Who is responsible
Akson Group Sàrl is the controller for this website, for enquiries sent to us, and for accounts we manage ourselves.
- Company
- Akson Group Sàrl
- Address
- Rue Caroline 2, 1003 Lausanne, Switzerland
- hello@blackkeys.ai
- Company number (UID)
- CHE-204.577.104
When an institution gives you access
Banks, card programmes and concierge firms run Black Keys for their own clients, often under their own name. If you use Black Keys through one of them, that institution decides what data is collected about you and why, and it is the controller. We process that data on its behalf, under a written data processing agreement, and only on its instructions.
In that case the institution’s privacy notice applies and it is your first point of contact. If you write to us instead, we pass your request to the institution and help it answer.
What we collect
- When you visit the site: your IP address, browser and device type, the pages you request, the referring page, and the date and time. Our hosting provider records these in server logs.
- When a page fails in your browser: a technical error report with the page address, browser version and the error itself. We do not record your session or what you type.
- When you write to us: your name, email address, organisation and whatever you put in the message.
- When you have an account: your name, email address, phone number, role and institution, plus sign-in and security data such as multi-factor settings, sign-in times and IP addresses, and a log of actions taken in the platform.
- When an institution uses Black Keys to serve you: profile and household details, preferences, requests and their history, messages exchanged by email or WhatsApp, documents, addresses and payment records. Card details are entered with our payment provider and never stored by us.
Clients sometimes share sensitive information with their institution, for example health details relevant to a request. Notes of that kind are encrypted a second time inside the database, so it holds them only as ciphertext.
Why we use it
- To deliver the website and the platform, and to keep them secure. GDPR basis: our legitimate interest in running a reliable, safe service.
- To answer enquiries and hold commercial conversations. GDPR basis: steps taken at your request before a contract, or our legitimate interest in replying.
- To perform our contracts with institutions, including processing their clients’ data on their instructions. GDPR basis: performance of a contract.
- To find and fix faults, prevent abuse and investigate security incidents. GDPR basis: legitimate interest.
- To keep accounting and business records the law requires. GDPR basis: legal obligation.
We do not sell personal data, use it for advertising, or build marketing profiles.
AI features
Some platform features send text to an AI model to draft a reply, summarise a conversation or sort an incoming request. That text goes to Anthropic or OpenAI through their business APIs, whose terms exclude using it to train their models.
We do not take decisions about you based solely on automated processing that have legal or similarly significant effects.
Who helps us
These providers process personal data for us, under contracts that bind them to our instructions and to confidentiality:
- Vercel (United States)
- Website and application hosting
- Supabase (database in Frankfurt, Germany)
- Database, sign-in and file storage
- Sentry (United States)
- Error reports
- Resend (United States)
- Sending service emails
- Anthropic and OpenAI (United States)
- AI features
- Mapbox (United States)
- Turning addresses into map positions
- Meta, WhatsApp (Ireland and United States)
- WhatsApp messages, where an institution uses them
- Stripe (Ireland and United States)
- Payments
We also disclose data to the institution that gave you access, to professional advisers bound by secrecy, and to authorities where the law requires it.
Data outside Switzerland
Some of these providers process data in the European Union and in the United States. Switzerland recognises the EU as providing adequate protection. For the United States we rely on the Swiss-US Data Privacy Framework where the provider is certified under it, and otherwise on the standard contractual clauses recognised by the Federal Data Protection and Information Commissioner (FDPIC).
How long we keep it
- Server logs and error reports: up to 90 days, as set by each provider, unless needed to investigate an incident.
- Enquiries: as long as the conversation needs, then up to two years, unless they lead to a contract.
- Contracts, invoices and the correspondence that supports them: ten years, as the Swiss Code of Obligations requires.
- Platform data held for an institution: as long as its contract says, then deleted or returned to it.
Security
Data is encrypted in transit and at rest, access is limited by role and by institution at the database level, accounts can use multi-factor sign-in, and actions are recorded in an audit log.
These measures are described in more detail on the trust page.
Your rights
You can ask us whether we process data about you and receive a copy, have it corrected, have it deleted, object to or restrict its use, receive data you gave us in a common electronic format, and withdraw any consent you gave. These rights have legal limits, for example where we must keep records.
Write to hello@blackkeys.ai or to Akson Group Sàrl, Rue Caroline 2, 1003 Lausanne, Switzerland. We may ask you to confirm your identity, and we answer within 30 days.
Deletion requests are explained step by step on the data deletion page.
You can also complain to the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch. If you live in the EU, you can complain to your local data protection authority.
Children
The site and the platform are made for institutions and their adult clients. We do not knowingly collect data from children under 16 except where an institution records family members at a client’s request.
Changes
We update this notice when our processing changes. The date at the top shows the current version.