Privacy
How we collect, use, store, share, and protect personal data on salvaagents.com and the Salva Agents platform.
Welcome to Salva Agents ("we", "us", or "our"). We are committed to protecting your personal data and respecting your privacy. This policy explains how we handle personal information when you visit salvaagents.com (the "Website"), use the Salva Agents platform at app.salvaagents.com (the "Platform", including the public discovery call booking pages), contact us, or engage our services.
Salva Agents is the trading name of Dörig Software Solutions, a Swiss sole proprietorship registered in the Swiss commercial register. Our core infrastructure is administered in Switzerland, and data processing complies with the Swiss Federal Act on Data Protection (nFADP, SR 235.1). Your workspace data is stored in Switzerland (Zurich region); some processing steps — for example relaying a message or generating an AI summary — run on our database provider's edge network, which may execute outside Switzerland (see Section 6).
In short:we never sell your personal data, we never share it for advertising or marketing purposes, and we disclose it only to the service providers who operate our infrastructure under contract, and where the law requires it.
The data controller responsible for your personal data is:
Dörig Software Solutions (trading as Salva Agents)
Owner: Yannis Dörig
Locarno, Switzerland — registered in the Swiss commercial register
Privacy contact:info@salvaagents.com
If you have any questions about how we handle your personal data, contact us atinfo@salvaagents.com.
We collect personal data you provide when you:
When you book a discovery call, this includes: your name, email address, business name, business type and approximate size, website or LinkedIn address (if provided), your chosen time slot, and the content of any message you include. After booking you may answer up to three optional preparation questions (what you would hand over first, what the work costs you today, and when you want someone in the seat). The answers are stored with your booking and shown to your host before the call. We send you a booking confirmation and, when the call was booked far enough ahead, a reminder the day before and one hour before it. These emails are sent in your host's name, and replies reach your host. If you reached the booking page through a link containing a referral code (for example from this Website or a partner), we store that code with your booking to understand where inquiries come from. Referral codes identify a source, not you.
Sales records. From your first booking until you become a client or the inquiry ends, we keep a record of the inquiry: the calls booked, moved or cancelled, the emails we sent you, the notes and facts your host writes down about your business and what you are looking for, the next step agreed with you, and the stage the inquiry is at. This record is visible to the host handling your inquiry, to the supervisor who prepares your assistant match, and to role-restricted internal staff. It is kept for two years from the last activity (see Section 7).
When you engage our services as a client, we collect the information required to deliver the service: business details, role requirements, time zone and communication preferences, and billing information. Content you and your agent create on the Platform — tasks, chat messages, voice notes, shared files, daily reports, calendar entries, Company Brain notes, and logged working hours — is processed to provide the service and remains visible inside your workspace only to you, your agent, and role-restricted internal staff.
Company Brain. Your workspace contains a knowledge base we call the Company Brain: notes about your business, tools, processes and contacts written by your agent or by you, together with a short summary, key facts and a list of open questions that our AI provider drafts from those notes (see Section 4a). AI may also propose new notes from your chat messages, call transcripts and public website; nothing proposed by AI is saved until you or your agent has reviewed and accepted it. Every change to a note keeps an earlier version, readable by role-restricted internal staff so that a mistaken edit can be restored. Our staff may keep separate internal notes about a pairing for supervision and coaching; those are not shown to you and are never fed into the summary, key facts or answers you can read. The Company Brain belongs to you: you can edit, verify and archive its shared notes at any time, and we export it to you on request (see Sections 7 and 8).
Supervision. Every agent pairing is assigned a Salva Agents supervisor. For quality assurance and coaching, the supervisor can view your workspace — chat, tasks, files, daily reports, and logged hours — and can write in the support threads of your organisation. Supervisors cannot write in your chat with your agent, change your settings, or see your billing details. Supervisors are bound by the same confidentiality obligations as our agents. In the first weeks of a pairing the supervisor asks you how it is going; your answers are stored with your workspace and used to coach your agent.
