Privacy Policy

Effective date: March 6, 2026 | Last updated: March 6, 2026

Pausis GmbH ("Pausis", "we", "us") is a company registered in Switzerland. We operate the Pausis mobile application and website (pausis.com). This privacy policy explains what personal data we collect, why we collect it, how we use it, and your rights under the Swiss Federal Act on Data Protection (FADP) and the EU General Data Protection Regulation (GDPR).

1. Data Controller

Pausis GmbH
Switzerland
Email: support@pausis.com

2. Data We Collect

Category	Data	Purpose
Account	Name, email address, hashed password (or Apple/Google ID)	Account creation and authentication
Phone	Phone number (Player and Aniki)	OTP verification, SMS alerts to Aniki
Financial	Transaction metadata (merchant name, amount, date, category code) fetched via Open Banking (Tink)	Gambling incident detection
Incident	Flagged gambling transactions (merchant, amount, date, detection method)	Aniki alerts, streak calculation, audit trail
Activity	Heartbeat timestamps, last-seen time	Dead Man's Switch — detect inactivity for Aniki notification
Device	Push notification token (APNS)	Deliver push notifications
Connection	Encrypted Open Banking access/refresh tokens	Maintain bank connection for transaction monitoring

We do not collect or store your bank login credentials. Bank connections are established through Tink, a licensed Open Banking provider, using secure OAuth flows. We only receive transaction metadata — never your balance, account number, or full card details.

3. Legal Basis for Processing

Consent — You explicitly consent to gambling transaction monitoring when setting up the service. This consent can be withdrawn at any time.
Contract performance — Processing your data is necessary to deliver the Pausis service (account management, alerts, streak tracking).
Legitimate interest — Security measures, fraud prevention, and service reliability.

4. How We Use Your Data

Scan bank transactions for gambling-related activity (MCC codes and merchant analysis)
Send SMS alerts to your designated Aniki when incidents are detected
Send inactivity alerts to your Aniki when the Dead Man's Switch triggers
Track your clean-day streak
Deliver push notifications about your account status
Authenticate your identity (login, OTP verification)

We do not sell, rent, or share your personal data with advertisers or data brokers.

5. Third-Party Processors

Provider	Purpose	Data shared
Tink (Visa)	Open Banking — transaction access	OAuth tokens (encrypted at rest)
Twilio	SMS delivery	Aniki phone number, alert message text
Apple (APNS)	Push notifications	Device token, notification payload
Render	Backend hosting	All server-side data (encrypted in transit and at rest)

6. Data Retention

Account data — retained while your account is active.
Transaction metadata — processed in real-time for incident detection; raw transaction data is not stored long-term.
Gambling incidents — retained for the duration of your account for streak calculation and audit purposes.
Aniki data — retained while the player–Aniki link is active.

When you delete your account or revoke consent, we purge all associated personal data within 30 days, except where retention is required by law.

7. Data Security

All data is encrypted in transit (TLS) and at rest
Open Banking tokens are encrypted with AES-256 before storage
Authentication uses JWT with secure key management
Webhook endpoints are protected by HMAC signature verification
iOS session material is stored in the device Keychain

8. Your Rights

Under the FADP and GDPR, you have the right to:

Access — request a copy of all personal data we hold about you
Rectification — correct inaccurate data
Erasure — request deletion of your data ("right to be forgotten")
Data portability — receive your data in a machine-readable format
Withdraw consent — revoke monitoring consent at any time via the app (this will disconnect your bank and stop all monitoring)
Object — object to processing based on legitimate interest
Lodge a complaint — file a complaint with the Swiss FDPIC or your local EU data protection authority

To exercise any of these rights, email us at support@pausis.com.

9. Aniki Privacy

If you are an Aniki, we collect only your phone number. We use it exclusively to deliver SMS alerts related to the player who invited you. You will never see the player's bank balance, account details, or transaction history. You can request removal of your phone number at any time by contacting us.

10. Children

Pausis is not intended for use by anyone under the age of 18. We do not knowingly collect data from minors.

11. International Transfers

Your data may be processed outside Switzerland/EEA by our sub-processors (e.g. Twilio, Apple). Where this occurs, we ensure appropriate safeguards are in place, including standard contractual clauses.

12. Changes to This Policy

We may update this policy from time to time. Material changes will be communicated via the app or email. The "last updated" date at the top reflects the most recent revision.

13. Contact

For any questions about this privacy policy or your data:
Pausis GmbH
Email: support@pausis.com