Privacy policy

Controller

For all questions about data protection and for requests about your rights, write to this address.

What data we process and why

Account. Your e-mail address, the language you chose and a name if one is stored. You sign in with your address, and we link you to your company. When you set up a company, we record with the company which version of the terms you accepted and when; when it takes out Pro, also the version and the time of the checkout, without reference to a person. These details are in the data export, stay as long as the company exists and lose their reference to you when you delete your account.

Sign-in. We send you a sign-in link that is valid for 15 minutes; we store the link only as a hash. To prevent abuse and overload, we count, in periods of at most one day, how many sign-in and password e-mails go to an address, how many exports of the tender list, the awards and the contracts that end soon, and machine translations of tenders an account starts, how many searches in the commercial register an account starts, how many two-factor codes are checked for an account, how many password sign-in attempts arrive for an address, in total and, likewise only as a hash, per IP address, how many changes of the sign-in address an account requests and how many e-mails go out for this to a new address, how many notices of a sign-in on a new device go to an account, and how often a calendar subscription is fetched. We store the address, the account and the subscription only as a hash and delete these counters within two days. We also count how many data error reports an account or, without signing in, an IP address sends; we store the IP address only as a hash, with the same deletion period. For the preview “What fits your business?” without an account we count the requests per IP address, likewise only as a hash and with the same deletion period; we do not store what you type there. We also count, per day, how often the preview was used and how often “Create account and keep it” was chosen there, as a bare number without an IP address or any other link to you; we delete these numbers after 400 days. If an IP address fetches calendar subscription addresses that do not exist, we count that too per IP address, only as a hash and with the same deletion period. If you sign in with a password, we store it only as a hash, never in plain text; you first confirm the address with a link, and you set a new password through a link sent to your address. After you sign in, we store a session with IP address, browser identifier, the time of sign-in and the time of last use. This protects your account from access by others; in your profile, under “Signed-in devices”, you see where you are signed in and can sign out there. The session lasts 7 days and is extended when you use TEXFY. To support customers and to understand how TEXFY is used, the operator sees in its customer overview when you last signed in and last used TEXFY, how many sessions are open and on what kind of device (browser and operating system, without IP address).

Account security. If you turn on two-factor sign-in, we store the key of your authenticator app and your 10 backup codes encrypted, as well as whether the set-up is confirmed and the number of wrong codes in a row, with a lock of 15 minutes where it applies. After the first step of a sign-in, we remember for 10 minutes that the code is still missing, and we keep a hash of an accepted code from the app for 90 seconds so that it does not count a second time. If you have a device remembered, we store a random identifier for it with your account, valid for 30 days and renewed at every sign-in. If you add a passkey, we store its public key, its identifier, a counter, whether it is synced, the transports your browser names, its name and the time; we never receive the private key or your fingerprint, face or PIN, which stay on your device. For adding a passkey and for every sign-in with one, we store a single-use random number for 5 minutes. So that we can warn you when someone signs in from an unknown device, every browser gets a random identifier in a cookie when signing in, and a browser that is already signed in on its next page; with your account we store only a hash of it and the time of the last sign-in, and we forget the device 400 days later; we also read this time, like that of your sessions, to know whether someone from the company has signed in lately: for the pause of the Monday overview after quiet weeks and that of the digest after 90 days without a sign-in (see “E-mails”) and for when the e-mails after a break come. When you sign in from a device we do not know yet for your account, we send you an e-mail with the browser, the operating system and the time, except for the first device of your account. You also get an e-mail when you turn two-factor sign-in on or off or when a passkey is added. “Sign out everywhere” forgets all remembered devices. The data export shows whether two-factor sign-in is on, whether you have a password, the times of your known devices and the name, date and syncing of your passkeys, never keys, codes or hashes. If you change your sign-in address, we store the new address and a hash of the link until you confirm it. The link is valid for 24 hours; without confirmation we delete both in the next daily clean-up. The previous address gets a notice when you make the request and after the confirmation. We delete everything with the account except this record: if the operator helps you at your request with a new sign-in address or by resetting two-factor sign-in, we keep the kind, time and reason of the step for 2 years. The record is part of your data export and stays after the account is deleted, without any link to it, until the period ends.

