01
Data controller
The controller is Erabox SA, Via delle Fornaci 6, 6826 Riva San Vitale (TI), Switzerland.
As a Swiss company offering services to users in the European Union, Erabox is subject both to the GDPR (Regulation (EU) 2016/679) and to the Swiss Federal Act on Data Protection (FADP, in force since September 2023). Where the two sets of rules conflict, we apply the standard that offers the user the most protection.
| Aspect | GDPR (EU) | FADP (Switzerland) |
|---|---|---|
| Scope | Users resident in the EU/EEA | Swiss users + processing in Switzerland |
| Main legal basis | Art. 6 GDPR | Art. 6 FADP (principles); Art. 31 FADP (justifications, where required) |
| Right of access | Art. 15 GDPR | Art. 25 FADP |
| Erasure | Art. 17 GDPR | Art. 32(2)(c) FADP |
| Supervisory authority | Authority of the country of residence | FDPIC (Federal Commissioner) |
Erabox processes personal data in two distinct roles.
As controller, Erabox determines the purposes and means of the processing needed to run the service: registration and account, subscriptions and payments, security and access logs, support, identity verification and electronic signature, verification of the event that sets off delivery, Guardians’ data, service communications, analytics and marketing subject to consent, and legal obligations. This Privacy Policy covers this processing.
As processor (Art. 28 GDPR; Art. 9 FADP) Erabox keeps and delivers, on your behalf and in accordance with your instructions, the content you place in your capsules and the data of the Beneficiaries you designate, including the data of people who appear in that content. You decide what content to include, who receives it, when and how; Erabox does not use it for its own purposes. This relationship is governed by the Data Processing Agreement, which you accept when you create your account.
When you add content for purely personal or household purposes, the processing you carry out falls within the exemption in Art. 2(2)(c) GDPR and Art. 2(2)(a) FADP. The rules of the Agreement nonetheless apply in all cases as conditions of the service that Erabox undertakes to respect.
For any request about your data: privacy@erabox.ch
Address: Via delle Fornaci 6, 6826 Riva San Vitale (TI), Switzerland
02
Types of data collected
First name and surname, email address, password (encrypted), country of residence, date of registration, registration method (email or social login).
Content created (text, audio, video, images), Beneficiary data entered by the user, delivery settings, access logs.
IP address (anonymised in analytics), device type, operating system, app version, cookies and session identifiers.
Handled exclusively by Stripe Inc. through tokenisation. Erabox never stores your full credit card number.
Beneficiaries’ data. You process this data as controller; Erabox keeps it and uses it for delivery as processor, in accordance with your instructions (section 01). If you choose the option in which the Beneficiary is informed in advance, Erabox sends them the privacy notice on your behalf within one month of their designation. If you choose the private option, Erabox provides the privacy notice at the time of delivery, together with the content.
Guardians’ data. Erabox processes this data as controller, because it is needed to verify the event that sets off delivery. The invitation Erabox sends to the Guardian contains a link to the privacy notice about how their data is processed. The legal basis is the legitimate interest of Erabox and of the Owner in reliable verification of the event (Art. 6(1)(f) GDPR).
The third-party privacy notice is published and can be read without an account.
03
Special category data and advance healthcare directives
Advance healthcare directives (in Switzerland, living wills) are documents in which you set out your wishes about medical treatment in case you are unable to decide for yourself. These documents may contain information about your health and therefore fall into the ‘special categories’ of data under Art. 9 GDPR.
For advance healthcare directives:
- Erabox keeps and delivers your advance healthcare directives on your behalf, as processor (section 01). Before you add them, Erabox nevertheless asks for your separate explicit consent (Art. 9(2)(a) GDPR; Art. 6(7)(a) FADP), which also covers the processing Erabox carries out as controller, such as linking the advance healthcare directive capsule to your account
- The documents are encrypted at rest with AES-256 and protected in transit with TLS 1.3. Access to the systems is restricted to authorised staff and is logged
- We do not use this data for any secondary purpose (analytics, marketing, AI training)
- You can withdraw your consent and delete your advance healthcare directive documents at any time
Legal notice: Erabox is a platform for keeping and delivering content securely, not a legal service. Whether an advance healthcare directive is legally valid depends on the law of the user’s country. An advance healthcare directive capsule on Erabox does not have the form required by Art. 4(6) of Italian Law No. 219 of 22 December 2017, nor that of Art. 371 of the Swiss Civil Code, and it is not registered in the Italian national database of advance healthcare directives (Italian Ministry of Health Decree No. 168 of 10 December 2019). We always recommend seeking legal advice.
