Privacy Policy

Last updated: 15 October 2026

This policy explains which personal data blueSky Information GmbH (brand «Protime») processes, for what purpose, who receives it and what rights you have. It applies to the website protime.ai, the application and the company directory hr.protime.ai. The company directory also has its own information page: hr.protime.ai/datenschutz

1. Controller and contact

The controller is blueSky Information GmbH, represented by Marc Loeb (Managing Director), Pilatusstrasse 41, 6003 Lucerne, Switzerland, phone +41 79 619 43 14. «Protime» is the brand under which we offer our services.

For all questions about data protection and to exercise your rights, contact us at privacy@protime.ai

2. Applicable law

We process personal data under the Swiss Federal Act on Data Protection (FADP). For persons in the European Economic Area, the General Data Protection Regulation (GDPR) applies in addition. Where this policy names a legal basis, it refers to the FADP; the corresponding GDPR bases (contract, consent, legitimate interest, legal obligation) apply accordingly to persons in the EU.

«Personal data» means any information relating to an identified or identifiable person. «Processing» covers any handling of such data, for example collecting, storing, using, disclosing and deleting.

3. Visiting our websites

3.1 Server log files

When you open protime.ai or hr.protime.ai, your browser transmits technical details that we record in server log files: page requested, date and time, amount of data transferred, referring page, browser, operating system and IP address.

We need these details to deliver the website, detect faults and defend against attacks (overriding interest in secure operation). The log files are held by Google Cloud (Cloud Logging) and deleted after 30 days.

3.2 Hosting and network

Our websites and applications run on Google Cloud (Google Ireland Limited, Gordon House, Barrow Street, Dublin 4, Ireland): the web application on Firebase App Hosting in the Netherlands (europe-west4), background functions in Frankfurt (europe-west3), the Firestore database in the EU multi-region «eur3», and the register database in Zurich (europe-west6). The Google Cloud data processing terms apply.

Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA) sits in front of our servers as a network service; Cloudflare sees your IP address and the technical connection data. Cloudflare also forwards emails addressed to your Protime address (…@mail.protime.ai) to our systems (section 7).

The maps on hr.protime.ai are loaded by your browser directly from the Swiss Federal Office of Topography swisstopo; swisstopo receives your IP address in the process. The map sets no cookies.

All connections are encrypted with TLS, recognisable by «https://» and the padlock symbol in the address bar.

3.3 Cookies and consent

We use technically necessary cookies and similar storage techniques, for example for sign-in and to remember your cookie choice. Non-essential services are loaded only with your consent. For this we show our own notice on your first visit with the categories «Necessary», «Marketing» and «Others». Your choice is stored in your browser (local storage), where you can delete or change it at any time.

You can block or delete cookies in your browser. Some functions, in particular sign-in, may then be unavailable.

3.4 Web analytics (Google Analytics 4)

Only if you accept the «Marketing» category do we load Google Tag Manager and Google Analytics 4 (Google Ireland Limited). Google Analytics measures which pages are viewed and sets cookies for that purpose. The data is transmitted to Google and may be processed in the USA (Google LLC). Without your consent nothing is loaded; if you decline, we remove the Analytics cookies. You can withdraw your consent at any time by deleting your cookie choice in the browser.

The Google data processing terms apply to Google Analytics. Further information: Google Privacy Policy · Google partner sites

We use Google Search Console to monitor the visibility of our websites in Google Search. We receive only aggregated information from Google; we do not transmit personal data to Search Console.

4. Account and sign-in

You need an account to use the application. You sign in with a sign-in link sent by email, with your Google account, with LinkedIn or with a password; sign-in runs through Firebase Authentication (Google). We store your email address, name, language, settings and the details you provide during setup (for example role, company, topics). The legal basis is the contract with you.

At each sign-in we log IP address, browser and time to detect abuse. We delete these entries after six months.

On registration we create a contact in our CRM HubSpot (HubSpot, Inc., USA) with email address, name, company, job title, signup date and sign-in method (section 5).