Company profile. Company name, description, services, cantons, type of offer and the settings for the digest and deadline reminders. We use them to find suitable tenders and show why they fit. If you enter them: company details (legal form, address, UID, VAT registration, website, phone, size, offer languages), the company logo and references (project, client, place, year, contract value, services; no contact persons). We use them to pre-fill the cover letter, the envelope cover sheet and forms such as the self-declaration; the cover sheet and forms are created in your browser or when you download them, and are not stored. The cover letter draft is stored with the bid once you edit it. From the postal code and town of an address in Switzerland or Liechtenstein we determine the centre of the locality (swisstopo's official list of localities), so you can find building applications, building projects in the building register and tenders within a radius of your company's location; we do not use the street or house number for this. It changes with the address and is deleted with the company.

Search in the commercial register. If you look up your company by UID or company name during the setup or under “Company details”, we send what you entered from our server to LINDAS, the linked data service of the Swiss federal administration, and read the company name, UID, legal form, address and seat of the companies found from “Zefix – Central Business Name Index” of the Federal Commercial Registry Office; we do not read the purpose. Nothing about you or your account is sent. Only what you choose with a click is taken over; from then on it is your company details (see “Company profile”), which you can change. We keep the answers about companies for up to eight days so that we do not ask LINDAS again and again; of a search we store only a hash of the search words. Sole proprietorships and partnerships whose company name contains a person's name are shown only when you search for their UID and are not kept. We count how often an account searches, against abuse (see “Sign-in”).

Your work in TEXFY. Saved tenders, search alerts (also for building applications, new awards and contracts ending soon), building applications you watch or hide, with a note, bids with their status, notes and checklists, the check of the eligibility and award criteria with note and assignee, comments with the people mentioned in them, your own tasks with due date and assignee, the documents used for a bid with the maximum age you entered, for company documents the type of proof, issuer and “valid until”, the proof of submission, and notifications of new matches, of proofs that will be too old at the submission deadline, of changes to saved tenders and bids, of expiring proofs (with the file name), of tasks due (only for the person the task is assigned to) and of the end of the trial and a failed payment (both only for the owner). They belong to your company: all members see and work on them together. We store them so that you can continue where you left off. A person mentioned in a comment receives a personal notification with the start of the comment that only they see; we delete it with the comment or the bid. Unless they switched off the e-mails about mentions or have already read the notification, they also receive an e-mail with the bid's title, the start of the comment and the name or e-mail address of the person who wrote it. If you set up a calendar subscription, you get a personal address; we store only an irreversible check value of it and when the subscription was set up, last fetched by a calendar and ended. For a watched building application you can note a person responsible from your team and a follow-up day. When someone else assigns an application to you, and on the follow-up day, you get a personal message with the title of the application and, unless you switched off the mails about tasks, an e-mail; without a person responsible the whole team sees the follow-up message. We delete the responsibility, the follow-up and these messages with the watch, with the application (those that may relate to private persons at the end of their publication period) or with the company; if the person responsible leaves the team, the responsibility is cleared.

Own tenders. If you enter a tender by hand, such as an invitation or a general contractor's request, we store the title, contracting authority, submission deadline, place, canton, source and note as you enter them; do not put personal data there that is not needed. The entry belongs to your company like a bid: all members see and change it, and we never show it to other companies. The owner and the person responsible get reminders of the deadline in the app and, if switched on, by e-mail. It is in your data export and is deleted when you remove it or the company is deleted.

Team tasks. For a task we also store who marked it as done and when; all members see it in the bid's history. Under “My tasks” each person sees the tasks assigned to them and the ones they did in the last 14 days. If a task is opened again, we delete this information; if you delete your account, the task stays without your name.

Data error reports. If you report a data error on a tender page, we store the page, the tender, the kind of error, your text and the time; if you are signed in, also your account and your company. The operator sees the report with your e-mail address, to check it and, if needed, to ask you about it. We delete reports that were dealt with six months after that, and the reports of an account together with the account. Your own reports are in your data export.

Feedback and visits. Feedback on whether a tender fits, with the reason chosen. It belongs to your company and only its members see it. If you hide a tender for yourself only, we store that with the time in your membership: only you see it, and it is deleted when you undo it, leave the company or delete your account. Also the time of your last visit, so that we can mark what is new since then; it also shows whether someone from the company has been here lately, which decides the pause of the Monday overview after quiet weeks and that of the digest after 90 days without a sign-in or visit (see “E-mails”), and when the e-mails after a break come.

First steps. If you hide the first steps on the overview, we store the time with your membership of the company, so they stay hidden in every browser. The time is included in your data export and is deleted with the membership.