04
Purposes of processing
| Purposes | Data involved | Legal basis | Retention |
|---|---|---|---|
| Providing the service (account, capsules, delivery settings) | Registration, content, delivery settings | Performance of a contract — Art. 6(1)(b) (for capsule content, Erabox acts as processor) | See section 09 |
| Managing payments and subscriptions | Email, Stripe data, transaction history | Performance of a contract — Art. 6(1)(b) | 10 years (tax obligation) |
| Security and fraud prevention | Access logs, IP, device fingerprint | Legitimate interest — Art. 6(1)(f) | 12 months |
| Analysing and improving the service | Aggregated usage data (Firebase/GA) | Consent — Art. 6(1)(a) | 26 months |
| Service communications (transactional) | Performance of a contract — Art. 6(1)(b) | Duration of the account | |
| Marketing and newsletter | Consent — Art. 6(1)(a) | Until consent is withdrawn | |
| Managing advance healthcare directives and other advance documents | Health documents, medical wishes | Explicit consent — Art. 9(2)(a) (keeping and delivery carried out as processor) | See section 09 |
| Verifying the event that sets off delivery | Guardian’s data, account login dates, reminders, reports and confirmations | Legitimate interest — Art. 6(1)(f) | See section 09 |
05
Integrated third-party services
Erabox integrates selected third-party services to ensure the platform works properly, stays secure and can grow. All providers have been selected on the basis of GDPR compliance and respect for personal data.
| Provider | Purpose | Location | Transfer safeguard | Privacy |
|---|---|---|---|---|
| Firebase / Google | Database, authentication, mobile analytics | USA | Data Privacy Framework (EU Decision 2023/1795; Swiss-U.S. DPF) and SCCs (Decision 2021/914) | ↗ |
| Stripe Inc. | Payments and subscriptions | USA | Data Privacy Framework (EU Decision 2023/1795; Swiss-U.S. DPF) | ↗ |
| Euronovate | Identity verification and simple electronic signature (SES) | Switzerland | Adequacy (Decision 2000/518/EC) | ↗ |
| Crisp / Crisp IM | Customer support chat | France (EU) | Within the EU | ↗ |
| Brevo (formerly Sendinblue) | Transactional emails and newsletter | France (EU) | Within the EU | ↗ |
| Apple App Store | iOS app distribution, in-app purchases | USA | Data Privacy Framework (EU Decision 2023/1795; Swiss-U.S. DPF) | ↗ |
| Google Play Store | Android app distribution | USA | Data Privacy Framework (EU Decision 2023/1795; Swiss-U.S. DPF) and SCCs (Decision 2021/914) | ↗ |
06
How data is handled after death
The GDPR does not apply to deceased persons, but Erabox — as a platform created to manage messages and content intended for the future — has adopted a specific policy for handling data after death, inspired by Art. 2-terdecies of the Italian Personal Data Protection Code (Legislative Decree 196/2003) and extended by analogy to Swiss users.
Legal heirs may request access to, modification of or erasure of the deceased user’s data, provided this does not conflict with wishes the user expressed before their death or with applicable law.
The Guardian you designate never has access to your account: their role is to report or confirm the event that sets off delivery. If you wish, you can allow them to view the content of one or more capsules in read-only mode; this visibility lasts as long as they remain your Guardian and you keep the permission active, and you can revoke it at any time. Every access is logged.
You can also prohibit, by means of a written statement sent to privacy@erabox.ch, others from exercising the rights over your data after your death (Art. 2-terdecies of Legislative Decree 196/2003). This prohibition does not prevent the delivery you have scheduled.
Capsules linked to your death are delivered to the Beneficiaries after the Guardian reports it or, with the ‘after a long silence’ option, after the Guardian confirms it. With the ‘after a long silence’ option, once the period you chose has passed, Erabox sends you a first reminder after 14 days and a second one 7 days later; if you do not log in within a further 7 days, Erabox contacts the Guardian, who must confirm. A 14-day safety window runs from the time the Guardian is contacted. Logging in to the app before delivery stops the procedure.
Delivery always requires the involvement of a person, the Guardian, and is never decided solely by an automated system (Art. 22 GDPR; Art. 21 FADP).
If the death is reported or confirmed by the Guardian, capsules that have already been scheduled are not deleted because the subscription has not been renewed: they are kept until they are delivered, for a maximum of 10 years. Not renewing the subscription does not amount to a wish to delete a capsule prepared to be received in the future.
07
Your rights
As a data subject, you have clear rights that you can act on. You can exercise them by writing to privacy@erabox.ch — we will reply within 30 days (GDPR, Art. 12) or within the time limits set by the FADP.
For capsule content and Beneficiaries’ data, which Erabox processes as processor, Erabox forwards the request to the user who entered them and assists them in responding. If the user has died or does not respond, Erabox examines the request directly.