Your account remains until you ask us to delete it. Write to privacy@protime.ai; we then delete your account data, briefings and access authorisations and remove you from backups within 14 days. Billing data is retained for ten years as required by law (section 13).

To provide and maintain the service and answer support requests, authorised Protime staff may access your account data: briefing settings, sources, usage data, subscription data and — if you have connected your mailbox — email metadata and content generated by the service. Access is limited to what is necessary and, for privileged operations, recorded in a tamper-proof log.

5. Contact, newsletters and marketing

If you contact us by email, through a form or via the chat on our website, we process your details to answer your request. Resolved requests are deleted at the latest three years after closure unless a retention obligation applies.

For contacts, meeting booking and the website chat we use HubSpot (HubSpot, Inc., 2 Canal Park, Cambridge, MA 02141, USA). The chat is loaded only when you click on it. HubSpot stores contact data on our behalf; the HubSpot data processing terms apply. Further information: HubSpot Privacy Policy

If you subscribe to a newsletter or a sample briefing, we store your email address and chosen topics in HubSpot and send you the content immediately. Every message contains an unsubscribe link. Delivery runs through SendGrid (Twilio Inc., USA).

As a customer you receive notices about your account and the service from us (for example welcome and reminder emails). We send product information only if you have agreed to it; you can unsubscribe at any time.

In briefing emails and newsletters, SendGrid measures whether a message was opened and which link was clicked. We store these events (time, clicked link) against your account to see which content is useful; they feed only an internal evaluation and are not passed on to third parties. There is currently no fixed deletion period for them. In sign-in, invoice and privacy emails this measurement is switched off. You can object to the measurement (privacy@protime.ai).

Business outreach (B2B): We may process publicly available professional details (name, role, company, business email address, professional profile) to inform professionals about our services. We may analyse these details with AI tools (Google Gemini, section 10). The basis is our overriding interest in business contacts. If you do not wish to receive messages, reply with «Unsubscribe» or write to privacy@protime.ai; we will then remove you from the list.

6. Payment processing (Stripe)

Payments are processed by Stripe (Stripe, Inc., USA, and its European entity Stripe Payments Europe, Ltd., Ireland). We transmit your email address, for organisations the company name, your language and an internal customer reference to Stripe. You enter your card details directly with Stripe; we never see or store them.

Stripe also processes data in the USA; the standard contractual clauses in Stripe's data processing agreement apply. We store invoices, payments and subscription data for contract performance and the statutory retention period of ten years (Art. 958f Swiss Code of Obligations). Further information: Stripe Privacy Policy

7. News briefings

Purpose: Protime condenses newsletters, RSS feeds, web searches and other sources into personal briefings that we deliver by email and in the application. The basis is the contract with you.

Origin of the content: (a) newsletters you redirect to your personal Protime address (…@mail.protime.ai); (b) newsletters from your own Gmail or Outlook mailbox if you connect it as a source (read access); (c) public sources such as RSS feeds, websites and search results; (d) public posts on social networks if you enable that source.

We process your topics and sources, the texts of the newsletters and articles (including names of persons mentioned in them), the generated summaries and — if you enable it — keywords from your inbox topic list (section 8.1) to weight stories by your current work.

Recipients: The texts go to Google Gemini for summarisation (section 10). For web searches we send search terms derived from your topics to Google (Custom Search and Google Search via Gemini); these queries may contain content of your briefing, and you can switch search enrichment off in the briefing settings. For social networks we send only search terms and public profile names to ScrapeCreators (USA) and Apify (Czech Republic), never your identity. Cover images are generated with Google Vertex AI (USA) from keywords of the briefing, never from email content. Delivery runs through SendGrid (Twilio, USA).

Retention: Newsletters sent to your Protime address are deleted automatically 90 days after receipt; attachments of such emails currently have no automatic deletion period.

Newsletters from your own mailbox are stored as the text source of the respective issue; they currently have no separate deletion period and are deleted with the briefing or your account. Generated issues remain available to you until you delete the briefing or your account.

Of the stories processed we keep the title and an excerpt of up to 500 characters in a shared story pool, so that the same story is processed only once and can be found in the news search.

