Privacy Policy

This website can be used without giving any personal data. Buying, managing a subscription and getting in touch produce data. What that data is, is set out here.

1. Controller

Responsible for the processing of personal data on this website is:

Media Atelier
Stefan Fürst
Bühlstrasse 43a
8055 Zurich
Switzerland

[email protected]
https://mediaatelier.com

Questions about data protection go to this address. No data protection adviser has been appointed; Swiss law does not require one for a business of this size.

2. Applicable law

Media Atelier is based in Zurich. The primary reference is therefore the Swiss Federal Act on Data Protection (FADP) together with its ordinance.

GrandTotal is also sold to customers in the European Economic Area. For their data the General Data Protection Regulation of the European Union (GDPR) applies in addition, because the offering is expressly directed at people in the EU. Where the two frameworks differ, whichever provision is more favourable to the person concerned applies.

The competent supervisory authority in Switzerland is the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern.

3. What a mere visit to the site produces

a) Server logs

Every request leaves an entry in the web server's log: address requested, date and time, IP address, browser and its version, operating system, the page visited before (referrer) and the volume of data transferred. They serve the operation and security of the website and checks on compliance with the licence agreement.

b) The cookie

This website sets a single cookie, __id. It holds a random identifier with no connection to a name, is set on the first page view and expires after two years. The identifier connects page views, program download and later purchase in the same browser, and serves audience measurement to tell returning visits from new ones (see letter c).

The cookie is readable only by the server (HttpOnly) and is passed on to no one. Third-party cookies — for advertising or tracking purposes — are not used. To fend off automated access, however, Cloudflare (see letter e) may set a technical cookie of its own.

Every browser can be set to refuse cookies or to delete those already stored. Without this cookie the website remains fully usable; returning visits then count as new ones in the measurement.

c) Audience measurement with Matomo

Matomo is used to evaluate access to the site, analytics software on this website's own server. The data collected does not leave that server. Recorded are the pages requested, the referring source, the time spent, details about browser, operating system and screen size, and individual events on the page — how far a page was read, for instance, whether a video was started or a file downloaded. Plus the IP address: it is stored in full and serves to detect automated access. Matomo sets no cookies of its own; it recognises returning visits by the identifier from the cookie described under letter b. The browser setting “Do Not Track” is respected: anyone who has it switched on is not recorded by Matomo.

d) Log of page views

The server records which pages were requested in which order. The log hangs on the identifier __id from letter b and serves the question of which content leads to a purchase decision. No merging with third-party data takes place.

e) Delivery via Cloudflare

This website is delivered via Cloudflare (Cloudflare, Inc., USA). Cloudflare sits in front of the web server, speeds up delivery and fends off automated attacks. In doing so it processes, as a processor, the IP address of every request (on disclosure to the USA see section 8). Privacy terms: https://www.cloudflare.com/privacypolicy/

4. Getting in touch

Anyone who makes contact by e-mail or through a form on this website transmits at least an e-mail address and the content of the enquiry. These details are stored in order to answer the enquiry and to be able to follow the history in the event of later questions. The same applies to enquiries made from within GrandTotal.

Replies.io and Gmail are used to handle e-mail correspondence, Sentry to evaluate program crashes. These providers are processors and may use the data only for the purposes named.

5. Purchase, payment and subscription

For a purchase, name, e-mail address, billing address, the payment method chosen and the subscription details are processed. This data is required to perform the contract; without it no purchase comes about. Licence and invoice arise from it, and it is then subject to the statutory retention obligation (see section 9).

a) Stripe

Payments and subscriptions are handled through Stripe. Payment by credit card, SEPA direct debit and iDEAL runs through it, as does the recurring charge for a subscription. Name, e-mail address, billing address and the payment method details are transmitted for this purpose. Full card details are processed exclusively by Stripe and never reach Media Atelier's server. Stripe's privacy terms are at https://stripe.com/privacy.

b) Chargebee

Before the move to in-house subscription management, subscriptions were managed through Chargebee. No new data is transmitted there any more; only the remaining subscriptions not yet moved over still run through Chargebee, until they are moved or expire. Chargebee's privacy terms are at https://www.chargebee.com/privacy/.