Usage events. A few events of use, such as profile set up, tender opened, saved or switched to the official tender, a click from the digest (for the Monday overview of the market, with that part of the e-mail) or a deadline reminder, the last visit of “For you” (so that the number at “For you” counts only what is new since then), a click from an e-mail with tips, after a break or about the trial with the kind of e-mail and whether the person was signed in, the company's first digest, a decision to bid or not, a downloaded cover letter, package, form or export, a search alert or calendar subscription set up, the use of the board and of the criteria check, a click on “Upgrade to Pro” with the page it happened on, and a checkout started and paid with the chosen interval. Only the type and time are stored, internal identifiers of account, company and tender, and counts such as the number of matches. When you sign up, we also store where it came from: the campaign if a link to our site names one (source, medium and campaign from the parameters “utm_source”, “utm_medium” and “utm_campaign”, such as “google”, “cpc”), otherwise only the name of the site you came from as your browser passes it on (such as “google.ch”, without the rest of the address), or “direkt”, and the kind of our page on which you began the sign-up (such as “Pricing”). Until then the open page keeps this only in its working memory; we do not store an ad's click ID, set no cookie for this and keep nothing in the browser. No search terms, no texts, no IP address, no e-mail address, no third-party provider. We use them to understand whether TEXFY helps businesses, and for the e-mails about the end of the Pro trial, which count what the team used during the trial, including how many AI summaries someone in the team read (recorded once per company, tender and day), and to know whether someone from the company has been here lately: a tender opened while signed in and a click from such an e-mail while signed in count for the pause of the Monday overview after quiet weeks and that of the digest after 90 days without a sign-in (see “E-mails”), a click without signing in does not. Events of your account are included in your data export and deleted with your account. Events not linked to a person, such as a click from the company's digest, belong to the company and are deleted with it.

E-mails. Sign-in links and the confirmation when you delete your account go to you, in the language of the page. The company's owner receives the digest with new matching tenders and building applications, the results of market alerts (awards with winner and price, contracts ending soon with supplier, as published), the next deadline of the company's saved tenders and bids and, on Mondays, an overview of the market of its services and cantons (new awards, contracts ending, new building applications as far as they are released for customers, open early signals; it also comes in a week without new results, unless nobody from the company has signed in or visited the platform since the first of the last four e-mails with only this overview; for this we read the members' sign-ins and visits, and a click in an e-mail without signing in does not count); every other member can switch it on in the profile for their own address; if nobody from the company has signed in or visited the platform for 90 days, we send, instead of the next digest, a single question whether it should keep coming, and then pause it for all its recipients until someone signs in, visits the platform or confirms “Yes, keep sending” in that e-mail, which we store with its time. Everyone receives it in the language of their account. Deadline reminders (for the submission deadline, question deadlines and appointments the publication calls mandatory) and change alerts (correction, deadline, award, cancellation or withdrawal on simap) for saved tenders and bids go to the owner and, for a bid, also to the person responsible for it. With Pro, the reminder of expiring proofs goes to the owner and to the people responsible for the bids that use the proof; the notice that a proof in use will be too old at the submission deadline goes to the owner only. E-mails about tasks due go to the person the task is assigned to, e-mails about the assignment of a bid to the person newly responsible for it, e-mails about mentions in comments to the person mentioned, e-mails about the end of the Pro trial and a failed payment to the owner. The e-mails about the end of the Pro trial name what your team used during the trial (matching tenders and good fits, saved tenders, bids, bids submitted and won, AI summaries read) and the next deadline of the company's saved tenders and bids. They also name what stays with Free, what Pro offers and what it costs. Only if you agreed when signing up or in the profile (we store this with your account), in the first two weeks after signing up we send, on at most three days (from day 1, 3 and 7), tips with the open tenders that fit your profile best and the next steps for saved tenders and bids, only when there is something concrete. If between day 8 and day 29 after signing up you have not been here for 7 days or more, we send at most one e-mail every 14 days with the new good fits since your last visit and, after 30 days without signing in, at most one e-mail per break with new matching tenders, both only when there are some. For this we read your company profile, which tenders and bids are saved or created, whether documents are uploaded and criteria checked for a bid, whether there is a search alert yet, whether you have a calendar subscription, how many people are in the team, whether the company has Free or Pro, whether the deadline reminders go to you, which tenders your digest has already sent you and whether it came today, and when you last signed in or visited the platform: your sign-ins and recognised devices (see “Account security”) and your last visit. That moment decides whether and when the e-mails after a break come. These e-mails come only with your consent; you withdraw it in the profile or with the link in the e-mail; we do not send them to an address that bounced or complained. Now and then we inform existing accounts by e-mail about new functions of the platform (Art. 3 para. 1 let. o of the Swiss Unfair Competition Act, for our own similar services); for this we read when you signed up and last signed in or visited the platform and, for the content of the e-mail, how many matching tenders of your company are still open, how many search alerts are active and whether the trial has ended. Each of these e-mails contains an unsubscribe link, and you switch them off in the profile as well; we do not send them to a blocked address. Of the e-mails about the trial and about news, the tips and the e-mails after a break you receive at most one a day; for this we read which of these e-mails we already sent you that day. Everyone receives these e-mails at their own address, in the language of their account. So that no e-mail goes out twice, we store the type, the receiving address, the time and the state of sending for each e-mail; this is part of your data export and is deleted with your account or the company. Invitations go to the invited address, in the language the inviting person chose (see “Team and collaboration”). The links in the digest, in the deadline reminders to the owner and in the e-mails about the trial, the tips and the e-mails after a break contain an identifier of the e-mail so that we can count a click, with or without signing in; there is no tracking pixel. The digest, the reminders, the change alerts and the e-mails about tasks, mentions and the trial contain a link to unsubscribe from that e-mail without signing in. Owners and admins switch off the digest, the reminders and the change alerts for the whole company, everyone their own e-mails in the profile; the owner unsubscribes from the e-mails about the trial with the link in the e-mail. The logo is included as an image in the e-mail; only when that is not possible is it loaded from our server.

