Legal
Privacy Policy
This English version is provided for convenience only. The German version is legally binding.
1. Introduction
Protecting your privacy and data matters to us. This privacy policy explains how FirstMedia Solutions GmbH (hereinafter "Saley", "we", "us") processes your personal data when you use our software-as-a-service platform "Saley" (hereinafter "App" or "Platform") or visit our website.
This policy fulfils the information obligations under the revised Swiss Federal Act on Data Protection (FADP), in force since 1 September 2023, and – where applicable – Art. 13/14 of the EU General Data Protection Regulation (GDPR).
2. Controller
- FirstMedia Solutions GmbH
- Lerchenfeldstrasse 3
- CH-9014 St.Gallen
- Email: info@saley.ai
- Phone: +41 71 230 10 30
3. Categories of data processed
| Data category | Examples | Source |
|---|---|---|
| Registration & contact data | Name, company name, email address, phone number | Directly from the user |
| Contract & billing data | Subscription type, billing address, Stripe token, payment status | Directly / Stripe |
| Usage data | Log files, timestamps, IP address, browser information, API calls | Automatically |
| Content data | Uploaded documents, images, comments, links | Directly from the user |
| Integration data (optional) | Records from bexio (e.g. contacts, quote IDs) | bexio API |
4. Purposes and legal bases
| Purpose | Legal basis (FADP / GDPR) |
|---|---|
| Providing & operating the App | Performance of contract (Art. 31(2)(a) FADP / Art. 6(1)(b) GDPR) |
| Payment processing via Stripe | Performance of contract |
| Security & abuse prevention | Overriding legitimate interest (Art. 31(1) FADP / Art. 6(1)(f) GDPR) |
| Product improvement & error analysis | Legitimate interest |
| Marketing communication (newsletter) | Consent (Art. 31(1) FADP / Art. 6(1)(a) GDPR) |
| Statutory retention obligations | Legal obligation |
5. Disclosure to third parties & processors
We only disclose data where this is necessary to perform the contract, on the basis of a legitimate interest or due to legal obligations.
| Recipient | Purpose | Location |
|---|---|---|
| Stripe Payments Europe Ltd. | Payment processing (tokenised card data) | Ireland / USA (SCC) |
| Hosting providers (AWS EU-West / Hetzner) | Cloud hosting & database | EU / Switzerland |
| Email provider (SendGrid) | Transactional emails, 2FA codes | USA (SCC) |
| bexio AG (optional) | CRM/ERP integration | Switzerland |
| Advisers & auditors | Tax & legal advice | Switzerland / EU |
Contracts in accordance with Art. 9 FADP and Art. 28 GDPR are in place with all processors.
6. Transfers to third countries
Data may be transferred to countries without an adequate level of data protection (e.g. the USA). In such cases we rely on EU standard contractual clauses (SCC) or other recognised safeguards to ensure an adequate level of protection.
7. Retention period
We store personal data only for as long as is necessary for the respective purpose or as required by statutory retention obligations.
8. Security
- TLS encryption of all connections
- Data at rest (RDS snapshots, S3 storage) encrypted with AES-256
- Two-factor authentication (optional)
- Role-based permission system
- Regular penetration tests & patch management
We report data security breaches that are likely to result in a high risk for the persons concerned to the FDPIC as soon as possible (Art. 24 FADP) or to the competent supervisory authority within 72 hours (Art. 33 GDPR).
9. Your rights
You have the right to:
- Access to the personal data processed (Art. 25 FADP)
- Rectification of inaccurate data
- Erasure or anonymisation ("right to be forgotten"), unless a retention obligation applies
- Restriction of processing
- Data release and portability (Art. 28 FADP)
- Object to direct marketing
- Withdraw consent with effect for the future
An email to info@saley.ai is sufficient for any request. You also have the right to lodge a complaint with the competent supervisory authority. In Switzerland this is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, CH-3003 Bern, www.edoeb.admin.ch.
10. Cookies & tracking in the App
The App sets session cookies (authentication token) and analytics cookies (Matomo, self-hosted). No Google Analytics. You can disable cookies in your browser; the App then remains partially functional, but logging in is not possible without a session cookie.
11. Automated decision-making
No solely automated decision-making with legal effect within the meaning of Art. 21 FADP / Art. 22 GDPR takes place.
12. Links & document sharing
The App generates a cryptographically random link for documents sent. The Customer is responsible for passing the link only to authorised persons. Links can optionally be protected by a password or an expiry date (default: 12 months). Views are logged (timestamp, IP, user agent).
13. Website saley.ai
Server log files: when you visit our website, the web server processes technically necessary data (IP address, date and time, page requested, referrer, browser and operating system). This data serves the secure and stable operation of the website (legitimate interest) and is not combined with other data. The website’s fonts and scripts are delivered from our own server.
Cookie settings: on your first visit we ask which categories of cookies (necessary, statistics, marketing) we may use. We store your choice in your browser’s local storage (localStorage, key "saley-consent"). Statistics and marketing services are only loaded with your consent. You can change your choice at any time via "Cookie settings" in the footer of the website.
PDF upload ("Upload a PDF proposal"): if you upload an existing proposal as a PDF, we process the file and your details (name, company, email address, optionally phone number and notes) in order to create a Saley example proposal from it and to contact you about it. The data is sent by email to info@saley.ai. The legal basis is your consent (Art. 31(1) FADP / Art. 6(1)(a) GDPR), which you can withdraw at any time.
Newsletter: if you subscribe to our newsletter, we process your email address, the language of the website and the time of subscription in order to send you information about new features and sales tips. The subscription is sent by email to info@saley.ai. The legal basis is your consent, which you can withdraw at any time by emailing info@saley.ai.
Contact and booking: if you contact us by email or phone or book an appointment via the "Book a demo" link (Google Calendar, Google LLC), we process your details to handle your request.
14. Changes to this privacy policy
We may amend this privacy policy at any time. In the event of material changes, we will inform registered users by email at least 30 days before they take effect.
Last updated: October 2026