← Back to Home

Privacy Policy

Last updated: October 28, 2026

1. Introduction

Netgen Switzerland AG ("we", "us", or "our"), located at Seestrasse 356, 8038 Zürich, Switzerland, operates the N.Cockpit platform. This Privacy Policy explains how we collect, use, disclose, and safeguard your information when you use our internal project management platform.

N.Cockpit is an internal business tool used exclusively by Netgen Switzerland AG for managing projects, resources, and operations with our employees, contractors, and clients. We do not sell products or services through this platform.

2. Data Controller

Netgen Switzerland AG
Seestrasse 356
8038 Zürich
Switzerland
Website: netgen.io/ch

For any privacy-related inquiries, please contact us at: privacy@netgen.host

3. Information We Collect

3.1 Personal Information

We may collect personal information that you voluntarily provide when using N.Cockpit, including:

  • Name and contact information (email address, phone number)
  • Employment information (job title, department, work schedule)
  • Professional skills and qualifications
  • Time tracking and project allocation data
  • Account credentials and authentication data

3.2 Automatically Collected Information

When you access our platform, we automatically collect:

  • Log data (IP address, browser type, access times)
  • Device information (device type, operating system)
  • Usage data (features accessed, actions taken within the platform)

3.3 Google User Data (Google OAuth)

When you connect your Google account using Google OAuth, we access, use, and store the following Google user data, only after you grant explicit consent, and solely to provide the calendar and authentication features of N.Cockpit:

  • Your Google account email address and profile name — used to authenticate you and link the calendar connection to your N.Cockpit profile.
  • Your Google Calendar data (calendar list and event details such as title, description, date and time, location, video-conference link, and participants) — accessed read-only via the calendar.readonly and calendar.events.readonly scopes to display your meetings within the platform.

We request read-only access and therefore cannot create, edit, or delete your Google Calendar events. We do not access, store, or share any other Google account data, and we never use Google user data for advertising or sell it to third parties. Synced calendar data is stored solely to render your meetings in N.Cockpit and is removed when you disconnect your Google account.

Limited Use disclosure. N.Cockpit's use and transfer to any other app of information received from Google APIs will adhere to the Google API Services User Data Policy, including the Limited Use requirements. Google user data is never used to serve advertisements, is not sold, and is not transferred to data brokers or used for purposes unrelated to the features described here. Human access to Google user data is limited to security, legal or abuse investigations, to your explicit request, or to aggregated and anonymised data for internal operations.

OAuth tokens that grant this access are stored encrypted in our database in Switzerland, are used only to call the Google APIs listed here, and are deleted when you disconnect the account in your settings or revoke access at myaccount.google.com/permissions. Removing the connection deletes the synced calendar data within 30 days.

3.4 Google Ads Data (Google Ads API)

For the advertising campaigns we manage on behalf of our clients, an authorised Netgen employee connects our Google Ads manager account to N.Cockpit via Google OAuth (scope adwords). Through the Google Ads API we read, read-only, the list of client accounts under the manager account and daily campaign performance data (campaign name, cost, impressions, clicks and conversions) of those accounts.

This data is stored in our database in Switzerland, assigned to the client project it belongs to, and used solely for budget controlling and reporting to that client. It is visible only to authorised Netgen staff and, in a restricted view, to the contact of the respective client. We only run read-only reporting queries through the API and never create, edit, or delete campaigns, budgets, bids, or audiences; we do not combine the data of one client with that of another in any client-facing view, do not use it for our own advertising, and do not sell or share it with third parties. The connection can be revoked at any time in the platform settings or in the Google account's security settings; stored campaign data is deleted together with the client project.

The Google Ads refresh token is stored encrypted and company-wide (it belongs to our manager account, not to an individual user). Daily performance figures are kept for as long as the client project is active and for the statutory accounting retention period of the invoices they support (10 years); account names and ids are removed when the account is unlinked from the project. The Google Ads API is used only in the way described in this section; the Limited Use disclosure in Section 3.3 applies to it as well.

3.5 Other advertising platforms (Meta, LinkedIn, TikTok)

For the same purpose — budget controlling and reporting of the campaigns we run for our clients — authorised staff can connect our company accounts on Meta (Facebook and Instagram ads), LinkedIn Ads and TikTok for Business. From these platforms we read, read-only, the list of ad accounts we manage and daily campaign performance data (campaign name, spend, impressions, clicks, conversions). We do not read personal data of the people who see or click the ads, do not change campaigns, and do not combine one client's figures with another's in any client-facing view. Access tokens are stored encrypted, used only for these read calls, and deleted when the platform is disconnected in the settings; stored figures follow the retention described in Section 3.4.

3.6 Receipts, documents and AI processing

Payment receipts of advertising platforms, offers, meeting notes and similar documents can be uploaded to N.Cockpit. They are stored in Switzerland and attached to the project they belong to. To extract structured information (for example amount, date, platform and account of a receipt, or action items of a meeting transcript) we send the document content to an AI model operated by Anthropic under a data-processing agreement; the content is not used to train models. Receipts may show the last digits of a company payment card; no full card numbers are stored.