Undeliverable addresses. If a mail to your address comes back as permanently undeliverable, if you report it as spam, or if our mail provider does not deliver it because of such an earlier report, the provider tells us. We then store your address, the reason, the kind of report from the provider, and when and how often it happened, and no longer send you the digest, alerts, reminders, invitations or tips; we keep sending sign-in, confirmation and password links. After a bounce the block ends 90 days after the last one; after a spam report, when you write to us. So that nothing goes to the address until then, the block stays even after the account is deleted. We keep the provider's reports without the address for 30 days to recognise duplicates. If your address is blocked, the profile says so under “Notifications”.

Documents. Members of a company can upload documents (PDF, Word, Excel, JPG, PNG, at most 20 MB). We store the file, its name, type, size, checksum and category, who uploaded it and when, the result of the check and, if entered, the issue date. Before a file is released, we check that its content matches its type; for now we do not check for viruses. A rejected file is deleted at once. The files are kept in private storage at our hosting provider (Railway, data centre in the Netherlands). Railway backs up this storage every day and keeps the backups for 6 days. If you delete a document, we remove the file at once and the details about it after 30 days; in the backups the file remains for up to 6 days. Interrupted uploads are removed after 60 minutes. When someone in your team fills in a PDF or Word form of the contracting authority (Pro), we read its fields and the words beside them on our server and create a copy with the company details and, where you keep them, your name and e-mail address as the contact. The copy is created when you download it and is not stored, and the original stays unchanged; we keep the fields read only in the server's memory. Nothing is passed to third parties.

Payments. If you subscribe to Pro, you enter your e-mail address and payment details directly with Stripe; we see no card data. We only pass Stripe an internal identifier of your company. From Stripe we store the customer number, the number and status of the subscription, the price identifier, whether it is billed monthly or yearly and the end of the paid period in order to unlock Pro. If you cancel, we also store the time, the reason Stripe reports and, if you give them in Stripe's customer portal, your choice and your comment (at most 2,000 characters); the operator sees them in the customer overview to improve the service. If you take the cancellation back, we delete these details; otherwise they stay with the company and are deleted with it. Stripe also processes payment data under its own responsibility, for example to fight fraud and for legal obligations (Stripe privacy policy).

Visiting the website. When you visit, our hosting provider processes technically necessary connection data such as IP address, time and requested address to deliver the website and protect it from abuse.

Team and collaboration

When several people belong to a company, they work together in TEXFY. TEXFY stores and processes the team data technically. The company decides whom it invites, which role a person has and who belongs to the team; TEXFY determines the structure, visibility, e-mail delivery and export of the platform.

Membership and roles. For each person in the team we store the role (owner, admin or member), the date of joining and, for invited people, who invited them. Owners and admins manage the team and the company's details; the owner also manages the subscription and can transfer the owner role.