8. Protime Inbox (Gmail / Outlook)

Purpose: Protime Inbox reads your mailbox, sorts incoming email into folders, detects what needs a reply, writes reply drafts, creates calendar entries and tasks when you ask for them, and summarises the day in the Morning Brief. The basis is the consent you give when connecting the mailbox (OAuth), which you can withdraw at any time.

Access: When connecting, we request read and write permissions from Google (Gmail, Google Calendar, Google Tasks) or Microsoft (Outlook/Microsoft 365, Calendar, To Do). With them Protime can read emails, move them into folders, flag them, create folders, place drafts in your drafts folder, and create calendar entries and tasks. Protime never sends email on your behalf: you review and send every draft yourself.

Data processed: senders and recipients, subject, content and history of your emails, the text of attachments (for classification), calendar entries and tasks, and the results derived from them (classification, drafts, tasks, profiles of your correspondents such as reply rate and topics). This also concerns the persons who correspond with you.

Recipients: For classification, drafts and summaries we send the content to Google Gemini (section 10). For the news part of the Morning Brief we pass topic keywords and company domains derived from your emails to Google Search (via Gemini), never email text or your identity. Weather and place details for drafts are fetched from MET Norway and OpenStreetMap (Nominatim) with a bare place name only.

What we store: We do not store complete emails. We store sender, subject (up to 200 characters), timestamps, the classification result, reply drafts (up to 2000 characters) and intermediate results of the AI tools. Drafts you have sent are deleted after seven days. The remaining details currently have no automatic deletion period; they are deleted with the briefing or your account. The individual values of your topic list (section 8.1) are deleted after 60 days. Access authorisations (OAuth tokens) are stored encrypted for as long as the mailbox is connected.

Folder cleanup: If you switch on automatic cleanup, Protime moves emails from the Protime folders in your mailbox to the trash or «Deleted Items» after 14 days (or the period you choose). Without this setting everything stays where it is.

Revoking access: You can withdraw the permission at any time in your Google or Microsoft account:

• Google: manage third-party access at myaccount.google.com/permissions
• Microsoft: manage third-party access at account.live.com/consent/Manage

After revocation Protime can no longer retrieve emails. Results already generated remain in your account until you delete them or the account.

8.1 Contact intelligence and Morning Brief

From your correspondence we derive profiles of your contacts (for example reply rate, frequency, topics) and a list of the topics you are currently working on. Both serve to recognise what matters and to tailor the Morning Brief to you. You can switch the topic list off per briefing.

8.2 Deal Coach (optional)

If you enable the Deal Coach, Protime detects negotiations in your emails, extracts offer and price details and researches market rates via Google Search (through Gemini). What goes to the search is a price query derived from the context (industry, region, billing basis, currency), not the email text. We store the recommendation (counter-offer, market range, justification, sources) and a cache of market rates for 21 days; the email text itself is not stored.

8.3 Business partner radar and objection watch

The radar alerts you when your business partners appear in official publications (bankruptcy, call to creditors, debt-restructuring moratorium, register changes). We derive the list of monitored companies from the sender domains of your genuine correspondence (for example «muster.ch»), supplemented by companies of your own group that you confirm yourself; the email addresses themselves never leave our systems. We query the domain stems at Zefix and amtsblattportal.ch; your identity is not transmitted. Alerts about your own group may go to a distribution list of your organisation. You can switch the radar off per briefing.

With the AML package we additionally check, once, the names of newly registered officers of your partners and the names of your direct correspondents against lists of politically exposed persons and sanctions lists. For this we transmit only the name to OpenSanctions Datenbanken GmbH (Germany), which does not retain it beyond the query; the SECO sanctions list is checked in our own systems. The basis is your statutory due-diligence duty under the Swiss Anti-Money Laundering Act, for which we act on your behalf.

Objection watch: If you enter property addresses, we store these addresses with their coordinates; to obtain the coordinates we transmit the address to the federal service GeoAdmin (swisstopo). What you see about building applications is described in section 9.2.