| Right | GDPR | FADP | How to exercise it |
|---|---|---|---|
| Access to data | Art. 15 | Art. 25 | Email privacy@erabox.ch with the subject ‘Right of access’ |
| Rectification | Art. 16 | Art. 32(1) | Directly from your Profile or by email |
| Erasure (‘right to be forgotten’) | Art. 17 | Art. 32(2)(c) | ‘Delete account’ button in Profile → Privacy, or by email |
| Restriction of processing | Art. 18 | Art. 32(2)(a) | Email privacy@erabox.ch |
| Portability | Art. 20 | Art. 28 | Data export available in Profile → Privacy |
| Objection | Art. 21 | Art. 30(2)(b) | Email privacy@erabox.ch |
| Withdrawal of consent | Art. 7(3) | Art. 30(2)(b) | Profile → Privacy, or by email |
| Complaint to the authority | Art. 77 | Art. 49 (report to the FDPIC) | EU authority of your country of residence, or the FDPIC |
08
International data transfers
Some service providers (Firebase, Stripe, Apple, Google) are based in the United States. Data transfers to countries outside the EU take place in compliance with the GDPR by means of:
- EU-U.S. Data Privacy Framework, recognised as adequate by Commission Implementing Decision (EU) 2023/1795 of 10 July 2023, for US providers that participate in it
- Standard Contractual Clauses (SCCs) approved by the European Commission in Implementing Decision (EU) 2021/914, for transfers not covered by an adequacy decision
For data processed under the FADP, transfers to certified US providers take place under the Swiss-U.S. Data Privacy Framework, which the Federal Council has recognised as providing an adequate level of protection with effect from 15 September 2024 (Art. 16(1) FADP and Annex 1 of the Swiss Data Protection Ordinance); in other cases, by means of standard data protection clauses recognised by the FDPIC (Art. 16(2)(d) FADP).
Switzerland is considered an adequate country by the European Commission (Decision 2000/518/EC, confirmed by Commission report COM(2024) 7 final of 15 January 2024). From Switzerland to EU Member States, data flows on the basis of Art. 16(1) FADP and Annex 1 of the Swiss Data Protection Ordinance. Transfers between Switzerland and the EU therefore take place without additional measures.
09
Retention period
| Data category | Retention period | Reason |
|---|---|---|
| Account data (user profile) | For the duration of the subscription. If the subscription expires without renewal: a 30-day grace period, then the account is suspended in read-only mode for 12 months, then permanently deleted | Managing the relationship, withdrawals and disputes |
| Content (capsules, messages) | Until delivery, for the duration of the subscription. If the subscription expires without renewal: a 30-day grace period, then 12 months in read-only mode, then permanent deletion | Carrying out the user’s instructions (Erabox as processor) |
| Scheduled capsules, after the Owner’s death has been reported or confirmed by the Guardian | Until delivery, even if the subscription is not renewed, for a maximum of 10 years. | Carrying out the Owner’s instructions |
| Delivered content | For the 30 days during which the delivery link is valid, then deleted within 30 days | Beneficiary’s access to the content |
| Beneficiaries’ data | Same as the capsule they relate to; deleted within 30 days if the Owner removes them | Carrying out the Owner’s instructions |
| Guardians’ data | Until the designation is revoked or the Owner’s account is closed, then deleted within 30 days | Verifying the event that sets off delivery |
| Account deleted by the user | 30 days to change your mind, then permanent deletion | Grace period |
| Payment data (Stripe) | 10 years | Swiss tax and accounting obligation (Art. 958f CO) |
| Access and security logs | 12 months | Fraud detection and security |
| Logs of data operations and of staff access | 12 months, kept separate from the systems in which the data is processed | Logging (Art. 4 of the Swiss Data Protection Ordinance); security (Art. 32 GDPR) |
| Analytics data (GA, Firebase) | 26 months (GA4 default setting) | Improving the service |
| Support emails | 36 months | Traceability of requests and disputes |
| Advance healthcare directives / health data | Same as capsule content; if consent is withdrawn, deleted within 30 days | Carrying out the user’s instructions |
10
Security and DPIA
All user content is encrypted at rest with AES-256. Data in transit is protected with TLS 1.3. The encryption keys are managed by Erabox: Erabox’s systems access the content when needed to keep, process and deliver it.
Access to content is restricted to authorised staff only, for maintenance, security and support, and is logged.
Annual penetration tests. Continuous vulnerability monitoring. In the event of a data breach, the authority is notified within 72 hours (Art. 33 GDPR).
Erabox has carried out a Data Protection Impact Assessment (Art. 35 GDPR) because it processes sensitive data (advance healthcare directives). DPIA completed on: 26 August 2026.
11
App Store, Google Play and mobile devices
Erabox is available on the App Store (iOS) and Google Play (Android). Both platforms require specific privacy information:
On the App Store listing you will find a full summary of the data collected, according to Apple’s classification. The categories declared include: contact info, identifiers, usage data and diagnostics.
The Google Play listing includes a ‘Data safety’ section detailing collection, sharing and security practices.
Before activating Firebase Analytics, we ask for your consent in the app. On iOS, this is followed by the ATT (App Tracking Transparency) prompt required by Apple’s guidelines.
You can delete your account directly from the app, without having to visit the website. The button is in Profile → Privacy → Delete account.
12
Changes to this Privacy Policy
We may update this Privacy Policy following regulatory or technological changes, or changes to the service we offer. Changes are communicated as follows:
- Material changes: notification email at least 30 days in advance + in-app notice
- Minor changes: the date at the top of this page is updated
The latest version is always available at erabox.ch/en/privacy-policy. If you continue to use the service after the date on which the changes take effect, you accept the new version.
For any questions about this Privacy Policy: privacy@erabox.ch