Visibility in the team. All members of a company see the name (if stored), e-mail address, role and joining date of the other members. We do not show who invited whom.

Invitations. The owner invites people by e-mail. We store the invited address, the role, who invited, when and how often the invitation was sent, how long it is valid (7 days, until the end of the last day, Swiss time) and its status. We do not store the invitation link, only an irreversible check value. The invited person receives an e-mail with the company's name, the name (if stored) and e-mail address of the person who invites, the role, the link and a reference to this policy. Only owners and admins see open invitations. We delete an invitation 30 days after it expires, is revoked or is accepted.

Team log and history. We record invitations, joins, role changes, removals, departures and transfers of the owner role with the type, the time, the roles involved and the accounts concerned or acting, so that changes to permissions remain traceable; this log is not shown. When the status of a bid changes, we store who changed it, for a task who created it and, in the check of the eligibility and award criteria, who last changed a criterion; the history and the criteria check show all members the name or e-mail address of these people. These details remain even if the person leaves the company, as long as their account exists.

Assignment. A person from the team can be assigned to a bid; all members see who is assigned, and the “My bids” export file (CSV or Excel), which every member can download, contains the name or e-mail address of the assigned person for each bid. Comments show all members the name or e-mail address of the person who wrote them, and the people mentioned also in their notification. A mention (“@Name”) stands as text in the comment: with the name of the person mentioned, or with their e-mail address if they have not entered a name or another member has the same name. A person assigned to a bid by someone else receives a personal notification naming that person by name or e-mail address and, unless they switched off the e-mails about tasks and assignments or have already read the notification, an e-mail with the bid's title and deadline; we delete the notification with their membership or the company.

Read notifications. For each person we store when they read a notification. Only the person themselves sees this.

E-mails to the owner and those responsible. The company's digest goes to the owner; all members see which address it goes to. Every other member can switch on an own digest with the same content; it goes to their own address, and for it we store whether it is on and, for each day, the state of sending. Deadline reminders and change alerts for a bid also go to the person responsible for it, with Pro also the reminder of expiring proofs that the bid uses; e-mails about tasks due go to the person the task is assigned to, e-mails about a new assignment to the person newly responsible, e-mails about mentions to the person mentioned, each to their own address. Everyone can switch these e-mails off in the profile. If the owner role is transferred, the owner's e-mails go to the new person from the next send on.

Leaving and removal. When a person leaves the company or is removed, their membership ends at once and they no longer have access to the company's data. We delete their read and personal notifications, their assignments and their calendar subscription. The company's shared work, the team log and the history remain with the company; the person remains recognisable in them as the one who acted as long as their account exists. Mentions of the person in the text of other people's comments remain; only the person who wrote the comment can change or delete them. Your own data export contains only your current company; you can request information about data from a previous company.

Account deletion. If you delete your account, we delete your membership and your read notifications. In the history and the team log we remove the link to your account, and we also delete the invitations you accepted. Comments you wrote remain with their text at the company, but without a link to your account: neither they nor the notifications about mentions in them show your name any more. Mentions of you in the text of other people's comments (“@Name”, without a name “@e-mail address”) remain; only the person who wrote the comment can change or delete them.

Data export. The data export contains your membership and role, the team events that concern you or that you triggered, the invitations you sent (without the invited addresses), for each bid whether you are assigned, the comments with whether they come from you or mention you, and your calendar subscriptions (without the address). It does not include details of other members (names, e-mail addresses, identifiers); shared notes, tasks and comments, including the mentions (“@Name”) in them and your notifications about them, may, however, contain names and other details that someone wrote into them.

AI summary (Pro) and translation

For companies with Pro, TEXFY summarises a tender on its detail page and in the digest, in advance for new matching tenders. For this we send the public details of the tender to Google: title, description, contracting authority, location, dates, criteria, details on submission, documents and conditions, and the link to the original publication. We remove e-mail addresses and telephone numbers from the text beforehand and do not send the contact person of the contracting authority. Names that appear in the text of the tender may be included.

We do not send Google any details about you, your account or your company. The fit with your profile, shown in the same section, is calculated without AI on our own server.

Google does not use the data to improve its products and stores requests and responses for a limited time to detect abuse. The summary is written in the language of the page, in the digest in the owner's language. We store it per language with the tender and delete it with it. It is marked as AI-generated; the original publication alone is authoritative.

