01
What this capsule can contain
The Diaries capsule is a space for personal reflection and for continuing your story. You can record thoughts, experiences and feelings over time — and choose who will be able to read them, and when.
- Personal texts — reflections, thoughts, life stories
- Audio recordings — your voice over time
- Video — personal video memories
- Photos — images from your journey
- Timeline and dates — dated personal events
- References to other people — family, friends, people named or portrayed in the content
02
Data processed by Erabox
| Controller and processor | Erabox SA · Via delle Fornaci 6, 6826 Riva San Vitale (TI), Switzerland. Erabox is the controller for account, payment, security and delivery-event verification data, and for the Guardian’s data. For the content of this capsule and for Beneficiaries’ data, Erabox is the processor and acts on your behalf, following your instructions and the Data Processing Agreement (Art. 28 GDPR; Art. 9 FADP) |
| Data protection officer | Massimiliano Nicotra, attorney · privacy@erabox.ch |
| EU representative | Massimiliano Nicotra, attorney · privacy@erabox.ch |
| Owner’s data | Content you add (texts, audio, video, photos), dates and metadata linked to diary entries |
| Beneficiary’s data | Name, email or phone, date of birth, scheduled delivery method (if set). Erabox processes them on your behalf, as processor. If you choose to let the Beneficiary know, Erabox sends them a privacy notice on your behalf within one month of their designation; if you choose confidential mode, the notice is given to them at the time of delivery. In no case does the notice reveal the content to them before delivery |
| Third parties’ data | Names, descriptions or images of other people that you include in your diary content. See section 03 |
| Technical session data | IP address, user agent, session ID, UTC timestamp — processed for security purposes and as proof of consent (audit trail) |
| Purposes | Secure, organised storage of diary content; timed delivery to the Beneficiary (if set up); personal keeping with no delivery (if you set no delivery moment); security of the service and legal obligations |
| Legal basis | Storage and delivery: carried out by Erabox on your behalf, as processor, in performance of the contract you have entered into with Erabox and of the Data Processing Agreement (Art. 6(1)(b) GDPR; for Switzerland, Arts. 6 and 30–31 FADP). Special categories of data about you — health, sexual orientation, religious, philosophical or political beliefs, trade union membership: your explicit consent (Art. 9(2)(a) GDPR; Art. 6(7)(a) FADP). Your consent covers the data that concerns you and not that of other people: see section 03. Security, proof of consent and legal obligations: Art. 6(1)(c) and (f) GDPR |
| Capsule with no delivery moment | If you set no delivery moment, there is no Beneficiary and no content is delivered: Erabox keeps the capsule for you and the only purpose is storage, on the same contractual basis. If you later set a delivery moment, the rules for delivery apply. In this case too, Erabox processes the content on your behalf, as processor |
| Providing your data | Your email, password and the details of the Beneficiary you designate are required: without them, the capsule cannot be created or delivered. You choose the content of your diary: by its nature it is optional. Consent to special categories of data is optional: if you don’t give it, you can use the capsule for content that does not fall into those categories |
| Retention | Content: until delivery, for the duration of the subscription. If the subscription expires without renewal, there is a 30-day grace period, then the account is suspended in read-only mode for 12 months, then permanently deleted. If your death has been reported or confirmed by the Guardian, capsules already scheduled are not deleted for non-renewal and remain until delivery, up to a maximum of 10 years. After delivery, the content remains available for the 30 days the link is valid and is then deleted within 30 days. If you delete your account, the content is erased after 30 days. Access and data operation logs: 12 months. Billing data: 10 years under Swiss law |
| Access to content | Within your account, only you can see the content. The Beneficiary receives it once the moment you have chosen arrives. Content is encrypted at rest with keys managed by Erabox, whose systems access it when needed to store, process and deliver it. Erabox processes the content on your behalf and does not use it for its own purposes. Staff access is limited to maintenance, security and support operations, is allowed only to authorised staff and is logged |
| Security | AES-256 at rest · TLS 1.3 in transit · access logged and monitored |
