Last updated: April 28, 2026
Florian Rothenbühler
c/o F2BII E-Commerce#511
Hintergoldingerstrasse 30
8638 Goldingen
Switzerland
Email: [email protected]
Based on the revised Swiss Federal Act on Data Protection (revDSG, in force since September 1, 2023) and Article 13 of the Swiss Federal Constitution, every person is entitled to the protection of their privacy and protection against misuse of their personal data.
We take the protection of your personal data seriously and treat your personal data confidentially and in accordance with the applicable data protection regulations and this privacy policy.
This privacy policy applies to the website florianrothenbuehler.com and all applications and services accessible through it.
This website does not use cookies. No tracking cookies, no analytics cookies and no marketing cookies are used.
Fonts are hosted locally. No external services such as Google Fonts are called. When visiting this website, no data is transmitted to Google or other third-party providers.
Local storage (localStorage): For your personal settings (e.g. dark/light mode, cursor style, sound settings), your browser's localStorage is used. This data does not leave your browser and is not transmitted to servers.
When accessing this website, the hosting provider (Cloudflare, Inc.) automatically collects general information. This includes the type of web browser, the operating system used, the domain name of the internet provider and similar data.
This is exclusively information that does not allow conclusions to be drawn about your person. This information is technically necessary to correctly deliver the requested content.
Registration is required for the use of certain applications on this website. During registration, the following data is collected and processed:
Authentication is handled via the service Supabase (Supabase, Inc., headquartered in the USA — physical data processing takes place in Frankfurt, Germany, region eu-central-1). Supabase stores your login data, session tokens and profile information in a secured PostgreSQL database with Row-Level Security (RLS). Each user has access only to their own data.
Legal basis: Contract fulfillment — registration is a prerequisite for using the applications.
Through your user account, you have access to the following applications. All data is stored per user and is not visible to other users.
Finance (Financial Management)
This data is stored exclusively in your personal area at Supabase and serves your own financial management. No data is shared with third parties, with the following exception: When optionally importing bank statements as PDF, the PDF document is transmitted to Anthropic (operator of the Claude API, USA) for structure extraction. Only the extracted transaction structures are stored, not the PDF itself.
Time Tracker
This data is stored in your personal area at Supabase and serves your own time management.
Account (User Management)
Legal basis: Contract fulfillment — you actively use the applications and control the entered data yourself.
This website uses Cloudflare Web Analytics. This service does not collect personal data, does not set cookies and does not create individual user profiles. Only aggregated, anonymous data such as page views, time on page and country of origin is collected.
Additionally, a custom analytics service is used that collects the following data:
No cookies are set. IP addresses are not stored. The pseudonymous visitor identifier is stored exclusively in your browser's localStorage and is never linked to other data. You can remove it at any time by clearing your browser storage.
The collected data is stored in Cloudflare Workers KV (retention: 90 days) and is used exclusively to improve the website. No user profiles are created and no data is shared with third parties.
Legal basis: Legitimate interest (Art. 31 revDSG) — optimization of the website without encroachment on privacy.
When you subscribe to the newsletter, the following data is collected:
Your email address and category selection are stored in Cloudflare Workers KV. Delivery is handled via the email service Resend (Resend, Inc., USA).
Double opt-in: After signing up, you will receive a confirmation email. You will only be added to the mailing list after confirming the link.
Legal basis: Your consent. You can unsubscribe from the newsletter at any time via the unsubscribe link in every email. Upon unsubscribing, your data will be deleted.
When you contact us via email, WhatsApp or Telegram, your data is stored for the purpose of processing the inquiry. This data will not be shared without your consent and will be deleted after completion of the inquiry, unless legal retention obligations apply.
We use the following service providers to operate this website and the applications:
eu-central-1) — Authentication, database for user data and application data. Privacy Policy →All listed service providers process data exclusively on our behalf and according to our instructions (Art. 9 revDSG or Art. 28 GDPR).
The above-mentioned data processors are headquartered in the USA. Data transfers are based on the EU-U.S. Data Privacy Framework or the adequacy decision of the Federal Council pursuant to Art. 16 revDSG.
In detail:
We store personal data only as long as necessary for the respective purpose:
Statutory retention obligations (e.g. accounting: 10 years pursuant to OR Art. 958f) remain reserved.
Personal data is generally not shared with third parties unless it is necessary to fulfill our services (see Data Processors), you have given express consent, or there is a legal obligation.
This website is hosted by Cloudflare, Inc. (101 Townsend St, San Francisco, CA 94107, USA). Cloudflare participates in the EU-U.S. Data Privacy Framework.