Texts of a tender that are not published in the language of the page (title, description, criteria, conditions, dates and notes) are machine-translated by TEXFY into the language of the page: when a signed-in user first opens it, and in advance for new matching tenders. For this we send only these public texts of the tender to Google, no details about you or your company. We store the translations with the tender and delete them with it. They are marked as machine translations; the original is always available and alone authoritative.

We never send tenders from the Austrian core data to Google: the source excludes processing by AI, so they have no summary, no translation, no questions to the documents and no AI drafts.

We never send building applications from the official gazette of the canton of Uri to Google: the gazette reserves processing by AI systems to its consent.

Questions on the documents (Pro)

For companies with Pro, TEXFY answers questions about the documents their team uploaded for an offer. This includes the fixed questions of the function “Requirements from the documents”. When someone in the team asks a question, we send the question and the passages of the documents our search picks for it to Google, the whole text for short documents. Documents often contain names and contact details, for example of contact persons of the contracting authority; these may be sent along. Scans without a text layer are read by text recognition on our own server; the recognised text may go to Google like the rest. We do not send images. We keep the text of the documents for further questions only in the working memory of our server, not in the database.

We store the question, the answer with its quotes, who asked it and when with the offer; all members of the company see them. We delete a question when the person who asked it or someone who manages the documents deletes it, as soon as one of the offer's documents is deleted, with the company and with the tender. If you delete your account, the question stays with the company, without reference to you.

Google does not use the data to improve its products and stores requests and answers for a limited time to detect abuse. For the limits we count questions and drafts per company and month and the requests to Google per day, without content. Answers and drafts are marked as AI-generated; the documents are what counts.

Data from public tenders and building applications

The tenders come from official publications, mainly from simap.ch and TED. simap notices may contain names and contact details of people; we show them as they were published. For TED we store organisations only, not contact persons of contracting authorities. From the BOAMP, France's official bulletin of public contracts, we take tenders below the EU thresholds from the départements on the Swiss border. Here too we store organisations only: we leave out contact persons, phone numbers and e-mail addresses. From the ANAC platform (Piattaforma pubblicità a valore legale), where Italy publishes its public contracts, we take tenders below the EU thresholds from Lombardy, Piedmont, the Aosta Valley and South Tyrol. Here too we store organisations only: we leave out contact persons, phone numbers, e-mail addresses and tax codes of persons. From Germany and Austria we take tenders below the EU thresholds from the regions on the Swiss border, from the federal Bekanntmachungsservice (oeffentlichevergabe.de) and from the core data under the Austrian Federal Procurement Act. Of these too we store organisations only, without contact persons, phone numbers and e-mail addresses.

We only show building applications from data sources released for display, and without details of the developer and other parties.

Building applications from the cantonal official gazettes (amtsblattportal.ch) are public, also for search engines, when only companies, authorities or other organisations take part, no sole proprietorships and no partnerships (general, limited or simple), and the application comes from Appenzell Ausserrhoden, Basel-Landschaft, Basel-Stadt, Bern, Schaffhausen, Solothurn, Valais or Zurich. All others are visible to signed-in users only. We do not store names or addresses of private persons. Notices that could relate to private persons are deleted when their publication period ends; for all others we then remove coordinates, parcels and addresses.

We take over building applications from the official gazettes of the cantons of Lucerne, Uri and Glarus only when the applicant is a company, an authority or another organisation, and only as details: project, municipality, place without parcel, name of the organisation, dates and deadline, with the source and a link to the original publication. We do not store applications of private persons. Lucerne and Uri are visible to signed-in users only; like the search of the official gazette, we show Glarus for 90 days from publication, publicly except for sole proprietorships and partnerships.

Planning notices from the cantonal official gazettes (road building, hydraulic engineering, plan approvals for transport and energy) are visible to signed-in users only, with the gazette as the source and a link to the original publication. As parties we store organisations only, no names or addresses of private persons, and we show no parties. Notices that could relate to private persons are deleted when their publication period ends; for the others we then remove coordinates and location details.

Road projects from the construction programme of the cantonal roads of the canton of Lucerne (the canton's geoportal, freely usable geodata), from the road construction projects on the cantonal roads of the canton of Aargau (the canton's geoportal, freely usable geodata) from the road programmes of the cantons of Schwyz and Zug (official decisions) and, as facts with a link to the original only, from the project pages of the canton of Zurich and the road programmes of the cantons of St. Gallen and Graubünden are public, also for search engines: name, municipality, road, kind of work, stage, programme, period, amount and numbers as the cantons publish them. The data name no persons; we do not take over a name or a remark that could point to a person.