| Automated decisions | Delivery linked to death takes place after the Guardian’s report or, with ‘after a long silence’, after their confirmation. Once the period of silence you have chosen has passed, Erabox sends you a reminder after 14 days and a second one after a further 7; if you do not log in within another 7 days, it contacts the Guardian. A 14-day safety window runs from the notice to the Guardian; logging in to the app before delivery stops the process. Delivery therefore always requires human involvement and is not a decision based solely on automated processing within the meaning of Art. 22 GDPR and Art. 21 FADP |
| Security breaches | If a data breach occurs that poses a high risk to your rights, Erabox tells you and notifies the competent authorities, under Arts. 33 and 34 GDPR and Art. 24 FADP |
| GDPR / FADP rights | Access, rectification, erasure, portability, restriction (Arts. 15–20 GDPR; for Switzerland, Art. 25 FADP for access, Art. 28 for the handover and transfer of data, Art. 32(1) and (2) for rectification and erasure). Objection to processing (Art. 21 GDPR). The FADP does not provide for a right to object in the same form, and allows people living in Switzerland to challenge processing carried out against their express wishes (Art. 30(2)(b) FADP). Write to privacy@erabox.ch. You can lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC) (Swiss users: edoeb.admin.ch) or with the supervisory authority in your country of residence (EU users). Full Privacy Policy → |
03
The people who appear in your content
A diary almost always talks about other people too. Those people have rights over their own data. The fact that you are the one writing does not cancel them.
- The content may concern people other than you and the person who will receive it.
- Those people have the right to know that their data is stored and to request access, rectification and erasure, under Art. 14 GDPR and Art. 19 FADP.
- Erabox publishes a notice for anyone who believes their data is stored in a capsule, at erabox.ch/en/third-party-privacy-notice, and provides a reporting channel at privacy@erabox.ch.
- By adding content that concerns other people, you undertake to do so with respect for their dignity and privacy. If one of those people contacts Erabox, Erabox will get in touch with you before taking any decision, unless the law requires otherwise.
- Special categories of data about other people. The consent you give covers the data that concerns you. If you write about a relative’s illness, a friend’s sexual orientation or a colleague’s faith, that consent does not cover that data: Art. 9(2)(a) GDPR requires the consent of the person the data relates to. Before writing about these aspects of someone else’s life, consider talking to the person concerned: they can ask for their data to be erased.
- The Beneficiary and the Guardian. You are the one who processes the Beneficiary’s data, and Erabox stores it and uses it for delivery on your behalf. If you choose to let them know, Erabox sends them the privacy notice on your behalf within one month of their designation; if you choose confidential mode, it gives it to them at the time of delivery. The Guardian, on the other hand, is informed by Erabox, which is the controller of their data: the invitation they receive contains the link to the privacy notice. They need to know they have been designated, because they are the person Erabox asks to confirm the event. No notice reveals the content of the capsule before delivery. The text of the notice is published at erabox.ch/en/third-party-privacy-notice.
04
Erabox’s role
Erabox is the controller for the data needed to run the service: registration and account, payments, security, verification of the delivery event, the Guardian’s data and legal obligations.
For the content you add to capsules and for Beneficiaries’ data, Erabox is the processor (Art. 28 GDPR; Art. 9 FADP): it stores and delivers them on your behalf, following your instructions and the Data Processing Agreement, without using them for its own purposes. You decide what to add, who to deliver it to and when, and you are responsible for those choices; Erabox is responsible for keeping it secure and delivering it correctly. If you add content for purely personal or household purposes, your processing falls under the exemption in Art. 2(2)(c) GDPR and Art. 2(2)(a) FADP; the rules of the Agreement still apply as terms of the service.
With regard to content, Erabox is a hosting service provider within the meaning of Regulation (EU) 2022/2065. It is not liable for what you store until it has actual knowledge of it; when it receives a report, it examines it and, if the content is illegal, acts without delay, giving reasons for the measure taken to the person who added the content.