8.4 WhatsApp notifications (optional)

If you enable WhatsApp notifications, we store your mobile number and send you short notices via Twilio (Twilio Ireland Ltd. / Twilio Inc., USA) and WhatsApp (Meta Platforms Ireland Ltd.): for urgent emails the sender and subject (up to 100 characters) with a draft reference, for critical radar alerts the company name, event and link to the official publication, and a notice when the connection to Outlook needs to be renewed. The messages use pre-approved templates; email text is never transmitted. You can switch notifications off at any time; we then delete the number.

9. Register features and the company directory hr.protime.ai

Protime maintains a corpus of official publications: the Swiss Official Gazette of Commerce (SOGC/SHAB) and cantonal gazettes via amtsblattportal.ch, Zefix, the digitised copies of the printed SHAB from the ETH Library, and the trademark register of the Swiss Federal Institute of Intellectual Property (IPI). It feeds the public company directory hr.protime.ai, the register queries in the application and via the programming interface (MCP/API), and the watch features described below. The data is held in Switzerland (Zurich). For AI-assisted preparation (for example reading publication texts, estimating company size) we use Google Gemini (section 10). For the company directory the information page hr.protime.ai/datenschutz applies in addition.

9.1 Personal data from commercial register publications

Protime maintains a movement journal of registered officers from the Swiss Official Gazette of Commerce (SHAB) and the cantonal gazettes. It records persons named in official publications as an officer of a Swiss company (board of directors, management, registered signatories and other functions), with the details stated in the publication itself: name, place of origin, place of residence (town only, no address), nationality for foreign nationals, function, signing authority, and the type and date of the event. Publications before 2002 (currently the years 1994 to 2001) come from the ETH Library's digitised copies of the printed SHAB (E-Periodica). They were read by text recognition and may contain reading errors. Their source link points to the ETH Library page instead of an official PDF.

Personal details are taken verbatim from the official publication and not enriched from other sources. Protime does not rate persons. Entries from different publications are attributed to the same person only if name and place of origin match; entries without a published place of origin are not merged. Whether a function is «current» or «ended» is derived by Protime from the published entries and exits; this is not an official statement. The legal basis is the overriding legitimate interest in register transparency; publication of these details is required by federal law (Commercial Register Ordinance, SHAB). Persons who are not named in an official publication are not recorded.

Details of registered officers are accessible in two ways. First, publicly in the company directory hr.protime.ai: since 22 September 2026 anyone can search there, without signing in, for the name of a registered person and open their person page with current and ended functions. Person pages and result lists are blocked for search engines («noindex») and are in no sitemap. The number of queries per connection is limited. Second, for customers with register access, including via their AI assistants (section 9.5), bound to the purpose of checking their own business relationships and statutory due-diligence duties (section 4.3 of the Terms of Service). There is no dataset export.

Since 15 October 2026 the person page additionally shows the section «Company bankruptcies of the last 24 months». It names companies over which bankruptcy was opened in the last 24 months and in which the person was registered on the board of directors or in management — up to the bankruptcy or at most two years before it. Only legal entities are considered and only companies that are reliably attributed to the person. Every entry links to the official publication. A company bankruptcy is not a statement about a person's conduct.

Protime currently retains details from commercial register publications without a fixed period; the publications in the SHAB also remain permanently publicly accessible. Publications on bankruptcy openings and on private individuals are deleted after five years, together with the personal details taken from them. An address blocked in the register is not delivered.

Data subjects can request access, object to the processing and report incorrect details — via the form at hr.protime.ai/widerspruch or by email. Before blocking, Protime confirms the identity via the email address provided and then blocks the details concerned. Correcting individual details in the dataset is currently not possible. Protime cannot change the official publication itself; that is the responsibility of the competent commercial register office. Email: privacy@protime.ai

9.2 Building applications

Building publications name private building owners as natural persons as well as their representatives and the planning firm. These details are delivered, together with the property address, project and objection deadline, exclusively to the customer who monitors the property or area concerned — in the Morning Brief and in their personal overview in the application, where they remain available for 90 days. Via the programming interface (MCP/API), building publications are delivered without details of building owners who are natural persons; companies as building owners are named. The basis is cantonal building law, which requires this publication precisely so that those affected can exercise their right of objection.