Planned procurements of the Federal Roads Office FEDRO (the lists of its branches on astra.admin.ch) and building projects of the Federal Council's civil real estate dispatch (Federal Gazette, Fedlex) are public, also for search engines: for each entry only project, type of service, planned dates, branch, place, credit and the federal offices as users, with a link to the original. The lists and dispatches name no persons.

Tenders that the canton of Ticino and its municipalities publish only in the Foglio ufficiale are visible to signed-in users only: title, contracting authority, municipality, procedure, deadline and publication number with a link to the publication. We do not show the rest of the text and delete the notices when their publication period ends.

Federal contracts come from the yearly lists of the Federal Procurement Conference (Art. 27 PPO) and are visible to signed-in users only. They name the supplier with name and place. Suppliers we cannot clearly identify as an organisation, such as individuals, are stored without name or address and are not shown.

Whether a contracting authority is public or private or semi-private we derive from its legal form in the commercial register (“Zefix – Central Business Name Index” via LINDAS) when its name matches exactly one company there, otherwise from its name or from the public offices it publishes for. For this we store the classification, the legal form and the UID of the company with the contracting authority, no UID for sole proprietorships and partnerships. The page of the contracting authority shows the classification with the source.

If a detail concerns you, you can write to us. We correct or remove it on TEXFY; the original publication remains authoritative.

Cookies and browser storage

Sign-in cookie. Only when you are signed in. Signing in does not work without this cookie.

Device identifier. At every sign-in, and in a browser that is already signed in on its next page, we set a cookie (“texfy_geraet”, a random identifier, valid for 400 days) so that we can warn you when someone signs in from an unknown device (see “Account security”). It stays after you sign out. We also read the time of the last sign-in with this device for the e-mails that depend on when you or someone from the company last signed in (see “Account security”).

Two-factor sign-in. During a sign-in, your browser remembers for 10 minutes that the code is still missing (“__Secure-better-auth.two_factor”). If you have a device remembered, another cookie is valid for 30 days (“__Secure-better-auth.trust_device”).

Passkeys. While you add a passkey or sign in with one, your browser remembers the single-use random number for it for at most 5 minutes (“__Secure-better-auth.passkey_challenge”).

Language. Your browser stores the language of the last page you visited in a cookie (“texfy_lang”) so that links without a language open in that language. The cookie lasts one year.

Appearance. If you choose Light, Dark or System, your browser remembers the choice locally (“theme”).

Intro. For the current session, your browser remembers that the logo intro has already played (“texfy-intro”). The entry ends with the browser window.

Trial notice. If you close the notice about the end of the Pro trial, your browser remembers this in a cookie (“texfy_trial_hint”, only the stage and the end date). The cookie is valid for 30 days.

Passkey tip. If you hide the tip “Back in faster” on the overview, your browser remembers this in a cookie (“texfy_passkey_hinweis”, only the value 1). The cookie lasts one year.

Team tip. If you hide the tip on inviting someone to the team on an offer, your browser remembers this in a cookie (“texfy_team_hinweis”, only the value 1). The cookie lasts one year.

Confirmations. After an action, such as saving, the page shows a short confirmation. For this it sets a cookie (“texfy_flash”, only the kind and an identifier of the message) that lasts at most 60 seconds and is deleted once shown.

View of the offers. If you choose the list or the board for your offers, your browser remembers the choice in a cookie (“texfy_angebote_ansicht”). The cookie lasts one year.

Profile suggestions. If on “For you” you keep a service or canton that a profile suggestion proposes to remove, your browser remembers this in a cookie (“texfy_vorschlag”, only the service or canton and the number of marks). The cookie lasts 90 days.

Setup. As soon as you enter something while setting up your company, your browser keeps the entries for this tab (“texfy_einrichten”: your account's identifier, company name, description, type of work, services, cantons, the choice on contracts from abroad and the step). The entry is deleted when the setup is finished and when you sign out through the menu, and ends with the tab at the latest.

Saving without an account. If you click “Save & deadline reminder” without an account, your browser remembers the tender in a cookie (“texfy_merken”, only the tender's identifier), so that it is saved after you sign up. The cookie lasts one day and is deleted when the tender is saved.