Billing. When you become a client we create a customer record with our payment provider, Stripe, containing your legal name, billing email address, billing address, tax identification number (where applicable), invoicing currency, and language. Card and bank-mandate details are entered on Stripe's own pages and are stored only by Stripe — we never see or store them. We keep a record of each payment received (amount, currency, invoice number, date) for our accounting.
Video calls on the Platform are provided through Whereby, an EU/EEA video service. Calls are not transcribed by default. For calls inside your workspace, transcription is enabled only after you switch on the corresponding consent setting in your workspace profile. Where transcription is enabled, the transcript is stored in your workspace and may be summarized by our AI provider into a call recap with suggested follow-ups (see Section 4a); transcripts and recaps are visible to you, your agent, and role-restricted internal staff.
Discovery calls. A discovery call booked on our booking pages is transcribed only if you tick the transcription box when booking, or if your host has asked you and recorded your agreement (your host's name and the time of that record are stored with the booking). You can turn transcription off at any time before the call starts, from the link in your confirmation email; the video room is then recreated without transcription, and a transcript that still reaches us for a call without consent is discarded. Transcription is in English. Where a discovery call is transcribed, our AI provider drafts from the transcript a short summary, facts about your business, the next step that was agreed, and a follow-up email (see Section 4a). Nothing an AI drafts is applied or sent until your host, the supervisor or an administrator has read and accepted it, and the transcript itself is visible only to them. The transcript and every draft that was not accepted are deleted 90 days after the call; what was accepted becomes part of your sales record (see Section 3.1).
Calls are not recorded by default. A recording only takes place when a call host manually starts it, and the video interface indicates an active recording to all participants. Recordings are stored with our video provider and handled under the same access restrictions as the rest of your workspace data.
You can optionally connect Telegram or WhatsApp to message your agent from your phone. Both channels are linked by you, from your phone, with a one-time code; we never contact a number or account you have not linked yourself. If you connect more than one channel, your agent's replies are delivered to every channel you connected as well as to your workspace chat.
Telegram. Linking through Telegram does not require your phone number. If you connect Telegram, we store your Telegram user ID and display name, and relay the messages, voice notes, and files you exchange with your agent into your workspace chat.
WhatsApp. WhatsApp identifies you by your phone number, so if you connect WhatsApp we store the phone number you linked and the profile name WhatsApp provides, and relay the messages, voice notes, and files you exchange with your agent into your workspace chat. Messages are transported by Twilio (our messaging provider) and Meta's WhatsApp Business Platform. WhatsApp allows a business to send free-form replies only within 24 hours of your last message; outside that window we can only send you a short, pre-approved notification that a new message is waiting in your workspace. Delivery reports from Twilio (for example, that a message could not be delivered) are processed so that we can detect failures. You can stop the channel at any time by disconnecting it in your workspace settings or by replying STOP on WhatsApp; a STOP is recorded and no further WhatsApp messages are sent to that number.
Messages sent through Telegram or WhatsApp are also subject to the privacy policy of that service.
You can optionally connect your Google account or your Microsoft account so that the calls and appointments scheduled in your Salva Agents workspace also appear in Google Calendar or in Outlook. This is a one-way sync from the Platform to your calendar provider: we never read, change, or delete anything you or others put in your calendars.
What we access. When you connect, Google asks you to grant our app the permission tomake secondary Google calendars and see, create, change, and delete events on them(calendar.app.created), plus your Google account email address (openid, email). With that permission our app creates a dedicated calendar named “SalvaAgents” in your Google account and writes only into that calendar. The permission does not cover your primary calendar or any other calendar, and we do not request access to them.
What we access (Outlook). When you connect a Microsoft account, Microsoft asks you to grant our app theCalendars.ReadWrite permission, which Microsoft describes as full access to your calendars, plus offline_access (so the sync keeps working while you are signed out) and your account email address (openid, email). Microsoft does not offer a narrower calendar permission limited to calendars an app created itself, so this permission is technically broader than what we use. Our app nevertheless behaves exactly as it does with Google: it creates a dedicated calendar named “SalvaAgents” in your Microsoft account, writes only into that calendar, and never reads, changes, or deletes anything in your other calendars. If you sign in with a work or school account, your organisation's administrator may need to approve the connection before it can be completed.