We transmit the location of the project as an address to the federal service GeoAdmin (swisstopo) to obtain coordinates; names are not transmitted. In the corpus itself, the names of building owners currently have no deletion period.

9.3 Person watch

Organisations and Pro accounts can store a list of their own employees (surname, first name, optionally place of origin; at most 100 entries) to learn when one of these persons appears in an official publication as an officer or signatory of another company (secondary occupation, conflict of interest). The list is the customer's HR data: the customer is the controller for it, must inform their employees and confirms this before activation; we process the list only on the customer's instruction. The list can also be derived from the register entries of the customer's own group companies. We report matches by email to the distribution list of the customer's own company domain designated by the customer, or in the Morning Brief; without a confirmed place of origin a match remains marked as «same name». If the customer removes an entry, we delete it; delivery markers are retained for 400 days.

9.4 Trademark watch

For the trademark watch we continuously obtain data from the Swiss trademark register (IPI Swissreg). We store mark text, classes, status and dates of the marks, as well as the marks you enter yourself and detected similarities. The register's raw response, which also contains names and addresses of applicants, holders and representatives, is stored without being displayed or evaluated; it currently has no deletion period. The trademark search in the application shows only mark fields, no holder details. We do not currently deliver notifications about new marks.

9.5 AI access (MCP) and programming interface

Customers with register access can query the register features (companies, registered persons, auditors, building applications, news search, briefings) through their own AI assistants (MCP interface). The queries are bound to the purpose of checking their own business relationships and statutory due-diligence duties (section 4.3 of the Terms of Service) and are counted; for this we store only checksums of the queries, no clear-text names. There is no dataset export. For further processing of the answers in their own AI assistant (for example at Anthropic or OpenAI) the customer is the controller; the privacy terms of the respective provider apply.

10. Artificial intelligence: providers, location, retention

For AI features — briefings, classification and drafts in the inbox, calendar and task suggestions, Deal Coach, contact intelligence, Morning Brief, register preparation, chat and setup, analysis of reference files, read-aloud (speech output), quiz and cover images — we use Google Gemini via the Google AI interface (Gemini API, Google LLC, USA) and Google Vertex AI. As a fallback for news briefings we keep models from Anthropic PBC (USA) available; they are used only if Gemini fails.

Processing location: For the Google AI interface, Google does not fix the processing location; processing may take place in any country in which Google maintains facilities, i.e. also outside Switzerland and the EEA. Cover images are generated via Vertex AI in the USA (us-central1); the Google Cloud fallback speech output also runs there. Anthropic processes in the USA. Our own systems and databases, by contrast, run in the EU and in Switzerland (section 3.2).

No model training, limited storage: Both providers are contractually bound not to use your inputs and the outputs to train their models. Google stores inputs and outputs for up to 55 days, Anthropic for up to 30 days, in each case only to detect abuse; after that they are deleted.

Safeguards: With Google the Google Cloud data processing terms apply; with Anthropic a data processing agreement with the EU standard contractual clauses and the Swiss addendum. Content transmitted to the AI providers may include email texts and threads, attachments, calendar entries, newsletter texts and register data.

Google Search via Gemini: For some features (web search for briefings, news in the Morning Brief, Deal Coach, chat about your briefings, setup chat, company-size estimation, title generation) Gemini may call Google Search. Content of your briefing, your questions in the chat or derived keywords then become search queries at Google. From the inbox only derived topics and company domains are sent, never email text.

No automated individual decisions: The AI classifies, summarises, suggests and drafts. It makes no decision with legal effect for you or your correspondents. You review and send every draft yourself, and register findings are indications, not assessments.

11. Recipients and processors

We disclose personal data only as far as necessary for the service. Processors may process the data only on our instructions; data processing agreements are in place with them. We do not sell data.

12. Disclosure abroad

Our own systems are located in the EU and in Switzerland. The EEA states are recognised by the Swiss Federal Council as countries with adequate data protection.