6. Details from the program itself

a) Licence check and updates

At regular intervals GrandTotal checks the licence held with Media Atelier's server and asks it for a new program version. Transmitted in the process are the licence and subscription number, a device identifier, details about the device and the operating system, and about which program features are used to what extent. From this follows how many devices a licence runs on — the number of workstations is part of the contract —, which features are developed further, and whether a licence has been passed on without authorisation.

The contents of the documents do not leave the device. A device that does not report in for six months is deleted along with these details.

b) Web access

Anyone who switches on web access makes a GrandTotal document reachable from a paired phone or tablet. The document stays on the Mac: GrandTotal answers every request itself, and no server keeps a copy. So that the device can find the Mac, GrandTotal maintains a connection to a relay server operated by Media Atelier (relay.mediaatelier.com). This server is hosted by netcup GmbH, Karlsruhe, Germany, which provides the machines as a processor (privacy terms: https://www.netcup.com/de/kontakt/datenschutzerklaerung).

The connection between browser and GrandTotal is encrypted throughout with TLS; the private key is created in the Mac's keychain and never leaves it. The relay server therefore cannot read the contents; it sees only which random address is being contacted, and passes the encrypted data on. The server's log records the Mac's IP address with the time and duration of each connection, the document's random address, and failed access attempts with the IP address of the accessing device. Successful access by a paired device is not logged. These details serve the operation and security of the service and are not merged with purchase or licence data; on the server the random address cannot be attributed to any person.

The certificate for the address is issued by Let's Encrypt (Internet Security Research Group, USA); it contains no personal data. Whether a Mac has set up web access is reported to the licence server as a program feature in use (letter a).

c) GrandTotal Help

Questions to GrandTotal Help in “Ask GrandTotal” go to help.mediaatelier.com (netcup, Germany): the question, program version, language and the place in the program where it was asked. No data from the document is sent; GrandTotal replaces names of clients in the question with placeholders. The device identifier (letter a) limits the number of questions, is stored only as a checksum and is not combined with purchase or licence data.

The answer is written by the language model Claude from Anthropic PBC, USA (privacy policy). Anthropic receives neither the IP address nor the device identifier.

Questions and answers are stored for 30 days, after that only in a generally rephrased form and without the device identifier. Agents of your own can search the website and the fields of e-invoices through the same server; the search terms are likewise stored for 30 days.

The help can be switched off in the Settings under “Ask GrandTotal”.

7. PDF/A Checker: full check with veraPDF

The PDF/A Checker first checks your file entirely locally in your browser; nothing is transmitted. Only if you then explicitly choose “Upload and run full check” do we send the PDF file, encrypted, via our web server (cyon, Switzerland) to our own server at netcup GmbH, Karlsruhe, located in Nuremberg (Germany). There the open-source software veraPDF checks the file for conformance with PDF/A or PDF/UA. The sole purpose is to show you the result of the check; the legal basis is your consent (Art. 6(1)(a) GDPR), given by starting the check.

The file is kept in a temporary directory only for the duration of the check and deleted immediately afterwards. We store neither the file nor its name, its content or the result of the check. For each check, the check server logs only the file size, the check profile, the duration and the result in short form (e.g. “PDF/A-3b passed”), without an IP address; these entries are deleted after 30 days.

To prevent abuse, full checks are limited to 10 per hour. For this purpose we store on our web server the time of the check together with a value (hash) that is derived from your IP address using a secret key and from which the address cannot be recovered without that key. These entries are no longer used after one hour and are deleted with the next check request.

8. Disclosure abroad

The web server and the Matomo installation are located in Switzerland, the relay server for web access (section 6b), the server of GrandTotal Help (section 6c) and the check server of the PDF/A Checker (section 7) in Germany; Germany is one of the countries whose data protection the Federal Council recognises as adequate. Some of the processors named in sections 3 to 6 are based in the United States or process data there. In those cases the disclosure rests on the standard contractual clauses of the European Commission, which the FDPIC has recognised for Switzerland, or on a certification of the recipient under the Swiss–U.S. Data Privacy Framework. No disclosure to recipients other than those named here takes place, unless a legal obligation requires it.

