Privacy Policy

This policy explains what personal data Visto processes, why, and what rights you have over it. It covers the website at getvisto.ch, the Visto waitlist, and the Visto app, which is currently a closed beta. It is governed by the Swiss Federal Act on Data Protection (nFADP).

1. Who is responsible for your data

The data controller is:

2. The website and the waitlist

• Your email address — when you join the waitlist through the form on getvisto.ch and confirm it (double opt-in). Used only to tell you when Visto launches and to send product updates. We process it on the basis of your consent, which you can withdraw at any time through the unsubscribe link in any email, or by writing to us.
• Where it is stored — by our newsletter provider, Infomaniak Network SA, Rue Eugène-Marziano 25, 1227 Geneva, Switzerland (infomaniak.com), in Switzerland and the EU.
• Google Fonts — the website loads fonts from Google (Google LLC, USA). When a page loads, your browser contacts Google's servers, which may log your IP address. Google's privacy policy applies: policies.google.com/privacy.
• Your language preference (English or German) is kept in your browser's local storage. It never leaves your device.

3. The Visto app — what we process and why

Your account: your email address, your password and the name you give us. Your password is stored only as a hash by our sign-in provider — nobody, including us, can read it.

From the bank statements you import:

• your bank accounts — IBAN, BIC, account name and currency;
• your transactions — dates, amount, currency, the description exactly as your bank provides it, the category, whether it recurs, and how it was categorized;
• your category corrections, and the rules Visto learns from them;
• bills you add — description, payee, amount, due date, status, notes and reminder setting.

The statement file itself is not stored. It is read once to extract your transactions and then discarded. For each import we keep the file name (bank file names often contain your account number), a fingerprint of the file so we can recognise it if you import it again, the period it covers and how many transactions it contained.

Other people's data: transaction descriptions contain the names of the people and businesses you pay or who pay you — for example TWINT contacts — and sometimes their account numbers. They are handled exactly like the rest of your data.

When an import fails, we record an error code, the file format, the bank, the file size and extension, and a short technical note — never the file contents, the file name or account numbers.

Why we process it:

• to show you your own spending — the reason Visto exists;
• to fix errors and improve categorization. To do this, the operator may look at your transactions (for example, merchant names Visto did not recognise) and use backup copies to test that data can be recovered. Nothing is shared with anyone, and it is never used for anything else.

We do not sell your data, show you advertising, build profiles of you, or share your data with anyone.

4. Where app data is stored and who processes it

• Supabase (Supabase Inc., USA) — runs Visto's database, sign-in and statement processing. Your data is stored in its Zurich data centre, which is operated by this US company.
• Resend (USA) — sends your sign-up and recovery codes, and so processes your email address.
• Apple — distributes the beta through TestFlight, under Apple's own terms and privacy policy.
• Email to us — mail sent to joel@getvisto.ch is forwarded by Infomaniak to a Gmail inbox, so Google (USA) stores it.
• Backups — the operator keeps encrypted backup copies on his own computer in Switzerland. They are deleted within 30 days.

There are no other recipients. Your data is never sold or shared.

5. What stays on your phone

Your sign-in session, your Face ID setting and a marker that you have signed in on this device before are kept in your iPhone's Keychain. When you export your data, the export file exists on your phone only briefly, while the share sheet is open.

Face ID data never reaches Visto. iOS performs the check on your device and tells Visto only whether it succeeded.

6. How long we keep your data

• Waitlist: for as long as you remain on the waitlist. If you unsubscribe or ask us to delete it, your email address is removed within 30 days.
• App: for as long as you have an account. Deleting your account in Settings takes effect immediately and removes everything listed in section 3. Backup copies are erased within 30 days.
• Provider logs: Supabase keeps sign-in logs for 1 day; Resend keeps email delivery records for 30 days.
• Emails you send us: kept for up to 12 months after the conversation ends, then deleted.

7. Your rights

Under the nFADP you have the right to:

• Access — in the app, use Export in Settings; or ask us for a copy
• Correction — ask us to correct inaccurate data
• Deletion — in the app, use Delete account in Settings; or ask us
• Withdrawal of consent — leave the waitlist through the unsubscribe link in any email, or by writing to us
• Complaint — lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) at edoeb.admin.ch

To exercise any of these rights, write to joel@getvisto.ch. We will respond within 30 days.

8. No tracking

Neither the app nor the website uses analytics, tracking, crash reporting or advertising IDs. If that ever changes, this policy changes first.

9. Changes to this policy

We will announce material changes in advance — to app users in the app or by email — and update the date at the top of this page.