4. Legal Basis for Processing (GDPR)

We process your personal data based on the following legal grounds under the General Data Protection Regulation (GDPR) and the Swiss Federal Act on Data Protection (FADP):

  • Contract Performance: Processing necessary for the performance of employment or contractor agreements
  • Legitimate Interests: Processing necessary for our legitimate business interests in managing projects and resources
  • Legal Obligations: Processing required to comply with legal obligations (e.g., tax and employment laws)
  • Consent: Where required, we obtain your explicit consent before processing specific data

5. How We Use Your Information

We use the collected information for the following purposes:

  • Managing employee and contractor work allocations and schedules
  • Tracking project progress, time entries, and resource utilization
  • Generating internal reports on project profitability and performance
  • Facilitating communication between team members and clients
  • Ensuring platform security and preventing unauthorized access
  • Complying with legal and regulatory requirements

6. Data Sharing and Disclosure

We do not sell, trade, or rent your personal information. We may share your data with:

  • Service Providers: Third-party service providers who assist in operating our platform (e.g., hosting, authentication services)
  • Integrated Services: When you connect third-party services (such as JIRA, Tempo, CREW, Bexio, Google, Meta, LinkedIn or TikTok) for synchronization purposes — only the data needed for that integration is exchanged
  • AI processing: Document and transcript content sent to Anthropic for extraction (see Section 3.6); never Google user data beyond what Section 3.3 allows
  • Legal Requirements: When required by law, court order, or governmental authority
  • Business Transfers: In connection with a merger, acquisition, or sale of assets

7. Data Retention

We retain personal data only for as long as necessary to fulfill the purposes outlined in this policy, unless a longer retention period is required by law. Specifically:

  • Active employee/contractor data: Retained during the business relationship
  • Time tracking and project data: Retained for 10 years for accounting purposes
  • Account data after termination: Deleted or anonymized within 90 days unless legally required
  • OAuth tokens and connected-account credentials (Google, Meta, LinkedIn, TikTok): Deleted immediately when the connection is removed or access is revoked
  • Synced calendar data: Deleted within 30 days after the Google account is disconnected
  • Advertising performance figures and receipts: Retained with the client project and its invoices for the statutory 10-year accounting period

8. Your Rights

Under the GDPR and Swiss data protection law, you have the following rights:

  • Right of Access: Request a copy of your personal data
  • Right to Rectification: Request correction of inaccurate data
  • Right to Erasure: Request deletion of your data (subject to legal retention requirements)
  • Right to Restrict Processing: Request limitation of data processing
  • Right to Data Portability: Receive your data in a structured, machine-readable format
  • Right to Object: Object to processing based on legitimate interests
  • Right to Withdraw Consent: Withdraw consent at any time where processing is based on consent

To exercise these rights, contact us at privacy@netgen.host.

9. International Data Transfers

Our platform uses Supabase for data hosting and authentication. Data may be processed in data centers located within the European Union. Switzerland has been recognized by the European Commission as providing adequate data protection. For any transfers outside the EU/EEA, we ensure appropriate safeguards are in place (such as Standard Contractual Clauses).

10. Data Security

We implement appropriate technical and organizational measures to protect your personal data, including:

  • Encryption of data in transit (TLS/SSL) and at rest
  • Role-based access controls and authentication mechanisms
  • Regular security assessments and monitoring
  • Secure password hashing and multi-factor authentication options

11. Cookies and Tracking

N.Cockpit uses only essential cookies required for the platform to function, including:

  • Authentication session cookies
  • Security tokens to prevent cross-site request forgery

We do not use marketing or analytics tracking cookies. We do not track users across other websites.

12. Third-Party Integrations

N.Cockpit may integrate with the following third-party services upon user configuration:

  • Atlassian JIRA (project management synchronization)
  • Tempo (time tracking synchronization)
  • Bexio (accounting integration)
  • CREW (crew.avidia.ai — task and worklog synchronisation)
  • Google OAuth and Google Calendar (authentication and read-only calendar sync — see Section 3.3)
  • Google Ads API (read-only campaign performance — see Section 3.4)
  • Meta Marketing API, LinkedIn Marketing API and TikTok for Business (read-only campaign performance — see Section 3.5)
  • Anthropic (AI extraction of uploaded documents and transcripts — see Section 3.6)
  • Resend (transactional e-mail delivery)

When using these integrations, the respective third-party privacy policies also apply.

13. Children's Privacy

N.Cockpit is not intended for use by individuals under the age of 16. We do not knowingly collect personal information from children.

14. Changes to This Policy

We may update this Privacy Policy from time to time. We will notify users of material changes by posting the updated policy on this page and updating the "Last updated" date. Continued use of the platform after changes constitutes acceptance of the updated policy.

If we materially change how we access, use, store, or share data obtained through Google OAuth or Google Calendar, we will notify affected users directly (for example, by email or an in-app notice) before the change takes effect.

15. Supervisory Authority

If you believe your data protection rights have been violated, you have the right to lodge a complaint with a supervisory authority:

Switzerland:
Federal Data Protection and Information Commissioner (FDPIC)
www.edoeb.admin.ch

European Union:
You may contact the supervisory authority in your EU member state of residence.

16. Contact Us

For questions about this Privacy Policy or our data practices, please contact:

Netgen Switzerland AG
Seestrasse 356
8038 Zürich
Switzerland
Email: privacy@netgen.host
Website: netgen.io/ch