Privacy Policy

1. 01Data Controller

   Cross Stream Solutions Sàrl (“the Company”), a Swiss limited liability company registered and domiciled in Lausanne, Switzerland (Chemin de Villardin 4, 1004 Lausanne, Switzerland; company number CHE-112.457.223), is the data controller responsible for the processing of your personal data. Contact: privacy@compr.ch.

2. 02Applicable Law

   This Privacy Policy is governed by the Swiss Federal Act on Data Protection (FADP/nDSG, revised version effective 1 September 2023) and, where applicable, the EU General Data Protection Regulation (GDPR).

3. 03Personal Data We Collect

   Account data: Name, email address when you register or use magic link authentication.

   Agent configuration: Agent name, timezone, communication preferences, approval rules, and webhook settings.

   Coordination data: Messages, workflows, reminders, scheduling sessions, calendar events, and contact connections you create through the Platform.

   Calendar tokens: OAuth2 tokens for Google Calendar and Microsoft Outlook, encrypted at rest using Fernet encryption.

   Push subscription data: Web push notification endpoints and keys when you enable push notifications.

   Usage data: IP address, browser type, device information for security and rate limiting. We do not use this for personal profiling.

   Transaction data: Payment information processed via Stripe when applicable; we do not store credit card numbers.

4. 04Purpose and Legal Basis

   We process your personal data for the following purposes:

   • Providing and maintaining the service: powering your personal agent, scheduling, reminders, and agent-to-agent coordination (contractual necessity)
   • Notifications: sending email, push notifications, and webhook deliveries for reminders, workflow responses, and scheduling confirmations (contractual necessity)
   • Calendar synchronization: syncing events with Google Calendar or Microsoft Outlook when you connect an external calendar (consent)
   • Processing payments: handling subscription billing when applicable (contractual necessity)
   • Security and abuse prevention: rate limiting, input sanitization, and fraud detection (legitimate interest)
   • Service improvement: aggregated, anonymized analytics to improve platform performance (legitimate interest)
   • Website statistics: counting visits and pages read on invoq.me with Google Analytics, only if you click Accept on the cookie bar (consent)
   • Legal compliance: responding to legal requests and obligations (legal obligation)

5. 05Agent-to-Agent Communication

   Controlled sharing: When your agent communicates with another user's agent via ACP, only the minimum information needed for the coordination task is shared (e.g., proposed time slots, meeting titles).

   Approval rules: You control what your agent can share and what requires your explicit approval.

   No passive snooping: Agents only communicate in response to explicit user actions: no background information exchange.

   Webhook delivery: If a recipient agent has a webhook configured, messages are delivered with HMAC-SHA256 signed payloads for integrity verification.

6. 06Data Sharing

   We do not sell your personal data.

   We may share data with trusted service providers who process data on our behalf under strict contractual obligations:

   • OVH (France): server hosting, database, and our own last-resort AI model
   • Vercel: frontend hosting and CDN
   • Stripe: payment processing (when applicable)
   • Infomaniak (Switzerland): AI answers for your agent chat and for business agents. Messages are processed in Switzerland, in Infomaniak’s Geneva data centre, are not stored by Infomaniak and are not used to train AI models
   • Groq (USA): emergency backup AI, used only when the Swiss service is down, so that your agent keeps answering
   • Sentry: error monitoring (no personal data, only error traces)
   • Google / Microsoft: calendar sync when you explicitly connect your calendar
   • Google (Google Analytics): website visit statistics, only if you click Accept on the cookie bar; see the Cookie Policy

   Data may be transferred to countries outside Switzerland/EEA only with adequate safeguards in place.

7. 07Data Security

   Encryption in transit: All data is encrypted via TLS (HTTPS).

   Encryption at rest: OAuth calendar tokens are encrypted using Fernet (JWT-derived key). Database hosted on secured OVH VPS with UFW firewall.

   Authentication: JWT-based authentication with magic link sign-in option. Passwords hashed with bcrypt.

   Access control: Rate limiting on all endpoints, input sanitization against prompt injection, CORS restricted to specific origins.

   Webhook integrity: HMAC-SHA256 signatures on all webhook deliveries.

8. 08Data Retention

   We retain personal data only as long as necessary for the purposes described above, or as required by Swiss law (typically 10 years for accounting records under the Swiss Code of Obligations, Art. 958f CO).

   Completed workflows and expired reminders are automatically cleaned up after 90 days.

   Magic link tokens expire after 15 minutes and are single-use.

   When you delete your account, all personal data is permanently removed within 30 days.

9. 09Your Rights

   Under the FADP and GDPR (where applicable), you have the right to:

   • Access your personal data: viewable at any time through the app
   • Correct inaccurate data: update your profile and agent settings
   • Delete your data: delete your account and all associated data permanently
   • Export your data: request a full export of your information
   • Object to or restrict processing
   • Data portability: receive your data in a structured, machine-readable format
   • Lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC)

10. 10Contact

    For privacy-related inquiries:

    Cross Stream Solutions Sàrl
    Chemin de Villardin 4, 1004 Lausanne, Switzerland

    Email: privacy@compr.ch

© 2026 Cross Stream Solutions Sàrl. All rights reserved.