Privacy

Last updated: 28 October 2026

RewardKeep is made by Smitteck GmbH, a company registered in the Canton of Zurich, Switzerland (“we”). This notice explains what we store when you use rewardkeep.com and join the waiting list, and what the RewardKeep application does with your data once it is available. It is written to be read; if something is unclear, write to us at the address at the end.

1. The website

rewardkeep.com is served through Cloudflare and Google Cloud. Like any web server, they see the IP address and browser of each request and keep short-lived technical logs to run and protect the site. Cloudflare may set a strictly necessary security cookie. We do not run analytics or advertising scripts on RewardKeep pages, and we set no tracking cookies.

2. The waiting list

When you join the waiting list we store the e-mail address you enter, and, only if you choose to give them, your name, company, headcount band and country, and whether you would like to use RewardKeep at launch or help test it before. We also record the time, the version of the consent text you agreed to, a shortened hash of your IP address and your browser identifier, so that we can recognise abuse of the form. We use this to send you a confirmation link and, after you confirm, to tell you about the launch of RewardKeep. The legal basis is your consent (Swiss FADP; GDPR Art. 6(1)(a) where it applies).

Your entry is inactive until you click the confirmation link we e-mail you. An unconfirmed address receives nothing else. Every message we send carries a link that removes you from the list without a login; you can also ask us to delete your entry at any time. We keep your entry until you leave the list or ask for deletion, and we do not sell, rent or share it with anyone for their own purposes.

Messages come from no-reply@rewardkeep.com. The list is stored in Google Cloud Firestore and the confirmation is sent through our e-mail hosting provider; both act on our instructions under data processing terms. Google Cloud may process data in the United States under the Swiss and EU adequacy frameworks and standard contractual clauses.

3. The RewardKeep application

RewardKeep is a Windows application that runs on your own computer. The employee and salary data you analyse is read from files on your machine, computed there, and never uploaded to us or to anyone else. There is no account and no server that holds your figures. Saved analyses are encrypted on your computer with Windows’ own data protection, for your Windows user account only. Reports are produced and signed on your machine.

The application contacts rewardkeep.com only to check and activate your licence, to look for updates and updated legislation, to download content you ask for, and to send us feedback when you press Submit in its feedback box. Apart from feedback, those requests carry your licence key, a random identifier of your installation, the application version and, when you request or activate a licence, your e-mail address and company name — never employee data. Before it connects for the first time, the application shows you the full list of what it sends, and it sends nothing until you have closed that notice. It keeps working when the network is blocked.

When we deliver content that belongs to a paid licence, we record that it was delivered to your licence and when, to protect it against unlicensed copying. We keep that record for as long as you hold a licence and then up to 24 months. If you send an analysis to someone, the application encrypts the file on your computer; you send it yourself, and nothing is uploaded to us.

When you send feedback from the application, it sends the words you typed, the application’s version, the screen you sent it from and the application’s language — and nothing else: not your licence, your e-mail address, your company, your computer or anything from your analyses. We store the message with those three facts and the time, and nothing that identifies you or the address it came from, so we cannot reply to it. Before it is stored we check the text for details about a person or a client; if the check finds any, or cannot run, nothing is stored and the application tells you why. Only we read these messages; each one is also sent to us by e-mail, with the same facts and nothing more. We keep them for up to 24 months; the legal basis is our legitimate interest in improving the application (GDPR Art. 6(1)(f) where it applies).

4. Buying a licence

When licences go on sale, payment will be handled by Stripe, which receives your card details directly; we receive the company name, e-mail address and country you enter, and a record of the purchase, to issue and support your licence and to keep the accounts the law requires.

5. Signed-in access

If we give you access to a signed-in part of our website, what we store to run it is explained to you there, before you use it. To keep it closed, we log each sign-in attempt — the time, the e-mail address, the sign-in provider and whether it was admitted or refused — including attempts by people who have no access. We keep that log for up to 12 months; the legal basis is our legitimate interest in keeping access limited to the people we gave it to (GDPR Art. 6(1)(f) where it applies).

6. Your rights

You can ask what we hold about you, have it corrected or deleted, withdraw your consent, or object to a processing. Write to us and we answer within the statutory period. You may also complain to the Swiss Federal Data Protection and Information Commissioner or, where the GDPR applies to you, to your local supervisory authority.

7. Changes

When this notice changes we update the date at the top. A change that affects the waiting list is also mentioned in the next message we send to it.

8. Contact

Smitteck GmbH, Zurich, Switzerland. For privacy questions: privacy [at] rewardkeep [dot] com. See also the terms of use.