If content reveals a danger to life. Erabox is not a psychological support service and does not monitor what you write. However, if it becomes aware, through a report or in any other way, of content suggesting a current danger to your life or to someone else’s, it informs the judicial or police authorities without delay, as required by Art. 18 of Regulation (EU) 2022/2065. This disclosure is based on Art. 6(1)(d) and Art. 9(2)(c) GDPR and, for Switzerland, on Art. 31(1) FADP. If you are going through a difficult time, please reach out for help: in Switzerland, Die Dargebotene Hand / La Main Tendue / Telefono Amico, 143; in the UK, Samaritans, 116 123; in Italy, Telefono Amico Italia, 02 2327 2327; in immediate danger, call 112.
05
After your death
The GDPR does not apply to the data of deceased persons and leaves the matter to individual states. For users in Italy, Article 2-terdecies of the Italian Data Protection Code applies: anyone who has an interest of their own, acts to protect the data subject or has family reasons deserving protection can exercise the rights that belong to you. You can prohibit this, in whole or in part, with a written declaration sent to privacy@erabox.ch. The prohibition does not affect the delivery you have scheduled.
06
What Erabox cannot do
Erabox keeps your diary safe and delivers it to the person you have chosen. It does not assess or moderate the content. The choices about what to write and who it is for remain yours.
- 1We do not check the content of your diary. It is you who decide what you write, record or add. You are responsible towards anyone who appears in it. Erabox is responsible for what falls to it as processor: storing the content securely and delivering it according to your instructions.
- 2Erabox is not liable for the emotional, psychological or relational impact that the content of the diary may have on the Beneficiary, because you choose that content and Erabox does not know it.
- 3The same applies to the consequences for relationships of sharing personal reflections about family, friends or colleagues.
- 4If your diary mentions, portrays or describes other people, it is up to you to respect their privacy and dignity. For their data, Erabox acts on your behalf: it forwards their requests to you and helps you respond, as described in section 03.
- 5We cannot guarantee that the Beneficiary will open or read the content once it has been delivered.
- 6If the Beneficiary details you have entered are wrong, delivery may not take place. Check them and keep them up to date from your profile.
- 7Erabox is not a counselling or psychological support service. If you are going through a difficult time, seek professional support. If content reveals a current danger to life, Erabox informs the authorities: see section 04.
- 8If there is a technical interruption of the service, Erabox refunds you on a pro rata basis the fees paid for the period concerned. Compensation for damage under Art. 82 GDPR and the rights the law grants you as a consumer remain unaffected.
The limitations of liability set out in this box and the indemnity commitments in section 07 do not apply in cases of intent or gross negligence on Erabox’s part, do not affect liability under Art. 82 GDPR, and do not apply within the mandatory limits laid down by consumer protection law (Art. 100 of the Swiss Code of Obligations; Italian Legislative Decree 206/2005 for users resident in Italy).
07
Your declaration
I have reached the age of 18 and have full legal capacity.
I am the author of the content added to this capsule and have the right to share it with the designated Beneficiary.
I have reflected on the impact this content could have on the Beneficiary and have consciously chosen to share it.
I have read section 03, and any references to other people in the diary content respect their privacy and dignity, or have been included in the exercise of a legitimate right.
I have checked that the Beneficiary’s details (name, email or phone) are correct and up to date.
If a third party brings a claim against Erabox over content I have added in breach of these declarations, I undertake to indemnify Erabox for the related costs and sums due. This undertaking does not apply in cases of intent or gross negligence on Erabox’s part, nor beyond the mandatory limits of consumer protection law.
Consent, optional. I consent to Erabox storing and delivering content that reveals special categories of data concerning me — health, sexual orientation, religious, philosophical or political beliefs, trade union membership (Art. 9(2)(a) GDPR; Art. 6(7)(a) FADP).
Erabox records this declaration with the session identifier, IP address and UTC timestamp in the capsule’s audit log. No handwritten signature is required.