Privacy & your data
What the QR-bill workspace stores for your team, how long it is kept, and how to exercise your data-subject rights under the Swiss data-protection act (nDSG).
The free generator runs in your browser — invoice contents are rendered to PDF locally and never stored on our servers. The categories below only start accruing once you save or issue invoices with an account.
Data categories stored
| Category |
|---|
Customers Debtor master data you save: legal name, UID (companies), address, contact details, language preference. Retention: Kept while the customer is on your books; deletable on request once no retained invoice references them. Legal basis: Contractual relationship (nDSG Art. 31 para. 2 lit. a). |
Invoices Drafts and issued invoices: line items, totals, VAT, payment terms, QR reference, status. Retention: Issued invoices are bookkeeping records: kept ten years from the end of the fiscal year of issue (OR 958f). Drafts can be deleted at any time. Legal basis: Statutory bookkeeping obligation (OR 957). |
Issuer profile Your own billing identity: name, address, QR-IBAN and reference settings printed on generated bills. Retention: Kept while your team account exists; editable at any time. Legal basis: Contractual relationship (nDSG Art. 31 para. 2 lit. a). |
That is the complete inventory today. Payments, dunning, credit assessments and the audit trail are not live yet — nothing accrues for them, and this page is updated when those modules launch.
Bookkeeping law overrides the deletion right
Where a record is part of the accounting trail — an issued invoice — Swiss bookkeeping law requires ten-year retention from the close of the fiscal year (OR 957/958f). Deletion requests are honoured for everything outside that scope.
Access, export and deletion requests
For a copy of your team's stored data, rectification, or deletion within the limits above, write to privacy@graph.swiss from the email address that owns your team. We respond within 30 days (nDSG Art. 25).