Data protection notice (Swiss FADP — Federal Act on Data Protection) — Oretly
1. Data controller
NXTY Sagl, Switzerland. Data protection contact: info@oretly.ch
2. Where your data is kept
In Switzerland. The database, application servers, chats and uploaded files reside on infrastructure located on Swiss territory, operated by NXTY Sagl (Gravesano). No personal data is transferred abroad to be stored or processed, with the only two technical exceptions described in section 7.
There is no third-party analytics or advertising tracking tool inside the application. No pixels, no measurement SDKs, no profiling for commercial purposes.
3. What data we process
To create and manage the account Email address, password (stored only as a cryptographic hash), first name, last name, phone number, language, and, where applicable, the sign-in identifier with Apple or Google.
To use the service Reference postcode (NPA), service radius, services offered, hourly rate, weekly availability, profile photo, published announcements, applications, messages and images exchanged in chat, recorded hours and PDF summaries, reviews, reports.
For the verified badge (optional) Identity document uploaded by the user.
Technical Registration date, login dates, session tokens, push notification tokens, server technical logs.
We do not process sensitive data within the meaning of art. 5 let. c of the Swiss FADP (Federal Act on Data Protection), other than any that may be contained in the identity document, and only for the duration of the verification.
4. Why we process it and on what basis
| Purpose | Legal basis |
|---|---|
| Creating the account, authenticating you, letting you use the service | Performance of the contract |
| Showing the profile on the map and on the job board | Performance of the contract |
| Delivering messages and notifications related to your jobs | Performance of the contract |
| Verifying your identity for the badge (if you request it) | Consent |
| Preventing abuse, fraud and unlawful conduct | Legitimate interest |
| Handling support requests | Performance of the contract |
| Retaining accounting data and reported chats | Legal obligation (art. 958f of the Swiss Code of Obligations (CO)) |
| Managing subscriptions | Performance of the contract |
Your consent to the processing is requested explicitly at registration, before the email address is verified.
5. Your location is never exact
The map does not show where you are. Profiles are placed at a point deliberately shifted at random within the reference postal area, and no precise coordinate is ever communicated to other users. Your phone number is visible to the other party only after an explicit unlock during a conversation.
6. Who sees what
- Other users see: name, photo, services, rate, approximate area, reviews and — after the unlock — the phone number.
- Oretly administrators access the data only for moderation, document verification, handling of reports and support. Every access to sensitive data is recorded in an internal log.
- No data is sold, transferred or shared for advertising purposes.
7. The only two exceptions outside Switzerland
- Push notifications. To deliver a notification to you, we send Apple (APNs) or Google (FCM) only the device token and the content of the notification. No other data from your profile passes through there.
- Subscriptions. The purchase takes place entirely within the App Store or Google Play, which communicate to us — through the RevenueCat service — only the status of the subscription (plan, active or expired, expiry date) associated with your Oretly identifier. We never receive your card details or your billing address.
8. How long we keep it
| Data | Duration |
|---|---|
| Account and profile | As long as the account exists |
| Chat messages | As long as the account exists (they remain visible to the other party) |
| Identity document (KYC) | Destroyed within 48 hours of the decision, in every case |
| One-time codes (OTP) | A few minutes |
| Technical logs | As long as needed for the security of the service |
| Reported chats and accounting data | 10 years (3650 days) from the closure of the account, art. 958f of the Swiss Code of Obligations (CO) |
9. Account deletion
You can delete your account at any time from the application (profile → "Delete account"). Deletion is immediate and final:
Gone immediately and forever: first name, last name, email address, phone number, photo, availability, credentials, links with Apple and Google, device tokens, profiles and announcements published by you.
Kept, because the law requires it: the conversations that had been reported for abuse and the accounting data relating to the jobs carried out. They are moved to an encrypted, isolated archive, readable only by administrators or upon formal request from the Swiss judicial authorities, and destroyed automatically at the end of the 10 years provided for by art. 958f of the Swiss Code of Obligations (CO).
Conversations that were not reported are not deleted because they also belong to the other party, who has not requested anything; in your place a nameless user appears. The same applies to the reviews you wrote.
10. Your rights
You have the right to: access your data and obtain a copy of it; have it corrected; have it deleted; object to processing based on our legitimate interest; withdraw consent you have already given; receive your data in a readable format.
To exercise them, write to info@oretly.ch or use the in-app help centre. We reply within 30 days. You may also contact the FDPIC (Federal Data Protection and Information Commissioner), Feldeggweg 1, 3003 Bern.
11. Security
All traffic travels encrypted (HTTPS and WSS). Passwords are stored only as a hash. Identity documents and the archives subject to ten-year retention are encrypted with AES-256. Administrative access is protected by personal credentials and logged. Backups are encrypted and their restoration is tested periodically.
12. Changes to this notice
If anything significant changes, we will let you know by email or in the application before it takes effect.
Last updated: 12 September 2026