Some providers process data in the USA or at a location that is not fixed (AI services, email delivery, payments, CRM, WhatsApp, network service). For these we rely on the standard contractual clauses in the providers' data processing agreements, for Anthropic supplemented by the Swiss addendum, and — where a provider is certified for it — on the Swiss-U.S. Data Privacy Framework. For Google AI services without a fixed location, processing may also take place in other countries; the same contractual safeguards apply. On request we will name the agreement that applies.

For register queries via your own AI assistant (section 9.5) you choose the provider and thus the location of further processing yourself.

13. Retention and deletion

We retain personal data for as long as necessary for the respective purpose or as required by law. The main periods:

• Account data: until deletion of the account, then a 30-day grace period
• Invoice and payment data: ten years (Art. 958f Swiss Code of Obligations)
• Usage and cost data per account (no content): three years
• Newsletters sent to the Protime address: 90 days; attachments currently without automatic period
• Sources from your own mailbox and generated briefings: until deletion of the briefing or the account
• Inbox (sender, subject, classification, drafts): until deletion of the briefing or the account; sent drafts 7 days; topic values 60 days
• Sign-in log (IP address, browser): 6 months
• Server log files: 30 days
• Open and click events from emails: currently no fixed period
• Support requests: up to 3 years after closure
• Marketing consents: duration of consent plus 3 years as evidence
• Register data (section 9): no fixed period; publications on bankruptcy openings and private individuals 5 years
• Backups: 14 days

14. Your rights

Under the Data Protection Act you have the following rights; for persons in the EU, Art. 15 to 22 GDPR apply in addition:

• Access (Art. 25 FADP): you learn which data we process about you, for what purpose, where it comes from and who receives it — free of charge and usually within 30 days
• Release and portability (Art. 28 FADP): data you have given us is provided to you in a common electronic format
• Rectification (Art. 32 FADP): you can have incorrect data corrected; you change account data yourself in the settings
• Erasure and blocking: you can request the deletion of your data or the blocking of a disclosure
• Objection: you can object to a processing, in particular to use for outreach and to measurement in emails
• Withdrawal: consents (for example mailbox access, cookies, WhatsApp) can be withdrawn at any time with effect for the future
• Complaint: to the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland, www.edoeb.admin.ch — for persons in the EU to the data protection authority of their country

For details from official publications (section 9), blocking is the only remedy we can carry out; the official publication itself can only be changed by the competent commercial register office. Use the form at hr.protime.ai/widerspruch or write to us.

Send requests to privacy@protime.ai. To protect against abuse, we confirm your identity before releasing, deleting or blocking data. We may restrict or refuse a request where a law or the overriding interests of third parties require it; in that case we give reasons.

15. Data security

We protect your data with technical and organisational measures: encrypted transmission (TLS) and storage, access controls and multi-factor sign-in for administrators, separation of customer data in the database, tamper-proof logging of privileged access, daily backups and an information security management system aligned with ISO 27001.

No transmission over the internet is absolutely secure. If a data breach poses a high risk to you, we inform you and the FDPIC.

16. Google API Services: Limited Use

Protime's use and transfer of information received from Google APIs adheres to the Google API Services User Data Policy, including the Limited Use requirements. We use data from Gmail, Google Calendar and Google Tasks exclusively to provide and improve the described features for you. We do not use it for advertising, do not sell it and do not pass it on to third parties — except to the processors named in sections 10 and 11 for delivering these features. Humans at Protime read your emails only with your consent for troubleshooting, for security reasons or where the law requires it.

We do not use data obtained via Google APIs to develop, train or improve generalised AI or ML models; AI processing is limited to your personal outputs, and our AI providers are contractually bound by the same prohibition (section 10). The web analytics and direct marketing described in sections 3 and 5 concern only website and account data, never data from Gmail or Google Workspace APIs.

17. Data processing agreement for business customers

If you use Protime in your organisation, we process emails and data of your employees and contacts on your behalf. On request we provide a data processing agreement (DPA) under Art. 9 FADP or Art. 28 GDPR: privacy@protime.ai

18. Changes to this policy

We update this policy when our services or the law change. The version published on this page applies; the date is shown at the top.