Privacy Policy

Last updated: 7 September 2026

1. Controller and Contact

The controller responsible for data processing under applicable data protection laws (including the Swiss Federal Act on Data Protection (revDSG) and the EU General Data Protection Regulation (GDPR)) is:

bimover GmbH
Hammer 19
5000 Aarau
Switzerland
UID: CHE-132.862.302
Email: support@bimover.ch

2. Scope of This Privacy Policy

This Privacy Policy covers what happens around the apps: our website at bimover.ch including subdomains, and the account, sign-in, licensing, payment, support and security data that goes with it. We aim to process only the data required to operate those.

What each app does with data is on the app’s own page. Every app has its own, because every app has its own exceptions, and a general policy that grows an app-specific paragraph every time an app ships is a policy nobody can read to the end.

App	What it does with data	Terms
Cloya	Cloya Privacy	Terms
Locus	Locus Privacy	Terms and the Locus Licence Terms
Filum	Filum Privacy	Terms
Cuolma	Cuolma Privacy	Apple’s standard EULA, see Terms 3.3
Vadum	Vadum Privacy	Terms

Where an app page and this policy could be read differently, the app page wins for that app. It is the more specific text and the one written for it.

For some apps the honest answer is “not us”. Filum writes its archive into storage the customer chooses and we never receive it; Cuolma and Vadum send us nothing at all. Where bimover is not the controller of what an app processes, the app’s own page says so and says who is.

3. Data We Process

Depending on your usage, we process the following categories of personal data:

Apple Sign in subject identifiers (SIWA subject) and email address (including Apple relay email, if used)
internal account identifier (usr_...)
licensing and entitlement records (license tier, grants, redeem/transfer code status, eligibility status, add-on download counters/timestamps)
payment/commerce records (transaction references, order status, line-item references, optional customer email, webhook reconciliation records)
security/session records (API session token hashes, device ID, optional device metadata, last-used timestamps, limited request metadata such as IP-derived network information for pricing/tax preview and fraud controls)
audit and operations records (request IDs, event logs, security-relevant events)
in-app notification preferences for the bimover app (see below)
what an app reports back about licensing and use, which differs per app and is set out on the app’s own page (see Section 2)

We do not build advertising profiles and we do not use analytics or marketing pixels on our website.

In-app notices (bimover app)

The bimover app can display notices from us inside the app: operational and security notices (always shown), product news and offers (both can be disabled in the app settings at any time, per category).

For this feature we store only your per-category choice (allow product news yes/no, allow offers yes/no) linked to your account. Which notices you have read is stored locally on your device only. We do not track reading behaviour on our servers, and we do not build profiles from this feature. Notices are delivered when the app fetches them; no marketing emails and no advertising push notifications are sent.

If you submit a feature request or vote on one in the app, we process the content you wrote, your vote and your account identifier. Submissions are reviewed before publication and are shown to other users without your name or email address; internally we keep the link to your account so we can inform you about the status and remove your submission on request. Legal basis: our legitimate interest in improving our products together with our customers (Article 6(1)(f) GDPR); submitting is entirely voluntary. Please don’t put personal data of others or confidential project information into a submission (see Terms §9.2).

We also process support ratings you choose to give: after a support ticket is solved you may rate it in the app (an overall score, or separate scores for solution, process and friendliness, plus an optional comment). Rating is voluntary, one rating per ticket, and is linked to your account and that ticket so we can improve our support. Please don’t put sensitive information into the free-text comment.

Legal basis: operational and security notices are processed for contract performance (Article 6(1)(b) GDPR); product news and offers to existing customers rely on our legitimate interest in informing customers about our own, similar products and services (Article 6(1)(f) GDPR and Swiss law incl. the Unfair Competition Act), always combined with the free, immediate opt-out in the app. Support ratings are processed on the basis of your voluntary submission and our legitimate interest in support quality (Article 6(1)(f) GDPR). Images shown in notices are hosted by us. No third-party servers are contacted from within the app. Your category choice is kept until you change it or your account is deleted.

What the apps themselves do

Every app has its own page, and those pages are listed in Section 2. This policy deliberately does not repeat them. An app changes, ships a feature, adds a data source — and a general policy that grows a paragraph each time is a policy nobody reads to the end, which helps no one.

So: for what an app collects, why, on what legal basis and for how long, read that app’s page. It is the complete answer for that app.

4. Cookies and Similar Technologies

Our website uses strictly necessary cookies for account login/session management:

Cookie	Purpose	Duration	Type
`bimover_web_session`	Keeps you logged in to your website account	Up to 30 days or until logout	Essential, first-party
`bimover_web_device`	Stable device identifier for secure web session issuance	Up to 365 days	Essential, first-party

These cookies are required to provide the login/account service requested by you. Cookie attributes used for these cookies include HttpOnly and SameSite=Lax; Secure is used on HTTPS/production.

We do not use analytics/marketing cookies.

If you use third-party login or checkout components (Apple, Microsoft, Payrexx), those providers may use their own technologies under their own policies.

We use Sign in with Apple and Sign in with Microsoft for website authentication and app authentication. Which of the two an app offers depends on the app. Filum signs in with Microsoft only, because the same sign-in also reaches the mailboxes it archives; there is no second login.

The same identity is used across website and supported apps. If you created your bimover account with Apple and later sign in with Microsoft, you link the two once in your account on bimover.ch, and both then lead to the same account.

When you sign in, we process:

the subject identifier issued by Apple or by Microsoft
email address (or Apple relay address)

We do not process passwords. Authentication is performed by Apple or by Microsoft.