What we send to Google or Microsoft. For each event in your workspace: its title, description, start and end time, location, reminder setting, and a link back to the Platform. When an event is changed or cancelled in your workspace, the copy in your SalvaAgents calendar is updated or removed.
What we store. The email address of the connected Google or Microsoft account, the access credentials (OAuth tokens) the provider issues to our app, the identifier of the SalvaAgents calendar, and a record of which workspace event corresponds to which calendar event. The credentials are stored encrypted at rest in our Swiss (Zurich) database, are readable only by our server-side sync process, and are never exposed to your agent, to other users, or to your browser.
Disconnecting. You can disconnect at any time from your Platform profile. Disconnecting removes the SalvaAgents calendar together with the events we created in it and deletes the stored credentials; for Google we additionally revoke our access at Google. Nothing else in your Google or Microsoft account is touched. You can also withdraw access from the provider's side atmyaccount.google.com/permissions(Google),account.live.com/consent/Manage(personal Microsoft accounts) ormyapps.microsoft.com(work or school accounts).
Salva Agents' use and transfer of information received from Google APIs adheres to theGoogle API Services User Data Policy, including the Limited Use requirements. Data you place in Google Calendar or Outlook is also subject to Google's or Microsoft's own privacy policy.
When you apply to join Salva Agents as an executive assistant, we collect your full name, contact details, location, work experience, skills, time zone availability, payment method preferences, and government-issued ID information required for contractor onboarding.
Our hosting providers process technical data in server logs when you visit the Website or Platform (such as IP address, browser type, and pages requested) to deliver the service securely and reliably. To protect the public booking pages and sign-in against abuse, we additionally process short-lived, IP-derived rate-limiting records and failed sign-in counters; these are deleted automatically within days. The Website does not use analytics tools or set non-essential cookies — see Section 9.
| Purpose | Legal basis |
|---|---|
| Schedule, confirm, remind you of, and hold discovery calls, and keep the sales record of your inquiry | Pre-contractual necessity / legitimate interest |
| Respond to inquiries and provide requested information | Legitimate interest / pre-contractual necessity |
| Assess and process EA contractor applications | Pre-contractual necessity / consent |
| Deliver our managed EA services and operate the Platform | Performance of contract |
| Transcribe and summarize video calls (only with your consent — the setting in your workspace profile, or the box on the booking page) | Consent |
| Provide AI assistance features (voice-note transcription, task and calendar drafts, call recaps, drafts from a transcribed discovery call) | Performance of contract / legitimate interest |
| Process payments and manage billing | Performance of contract / legal obligation |
| Relay messages through Telegram or WhatsApp, and send a new-message notification on WhatsApp (only if you connected it) | Performance of contract / consent (by connecting) |
| Protect the service against abuse and unauthorized access | Legitimate interest / legal obligation |
| Monitor and improve service quality | Legitimate interest |
| Send service-related communications (confirmations, reminders, invoices, updates) | Performance of contract |
| Send marketing communications (only with consent) | Consent |
| Comply with legal and regulatory obligations | Legal obligation |
We never sell or rent your personal data, we never share it with third parties for advertising or marketing purposes, and we never use it for purposes unrelated to the delivery of our services.
Some Platform features are AI-assisted: transcribing voice notes, suggesting task and calendar drafts from messages, summarizing call transcripts into recaps, drafting a summary, facts, a next step and a follow-up email from a transcribed discovery call, proposing Company Brain notes from messages, calls and your public website, writing the Company Brain's summary and key facts from your shared notes, answering questions you ask the Company Brain, and assisting agents in their work. This processing is performed by our AI provider, Mistral AI (France, EU). AI outputs are drafts, summaries and answers — a human (you, your agent or, for a discovery call, your host) reviews and confirms anything that becomes a task, calendar entry, Company Brain note, sales note or email, and an answer always cites the notes it was drawn from. Internal supervision notes written by our staff are never provided to an AI feature whose output you can read. Content sent to our AI provider is processed solely to return the requested output; we do not permit it to be used for training AI models.