You can refuse or delete cookies and browser entries in your browser's settings. Without the sign-in cookie, signing in does not work, without the cookies of the two-factor sign-in and of passkeys, signing in with a code or a passkey does not work, without the device identifier we do not recognise your device, and without the others the site does not remember what the entry above describes.

There are no analytics or advertising cookies, no tracking pixels and no third-party analytics or advertising services; we do not create advertising profiles. Our own usage events and the click identifiers in e-mails are described above. Fonts and images come from our own server, not from third parties.

Who receives the data

The following service providers process personal data on our behalf:

Hosting: Railway Corporation, USA (EU West region), Netherlands. Safeguard for disclosure abroad (Art. 16 FADP): The Netherlands have adequate data protection (Annex 1 DPO). For access from the USA, the EU standard contractual clauses apply with the adaptations for the FADP (Railway's data processing agreement).

Database: Neon, LLC (Databricks), USA (AWS Frankfurt region), Germany. Safeguard for disclosure abroad (Art. 16 FADP): Germany has adequate data protection (Annex 1 DPO). Neon is certified under the Swiss-U.S. Data Privacy Framework.

E-mail delivery: Resend (Plus Five Five, Inc.), USA (AWS eu-west-1 region), Ireland. Safeguard for disclosure abroad (Art. 16 FADP): Ireland has adequate data protection (Annex 1 DPO). For access from the USA, the EU standard contractual clauses apply with the adaptations for the FADP (Resend's data processing agreement).

Mailbox (messages to info@texfy.ch): Hostpoint AG, Rapperswil-Jona, Switzerland.

Payments: Stripe Payments Europe, Limited, Dublin, with Stripe, Inc., USA, Ireland and USA. Safeguard for disclosure abroad (Art. 16 FADP): Ireland has adequate data protection (Annex 1 DPO). Stripe, Inc. is certified under the Swiss-U.S. Data Privacy Framework.

Database backup: Railway Corporation, USA (Railway Object Storage, Amsterdam, EU West region), Netherlands. Safeguard for disclosure abroad (Art. 16 FADP): The Netherlands have adequate data protection (Annex 1 DPO). For access from the USA, the EU standard contractual clauses apply with the adaptations for the FADP (Railway's data processing agreement).

AI features (summary, translation, questions on the documents, drafts): Google Cloud EMEA Limited, Dublin (Gemini API), Ireland; Google may cache the data in any country where Google or its agents operate data centres, including the USA. Safeguard for disclosure abroad (Art. 16 FADP): Google's data processing agreement (Data Processing Addendum, version 10 of 7 May 2026) with the Swiss-US Data Privacy Framework or, where it does not apply, the EU standard contractual clauses.

We do not sell data or pass it on for advertising.

How long we keep data

We keep your account until you delete it. Your company's data (profile, shared work in TEXFY, team) is kept as long as the company exists; it is deleted with the account of its last member. We delete invitations 30 days after they expire, are revoked or are accepted. Sign-in links expire after 15 minutes, sessions at the latest 7 days after last use. We delete expired sessions with the next clean-up, which runs once a day.

Database backup. Every night we store a copy of the whole database, that is of all the data above except the files of the documents, in separate object storage (Railway Object Storage) in Amsterdam, the Netherlands (above), outside the database at Neon, so that we can restore it after an outage. We keep the copies of the last 14 days and one per week for the last 8 weeks, and delete older ones. What you delete therefore stays in these backups for up to 8 weeks; we use them only to restore the service after an outage.

With “Delete account” in your profile we remove your account from the database immediately. If you are the last member of your company, we delete the company with all its data. If other people belong to it, the company's data is kept; as the owner, you transfer the owner role first. If a Pro subscription is running, cancel it first via “Manage subscription”; deletion is possible from the end of the paid period, earlier through info@texfy.ch.

Your rights

Access. You can ask at any time what data we process about you (Art. 25 FADP).

Data portability. You download your account data and the data of your company available to you yourself as a file in your profile (Art. 28 FADP). The file also contains company data that you share with the other members.

Correction and deletion. Owners and admins change the company's details in the profile; members can only view them. You delete your account yourself in the profile. We handle everything else on request (Art. 32 FADP).

Complaint. If you disagree with our answer, you can contact the Federal Data Protection and Information Commissioner (edoeb.admin.ch).

Changes

If the processing changes, for example with a new service provider, we update this policy beforehand. The version on this page applies.