When app login is started from a supported app, the website can issue a short-lived app-login claim token.

For this flow, we generate a short-lived token (default: 15 minutes), store only a hash of that token server-side, and complete app login after successful claim confirmation from the matching app bundle. The deep link payload contains technical claim context (for example bundle_id and a claim token).

Purpose:

sign the app into your existing website account identity
allow the app to retrieve the correct license and entitlement state

When you sign in with Microsoft, we process the identity token Microsoft issues and take from it the identifier Microsoft gives your account and your email address, in order to find or create your bimover account. Where the token names your Microsoft organisation, we process that identifier as well. We do not process passwords. Authentication is performed by Microsoft.

In Filum the same sign-in also authorises the app to read the mailbox folders you name, and what that means is set out in Filum Privacy. That mail travels between your device and Microsoft; it does not pass through us, and we never store it.

6. Licensing, Eligibility and Account Data

To operate licensing, we process:

account ID, app bundle ID, SIWA-linked identity records
license/entitlement state and hierarchy (for example trial/personal/professional)
redeem and transfer code lifecycle (unused/redeemed/revoked)
eligibility requests (for example educational eligibility), including token hash/hint and status data

This processing is required to enforce license rules, entitlement integrity, and anti-abuse controls.

Where an app is licensed by something it counts, we keep what the count is measured against. For Filum that is the mailbox hashes and run records, per billing recipient and licence year; see Filum Privacy.

7. Payments, Invoicing and Payrexx

We sell our subscriptions ourselves; bimover GmbH is the contracting party and issues the invoice. Card payments are processed by our payment service provider Payrexx AG (Switzerland), which processes payment method data on our behalf. Business customers may instead be invoiced.

From Payrexx transactions and webhooks, we may process and store:

transaction and subscription IDs and our own order references
status changes (including failed payments, refunds and chargebacks)
amount, currency and billing period
the business details you provide for invoicing (company, address, country, VAT ID where applicable)
webhook payload data required for reconciliation, accounting evidence, fraud prevention, and entitlement changes after a refund

We use this data to activate, renew, suspend and end subscriptions correctly, and to meet our bookkeeping obligations.

We never receive or store full card numbers or CVV. Those stay with the payment service provider.

Payrexx privacy policy: https://www.payrexx.com/en/privacy-policy/

8. Security, Session and Audit Logging

We process technical security/session data, including:

API token hashes (not plaintext token storage)
device/session metadata (device ID, optional device name/platform/version)
session usage/revocation timestamps
audit/security events with request identifiers

Error and audit logs may include operational request context (for example bundle ID, offer code, request ID, and status/error codes). Sensitive token/secret fields are redacted in structured error logging. Audit logs are used for security monitoring, incident handling, and legal defense.

We do not sell personal data.

Data may be shared with:

Apple (authentication, and app distribution through the App Store)
Microsoft (authentication; and, for Filum, the mailboxes the app reads on your instruction and with your own sign-in. That mail does not pass through us.)
Payrexx AG (payment processing on our behalf)
the timestamp service chosen for a Filum archive (SwissSign in Switzerland by default, or DFN in Germany), which receives a checksum of a run record and nothing else. That request goes from your machine, not from ours.
infrastructure/service providers required to operate our services (for example hosting/network delivery), under applicable confidentiality and data protection obligations
authorities or courts where legally required

10. International Transfers

Depending on provider infrastructure (for example Apple, Microsoft, hosting/network providers), data may be processed outside Switzerland/EU/EEA. Payment processing itself runs with a Swiss provider.

Where required, transfers are based on applicable legal transfer mechanisms and safeguards.

11. Data Retention

We retain data only as long as necessary for the stated purposes and legal obligations.

Typical retention logic:

web session cookie: up to 30 days
web device cookie: up to 365 days
app-login claim token validity: short-lived (default 15 minutes); expired/consumed tokens become unusable (related hashed records may remain until operational cleanup)
eligibility request token validity: limited lifetime (default 14 days unless resolved earlier); related request records may be retained for support, anti-abuse, and audit/legal needs
account/licensing/payment records: for contract execution, fraud/security controls, and legally required accounting/tax retention periods
audit logs: operational retention windows (default cleanup policy targets 6 months unless longer retention is required)
app licensing records, where an app is licensed by something it counts: kept per licence year as the basis of the invoice, and thereafter for as long as invoicing and the statutory accounting retention periods require. What each app reports is on its own page; for Filum, see Filum Privacy.

You may request deletion of your data at any time, unless retention is legally required. You can also delete your account yourself, in your account on this site or in the Cloya app: see Delete your bimover account.

12. Legal Basis for Processing

Under GDPR, processing is generally based on:

Article 6(1)(b) GDPR (contract performance)
Article 6(1)(c) GDPR (legal obligations, where applicable)
Article 6(1)(f) GDPR (legitimate interests: secure service operation, fraud prevention, entitlement integrity, and in-app product information to existing customers with opt-out)

Under Swiss law, processing is based on lawful purpose, proportionality, transparency and data security under the revised FADP (revDSG).

13. Your Rights

Depending on applicable law, you may have rights to:

access your data
rectification
deletion (you can do this yourself: see Delete your bimover account)
restriction or objection
data portability (where applicable)

Contact: support@bimover.ch

You may also contact the competent supervisory authority.

14. Changes to This Privacy Policy

We may update this Privacy Policy as our services evolve or legal requirements change.

The current version is always published on our website.