We do not sell or rent your personal data, and we never share it for advertising or marketing purposes. We share it only in the following limited circumstances:
We share relevant client data with the assigned EA contractor (and vice versa), only to the extent necessary to deliver the service. Both clients and contractors are bound by confidentiality agreements.
We use a small number of technology providers to operate our Website and Platform. They process data only on our documented instructions, under contracts requiring appropriate security measures, and have no right to use your data for their own purposes. Our current providers:
| Provider | Purpose | Location of processing |
|---|---|---|
| Supabase | Platform database, authentication, file storage & server functions | Data at rest: Switzerland (Zurich region). Server functions run on a global edge network (provider based in the USA) |
| Stripe | Payment processing, invoicing & saved payment methods for client billing | EU (Stripe Payments Europe Ltd, Ireland) with affiliates in the USA |
| Twilio | WhatsApp message relay & delivery reports — only if you choose to connect WhatsApp (see Section 3.4) | USA / EU (Twilio Inc. and Twilio Ireland Ltd) |
| Meta (WhatsApp Business Platform) | WhatsApp message transport — only if you choose to connect WhatsApp (see Section 3.4) | EU (WhatsApp Ireland Ltd) with affiliates in the USA |
| Vercel | Website & Platform hosting / content delivery | Global edge network (provider based in the USA) |
| Cloudflare | DNS & network services | Global network (provider based in the USA) |
| Whereby | Video calls, call transcription & recording | EU/EEA (provider based in Norway) |
| Mistral AI | AI features (transcription, drafts, summaries) | European Union (provider based in France) |
| Resend | Transactional email (booking confirmations and reminders, emails from your host, account emails) | Provider based in the USA |
| Telegram | Optional messaging channel — only if you choose to connect it | Telegram's global infrastructure |
| Google Workspace | Business email | EU / USA |
| Google (Google Calendar API) | Optional one-way calendar sync into a dedicated calendar in your own Google account — only if you choose to connect it (see Section 3.5) | Global (provider based in the USA) |
| Microsoft (Microsoft Graph / Outlook calendar API) | Optional one-way calendar sync into a dedicated calendar in your own Microsoft account — only if you choose to connect it (see Section 3.5) | Global (provider based in the USA) |
Optional channels and integrations (Telegram, WhatsApp, Google Calendar, Outlook) only ever process your data if you choose to enable them. When we add a provider, we update this list before the feature is activated.
We may disclose your data where required by law, court order, or regulatory authority. Where legally permitted, we will notify you before such disclosure.
In the event of a merger, acquisition, or restructuring of our business (for example, transfer of the service into a Swiss company), your data may be transferred as part of that transaction under the same protections. You will be notified prior to any such transfer.
Salva Agents operates across Switzerland and the Philippines and serves clients globally. Your personal data may be transferred to, stored in, or processed in countries outside your own. Transfers to EU/EEA countries rely on Switzerland's recognition of their adequate level of data protection. Where data is transferred to countries without a general adequacy determination under the nFADP — including the Philippines and, for certain providers, the USA — we ensure appropriate safeguards are in place, such as Standard Contractual Clauses (SCCs) recognised under Swiss law, certification under applicable data privacy frameworks, or equivalent contractual protections. For providers established in the USA we rely, where the provider is certified, on the Swiss-US Data Privacy Framework (recognised by the Swiss Federal Council as providing adequate protection since 15 September 2024), and otherwise on SCCs.
EA contractor data processed in the Philippines is subject to both Swiss data protection standards and the Philippine Data Privacy Act of 2012 (Republic Act No. 10173), and is transferred only under appropriate contractual safeguards.
