposes.
After the applicable retention period, data is securely deleted.
9. Data Security
We implement industry-standard technical and organisational measures to protect your data, including TLS encryption in transit and role-based access controls. The measures in place are listed on our Security page.
10. International Data Transfers
Customer data is hosted in the EEA (Finland). Some processing takes place outside the EEA and Switzerland:
- AI-powered OCR with our providers (Anthropic, OpenAI or Google, United States): under each provider's data processing agreement, which includes the EU Standard Contractual Clauses and a Swiss addendum. We use a provider only once that agreement is in place.
- Relay of Website form submissions (Amazon Web Services, United States): under the AWS data processing addendum, which includes the EU Standard Contractual Clauses and a Swiss addendum.
- Development and support (Grynn Advanced Pvt. Ltd., India): access to customer data only on the customer's request or approval. We are putting a data processing agreement with the EU Standard Contractual Clauses and the Swiss addendum in place.
11. Children's Privacy
Our Services are not directed at individuals under the age of 16. We do not knowingly collect personal data from children.
12. Changes to This Policy
We may update this policy. We will tell you about material changes by email or by a prominent notice on our Website, and they take effect when we publish them. Customers who do not agree may end their subscription within 30 days of our notice, as set out in Section 18 of our Terms of Service. We encourage you to review this page periodically.
13. Contact
For questions about this privacy policy or to exercise your data rights:
Grynn GmbH
Beringen, Schaffhausen, Switzerland
Email: contact@grynn.ch