9. Retention and deletion

Personal data is kept only as long as the purpose requires or the law prescribes. In detail:

  • Purchase and invoice data — kept indefinitely. The commercial retention obligation runs for ten years; beyond that, invoices and licences stay available so they can still be downloaded from the customer portal years later. Anyone whose last purchase was before 2016 and who has no subscription can delete their account in the customer portal: all personal data is removed — name, address, email, VAT ID. The amount and date remain as an accounting record.

  • Enquiries and correspondence — as long as the matter must remain traceable, at most as long as warranty or contract questions can arise from it.

  • Server logs — archived monthly; the host keeps the archives of the last few months.

  • Download log — three months; after that only monthly totals remain, with no reference to an individual download.

  • Details from the program (section 6) — six months without the device reporting in, then they are deleted.

  • Relay server log (section 6b) — 30 days. The list of certificates issued, which contains only the random address and the time, 90 days. Contents are never stored on the relay server.

  • GrandTotal Help (section 6c) — 30 days, after that without the device identifier.

  • PDF/A Checker (section 7) — the file is deleted immediately after the check, the check server's log after 30 days; the entries used to limit the number of checks lapse after one hour.

  • Measurement data and page log — the individual entries are deleted after twelve months; only totals remain, with no reference to an individual visit.

Delete account: the sign-in link for the customer portal arrives by email.

10. Data security

The website and the customer portal are encrypted throughout with TLS. With web access, the encryption ends only on the customer's Mac; the relay server merely passes the encrypted data on. Access to the server and to the database is limited to the controller. Payment data is not stored in-house but processed exclusively by Stripe.

11. Rights of the person concerned

The following rights exist towards Media Atelier. They can be exercised informally at [email protected]; as a safeguard, it is checked whether the person asking is in fact the person whose data is concerned.

  • Access — to whether and which personal data is processed, for what purpose, for how long and to whom it is disclosed (Art. 25 FADP, Art. 15 GDPR). Access is free of charge.

  • Rectification — incorrect data is corrected on request (Art. 32 para. 1 FADP, Art. 16 GDPR).

  • Erasure — data is deleted provided no statutory retention obligation stands in the way (Art. 32 para. 2 FADP, Art. 17 GDPR).

  • Release and transfer — data processed on the basis of consent or of a contract is released in a common electronic format or, on request, transferred directly to another body (Art. 28 FADP, Art. 20 GDPR).

  • Objection — processing for measurement purposes (section 3, letters c and d) can be objected to at any time, without giving reasons and without disadvantage (Art. 30 para. 2 let. b FADP, Art. 21 GDPR). Switching on “Do Not Track” in the browser or sending a short message is enough.

  • Restriction — instead of erasure, it can be demanded that data only be kept and not processed further (Art. 18 GDPR).

  • Withdrawal of consent — consent once given can be withdrawn at any time with effect for the future.

  • Complaint — to the FDPIC (address in section 2) or, for people in the EU, to the supervisory authority of one's own country of residence (Art. 77 GDPR).

12. No automated individual decisions

Decisions that significantly affect someone legally or in a similar way are not taken automatically. The measurement in section 3 serves the design of the website.

13. Basis of the processing

Swiss law requires no special permission for processing personal data, as long as it is done in good faith, proportionately and recognisably.

Where the GDPR applies in addition, the processing rests on Art. 6(1)(b) GDPR where it is needed to perform the purchase contract or to answer an enquiry; on Art. 6(1)(c) GDPR where a legal obligation exists, in particular in tax and accounting matters; and on Art. 6(1)(f) GDPR for the secure operation of the website, the warding off of automated access and audience measurement. Where consent is obtained, Art. 6(1)(a) GDPR is the basis.

14. Changes to this policy

This policy is adjusted as soon as the processing changes. The version published on this page is the one that applies.

As of October 2026