Privacy Policy
Amrachi is a Swiss software business based in Geneva. This Privacy Policy explains how Amrachi processes personal data and the roles it assumes depending on the processing activity.
Last updated: 4 September 2026
1. Our roles
Amrachi generally acts as controller for personal data processed for its own business purposes, including the public website, prospect and customer communications, account administration, support, security, billing and consent-based website analytics.
Where Amrachi processes personal data submitted by or on behalf of a professional customer through the Service for that customer’s portfolio-supervision activities (“Customer Personal Data”), Amrachi generally acts as processor on behalf of that customer. Where the customer itself acts as processor, Amrachi may act as subprocessor. Customer Personal Data is also governed by the Data Processing Agreement (“DPA”).
2. Personal data we process
- Website and technical data, including IP address, browser/device information, requested pages, timestamps, security signals and privacy preferences.
- Professional contact and CRM data, including name, business email, organisation, role, correspondence and relationship history.
- Account and service-administration data, including organisation membership, authentication/access information, account settings, support requests and operational communications.
- Customer Personal Data submitted or generated through the Service, which may include client references, portfolio-related information, supervision reviews, decisions, rationales, follow-up and evidence records.
- Optional website analytics data where the visitor has consented to Analytics.
3. Why we process personal data
We process personal data to provide, administer and secure the Service; authenticate users and manage access; administer customer and contractual relationships; communicate with prospects and customers; provide support and transactional communications; protect the Service against misuse and security threats; maintain reliability and evidence integrity; comply with applicable law and establish, exercise or defend legal claims; and, with consent, understand and improve use of our public website.
4. Legal bases where the GDPR applies
Where the GDPR applies, processing may be based on performance of a contract or pre-contractual steps, compliance with a legal obligation, legitimate interests in operating and protecting our business and Service, or consent where consent is required. Consent may be withdrawn at any time with effect for the future.
5. Service providers and recipients
We use selected service providers to operate and secure Amrachi. Not every provider processes Customer Personal Data in every context. Providers that process Customer Personal Data on our behalf are subject to appropriate contractual requirements and are identified in our current Subprocessor List.
We do not sell personal data.
| Provider | Purpose | Current public location statement |
|---|---|---|
| Supabase | Database, authentication, storage and backend infrastructure | Primary production database: Zurich, Switzerland |
| Vercel | Application-shell hosting and delivery | Controller-side technical infrastructure used by Amrachi for service delivery and security; does not receive the Customer Personal Data content processed through authenticated portfolio-supervision workflows |
| Resend | Transactional email delivery | Provider infrastructure; transfer safeguards apply where required |
| Cloudflare | Turnstile bot protection on authentication flows and DNS | Provider infrastructure; transfer safeguards apply where required |
| Sentry | Application error and performance monitoring | EU data-storage region |
| Attio | CRM for Amrachi prospect and customer relationship management | Amrachi acts as controller for CRM data; Attio processes that data on Amrachi’s behalf |
| Google Analytics 4 | Optional public-website analytics after consent | May process approximate location, including city-level location derived from network/device information |
6. Hosting and international processing
The primary Supabase production database used by the Service is hosted in Zurich, Switzerland. This does not mean that all personal data processed in connection with Amrachi remains exclusively in Switzerland.
Certain service providers may process limited personal or technical data, or permit operational access, from other jurisdictions. Where additional safeguards are required, Amrachi uses appropriate contractual or other legally recognised transfer mechanisms.
7. Website analytics
With consent, Amrachi uses Google Analytics 4 (“GA4”) on the public marketing website to understand website usage and improve the site. Analytics is disabled by default and is activated only after affirmative Analytics consent.
GA4 is not loaded in the authenticated Amrachi application. Analytics may include pages viewed, device/browser characteristics, referring source, campaign information and approximate location, including city-level location. Amrachi does not send Customer portfolio data, Customer client identifiers or authenticated Amrachi account identifiers to GA4.
Analytics consent can be withdrawn at any time through Cookie settings.
8. Retention
We retain personal data only for as long as reasonably necessary for the relevant purposes, taking into account contractual requirements, security needs, applicable limitation periods, customer instructions and legal obligations.
Where Amrachi acts as processor, retention and deletion of Customer Personal Data are governed primarily by the customer’s instructions, the Agreement, the DPA and applicable backup procedures. Deleting or disabling an individual user account does not necessarily require deletion of historical supervision evidence relating to actions previously performed by that user where preservation remains appropriate for the customer.
9. Security
Amrachi uses technical and organisational measures designed to protect personal data against unauthorised access, alteration, loss and disclosure, taking into account the nature and risks of the processing. Further information is available on the Security page.
10. Your rights
Depending on applicable law and the circumstances, individuals may have rights to obtain information about personal data, request correction or deletion, object to or restrict certain processing, request portability where applicable, or withdraw consent. Statutory conditions and limitations may apply.
Requests concerning processing for which Amrachi acts as controller may be sent to privacy@amrachi.ch. If personal data was submitted by an Amrachi customer, requests should normally be directed to that customer; Amrachi will assist the customer where required.
11. Contact and changes
Privacy questions may be sent to privacy@amrachi.ch. Amrachi may update this Policy to reflect changes in its processing activities, the Service or applicable law. The “last updated” date displayed on this page identifies the current version.