We retain personal data only for as long as necessary for the purposes described in this policy, or as required by law.
| Data type | Retention period |
|---|---|
| Website inquiry / contact data | 2 years from last contact |
| Prospect and sales records (no engagement): bookings, preparation answers, notes, facts, emails sent | 2 years from the last activity |
| Discovery call transcripts and the AI drafts made from them | 90 days after the call; facts, notes and next steps your host accepted remain in the sales record |
| Sample desk (a demonstration workspace your host prepares for you, opened from a private link) | Up to 14 days from the day it is prepared, or 7 days from the moment you first open it (your host can extend it once), then erased. It holds your first name and your business name on a temporary login, together with invented example data. Nothing you type there is kept |
| Client workspace data (tasks, chat, files, reports, calendar, Company Brain, logged hours) | 90 days after the engagement ends, then deleted — earlier on request. An export of your Company Brain and workspace content is available on request before deletion |
| Client account and billing records | 10 years (Swiss financial records law); the reference to your organisation is removed once the workspace is deleted |
| Client call transcripts, recaps & recordings | Part of your workspace data; deleted earlier on request |
| EA contractor application data (not placed) | 1 year from application date |
| EA contractor engagement data | 7 years after the contract ends |
| Payment and billing records | 10 years (Swiss financial records law) |
| Google Calendar or Outlook connection (credentials & sync records) | Until you disconnect or your account is closed; credentials are deleted immediately on disconnect (and, for Google, revoked) |
| Telegram or WhatsApp connection | Until you disconnect or send STOP; the link is removed immediately, relayed messages remain part of your workspace data |
| Stripe customer record | For the duration of the engagement; payment records as above (10 years) |
| Rate-limiting and sign-in protection records | Deleted automatically within days |
| Marketing consent records | Until consent withdrawn + 1 year |
After the applicable retention period, data is securely deleted or anonymized.
Depending on your location, you may have the following rights regarding your personal data:
To exercise any of these rights, contact us atinfo@salvaagents.com. We will respond within thirty (30) days. If you are dissatisfied with our response, you may contact the Swiss Federal Data Protection and Information Commissioner (FDPIC) or the data protection authority in your jurisdiction, and you retain the right to pursue civil remedies before the courts.
Website (salvaagents.com): the Website does not set analytics, functional, or marketing cookies, and no cookie consent banner is required for browsing it today. Strictly necessary technical mechanisms (such as security handling by our hosting provider) may be used; these do not require consent.
Platform (app.salvaagents.com): the Platform stores strictly necessary data in your browser (such as your sign-in session and interface preferences like your theme choice) to function. This storage is not used for tracking, advertising, or analytics, and is not shared with anyone.
If we introduce non-essential cookies in the future (for example, privacy-respecting analytics), we will ask for your consent through a cookie banner before placing them, and you will be able to manage or withdraw your preferences at any time. We do not and will not use cookies to collect sensitive personal data.
Third-party content: the Website loads no resources from third parties — typefaces, scripts and images are served from our own domain. The Website and Platform are delivered through Vercel's content delivery network, and video calls are delivered through Whereby's infrastructure when you join a call.
We take the security of your personal data seriously. Our infrastructure is operated by Dörig Software Solutions (Switzerland) and maintained with appropriate technical and organizational measures, including:
No method of transmission over the internet is completely secure. While we use commercially reasonable measures to protect your data, we cannot guarantee absolute security. In the event of a data breach likely to result in a high risk to your rights, we will notify you and the relevant authorities as required by law.
Our Website and services are intended for adults (18 years and over) operating in a professional or business context. We do not knowingly collect personal data from anyone under 18. If we become aware that we have inadvertently collected such data, we will delete it promptly. If you believe a minor has provided us with personal data, contactinfo@salvaagents.com.
Our Website may contain links to third-party websites or platforms. This policy applies only to salvaagents.com and the Salva Agents Platform. We are not responsible for the privacy practices of third-party sites and encourage you to review their policies before providing personal data.
We may update this policy from time to time to reflect changes in our practices, technology, or legal requirements. When we make material changes, we will update the "Last updated" date at the top of this page; active clients and contractors will additionally be notified by email before material changes take effect. We encourage you to review this policy periodically.
For any questions, requests, or concerns relating to this policy or our data practices:
Dörig Software Solutions (trading as Salva Agents)
Locarno, Switzerland
Email: info@salvaagents.com
We will acknowledge your request within 5 business days and provide a full response within 30 days.