This website offers software files for download. No personal data is collected during downloads beyond what is recorded in server log files.
Under the revDSG, you have the following rights:
To exercise your rights, a data subject rights form with jurisdiction selection is available. Requests are answered within 30 days (45 days for CCPA/Canada). Direct contact: [email protected]
Supervisory authority:
Federal Data Protection and Information Commissioner (FDPIC)
Feldeggweg 1, 3003 Bern, Switzerland
edoeb.admin.ch →
The rights described in Section 16 apply regardless of residence. If you reside in one of the following regions, additional region-specific rights and complaint channels apply. Please direct requests to [email protected]; please state your jurisdiction so the applicable deadline can be observed.
European Union (GDPR)
In addition to the above rights, you have the right to restriction of processing (Art. 18), the right to object (Art. 21) and the right to lodge a complaint with the supervisory authority of your member state (Art. 77). Since the data controller is based in Switzerland, you may contact the supervisory authority of your country of residence.
United Kingdom (UK GDPR + Data Protection Act 2018)
Data subjects resident in the United Kingdom have the same rights as under the GDPR. Complaints can be addressed to the Information Commissioner's Office (ICO), Wycliffe House, Water Lane, Wilmslow, Cheshire SK9 5AF. ico.org.uk →
California (CCPA/CPRA)
California residents have the right to know what personal data is collected (Right to Know), to deletion (Right to Delete), to correction (Right to Correct), to data portability and to opt out of the sale or sharing of personal data (Right to Opt-Out of Sale/Sharing). We do not sell personal data and do not share any with third parties for cross-context behavioral advertising. Additionally, you may limit the use of sensitive data (Right to Limit). Opt-out signals via Global Privacy Control (GPC) will be honored once the applications are publicly available. Requests are answered within 45 days (extendable by 45 days with justification). Complaints: California Privacy Protection Agency, cppa.ca.gov →
Brazil (LGPD)
Under the Lei Geral de Proteção de Dados (Lei 13.709/2018), you are entitled to confirmation of processing, access, rectification, anonymization/blocking/deletion of unnecessary data, portability and information about shared data (Art. 18 LGPD). Supervisory authority: Autoridade Nacional de Proteção de Dados (ANPD). gov.br/anpd → — a Portuguese summary of the key passages is available upon request.
Canada (PIPEDA) and Quebec (Law 25)
You are entitled to access, rectification and complaint under PIPEDA; in Quebec additionally to data portability and information about automated decision-making processes (Law 25). Complaints: Office of the Privacy Commissioner of Canada, priv.gc.ca → or Commission d'accès à l'information du Québec (CAI), cai.gouv.qc.ca →.
Japan (APPI)
Under the Act on the Protection of Personal Information, you have the right to disclosure, rectification, deletion and cessation of use of your data. For sharing with third parties, we obtain your consent where required. Supervisory authority: Personal Information Protection Commission (PPC), ppc.go.jp →
India (DPDP Act 2023)
You are entitled to access, rectification, deletion, appointment of a trusted person ("Data Principal" rights under Sections 11-13 DPDP Act) and complaint to the Data Protection Board of India. The contact for complaints is initially the email address stated above. meity.gov.in →
Other Jurisdictions
Residents of other states with comparable data protection laws (e.g. South Korea PIPA, South Africa POPIA, Australia Privacy Act, US states with consumer protection laws such as Virginia VCDPA, Colorado CPA, Connecticut CTDPA, Utah UCPA, Texas TDPSA) may also exercise their rights via email. We review every request based on the applicable legal basis and respond within the statutory period (typically 30-45 days).
In individual applications, we use AI systems to provide certain functions. In detail:
Transparency: For all publicly accessible AI interactions (chat, generated texts or images), we clearly indicate pursuant to Art. 50 EU AI Act that you are interacting with an AI system or that content was AI-generated.
No automated individual decisions: No automated decisions within the meaning of Art. 22 GDPR are made that have legal effects on you.
No training with your data: Your inputs are not used for training the AI models employed. Processing is exclusively for the specifically requested function.
Result quality: AI systems may produce incorrect or incomplete results. Please verify important decisions independently.
These services are not intended for persons under 13 years of age. For users in the EU, a minimum age of 16 years applies pursuant to Art. 8 GDPR.
We do not knowingly collect personal data from children under 13. Should we become aware that an account was created by a person below the stated age limits, we will immediately delete the account and all associated data.
Parents and guardians who become aware of such a registration can contact us at any time at [email protected].
We reserve the right to modify this privacy policy at any time. The current version is published on this website.