Privacy
Updated 25 September 2026
Scope and responsibility
This notice covers krascorp.com, www.krascorp.com, the branded login, company chooser and invoicing workspace at invoicing.krascorp.com. The separate staging service is for testing. Krascorp is operated by Fibuag AG, Oberneuhofstrasse 5, 6340 Baar, Switzerland. Contact martin.brun@krascorp.com for privacy questions or requests.
Visiting the website
The hosting systems receive your IP address, requested address and technical browser/connection information to serve and protect the website. The public homepage is hosted through OpenAI Sites and Cloudflare; the invoicing app uses Cloudflare Workers, D1 and private R2 storage. The site’s images, graphics, scripts and styles are served locally. Pointer movement and display preferences used by the interactive graphic are processed in your browser. The authored site and app contain no advertising analytics, marketing pixels or social-media embeds.
Contact enquiries
The form asks for your name, reply email, phone number and message so we can respond and follow up about your enquiry. All four fields are required; you can also email us directly. Submission does not subscribe you to marketing. Please do not send passwords, payment-card details or sensitive documents. Resend sends the plain-text enquiry to martin.brun@krascorp.com, hosted on Microsoft 365 through GoDaddy. Martin Krassimir Brun is the only person authorised to read this mailbox; no automatic forwarding to other people is configured, as confirmed by the mailbox owner. Contact enquiries are kept while we handle the enquiry, its follow-up or a continuing business purpose. We review completed enquiries and delete information when there is no remaining purpose, except information needed for an identified legal obligation or claim. This is a purpose-based review policy, not an automatic mailbox purge or a promise that all provider backups disappear immediately.
Form protection and delivery
The website database stores a random submission reference, hashes of the email payload and IP address, timestamps, retry counters and delivery status. It does not store your name, reply email, phone number or message text. These details do appear in the enquiry email processed by the email services. Records older than 48 hours are removed on the next valid configured submission; this is not an exact deletion deadline during periods with no submissions. Draft form contents stay in the open page and are not saved by our code in browser storage. Provider acceptance of an email does not guarantee inbox delivery.
Private access and business records
Only provisioned accounts can request a five-minute, one-use login code. The server stores a hashed verification value, account details, rate-limit records and session information including IP address and browser identification. Sessions expire after eight hours. The app stores company and client contact details, addresses, services, invoice items and totals, payment records, corrections, reminders and an activity history. Authorised workspace members can access those records. The activity list retains the latest 500 entries. Approved business documents preserve their original details when a current client entry changes. Where a company explicitly enables quarterly repetition for a client, the workspace also stores the selected regular services, agreed quantities and fees, preparation dates, source invoice and a record of prepared quarters. The hourly scheduler uses those settings to prepare review drafts. Schedules and prices belong to each client within that company workspace; no employee database or headcount pricing formula is created. Drafts are not automatically approved or emailed. Saved documents retain their language. Translating an issued invoice stores a separate rendition with wording, author, creation time and a copy of the issued original; the original remains available. Standard wording is translated locally, and custom wording is preserved.
Emails and documents
The contact and login services use Resend. Invoice and reminder sending is a separate feature requiring sender setup and explicit review; it is not activated by submitting a contact enquiry. When that feature is used, delivery metadata and an immutable email/PDF payload can be stored in D1 and private R2. The ordinary website/app flows do not send form or invoice content to a generative-AI API.
Provider retention settings
The invoicing app uses Cloudflare Workers Free. D1’s documented recovery window for that plan is seven days; our R2 storage has no automatic expiry rule for completed attachments. Stored Worker logs and traces are switched off for the production invoicing app. This does not switch off Cloudflare’s separate security or operational processing. Resend’s Free plan states 30 days for email and log data, with seven-day backups. These provider periods are separate from the business-record and mailbox policies.
Accounting retention
Issued accounting invoices are subject to our selected minimum retention of ten years from the end of the relevant fiscal year. Related records, an unresolved balance, a dispute or another duty can require longer retention. There is no automatic deletion on the anniversary. Any later deletion must be deliberate and performed by an authorised workspace owner after checking eligibility; invoice recipients do not receive deletion access. Fibuag’s configured fiscal year-end is 31 December. Permanent deletion requires an eligible invoice, resolved balances, no continuing hold, the owner’s review of continuing duties and confirmation of the exact invoice number. The deletion includes linked translations and saved email attachments; existing activity history, numbering safeguards and records preventing duplicate billing remain. Previously sent or downloaded copies and provider backups are not recalled. Draft and unused-client deletion have separate safeguards.
Storage and requests
Closing a page, signing out or clearing cookies does not erase stored business records or messages in the mailbox. Expiry of a login code or session limits its use; it does not by itself promise deletion from every database or backup. Access, correction and deletion requests can be sent to martin.brun@krascorp.com. Depending on applicable law and the record involved, access, correction, deletion, restriction, objection or portability rights may apply. Records may have to be retained for accounting, legal obligations or claims; a request does not guarantee that an approved invoice can be deleted. You may contact the competent supervisory authority, including the Swiss FDPIC.
International processing
Our providers can process personal data outside Switzerland. The countries, services and transfer safeguards are explained below. A storage region for one service does not limit every network, security, support or backup operation to that region.
Cloudflare
The invoicing service uses Cloudflare’s global network, with app storage configured in Western Europe. Cloudflare also processes operational metadata in the United States and Europe. Requests can be handled at available network locations worldwide. Its standard data-processing terms include safeguards for applicable transfers, including Swiss-adapted standard contractual clauses.
OpenAI Sites
OpenAI Ireland Ltd hosts this site under the individual ChatGPT Sites Data Processing Addendum. It covers hosting, maintenance, support, subsequent deletion obligations and safeguards for overseas transfers. It gives no fixed security-log deletion deadline.
Sites provider locations
OpenAI lists possible Sites processing in Australia, Brazil, Canada, Finland, France, Germany, India, Indonesia, Ireland, Italy, Japan, Malaysia, Mexico, the Netherlands, Norway, the Philippines, Poland, Singapore, South Africa, South Korea, Spain, Sweden, Switzerland, the United Arab Emirates, the United Kingdom and the United States, plus Cloudflare’s network locations. These are possible destinations.
Email providers
Resend stores email content and logs in the United States regardless of the sending region. Its published data-processing terms include Swiss-adapted transfer clauses. Microsoft 365 through GoDaddy hosts our contact mailbox. The mailbox’s exact storage geography and any separate backup subscription have not been verified. We do not promise Swiss-only mailbox storage, absence of backups or immediate erasure of every provider copy. GoDaddy and Microsoft describe their international processing and applicable transfer safeguards in the linked terms.