Privacy policy

Maijin Shield lets you entrust your Word, Excel, PowerPoint, PDF and XML documents to an artificial intelligence (ChatGPT, Claude, Copilot…) without handing over the personal or sensitive data they contain. This page describes exactly what we process, where, and for how long.

In short

• Your documents are analysed in Switzerland; the originals are never kept.
• So that you can get the real values back and download your anonymised documents again, we keep the mapping table between labels and real values and the anonymised version of each document, encrypted, for 90 days. You can delete them at any time.
• In a team, only the person who anonymised a document can get its real values back, for as long as they are part of the team; administrators see the anonymised name of the file, its date and its author, and choose which data to mask.
• A document submitted by email is processed in the same way, in Switzerland, and the email is deleted as soon as it has been processed. The attachment and the reply remain in your own mailbox.
• All our emails are sent from Infomaniak's email service, in Switzerland.
• The demo without an account keeps no document; its mapping tables stay in memory, encrypted, never in the database, and are deleted 1 hour after the last document uploaded.
• No trackers, no advertising cookies, no third-party analytics tools.
• To improve the tool, we measure how it is used (number of pages, types of data masked…), without ever recording the content of your documents.
• Payment for subscriptions goes through Stripe, which never receives a document.
• You can download your data, and have it corrected or deleted; we reply to any request within 30 days, and you can contact the Federal Data Protection and Information Commissioner (FDPIC).
• The browser extension checks a document on your computer before it goes to ChatGPT, Claude or another AI; it is only sent to Maijin Shield if you choose to anonymise it.

1. Who is responsible

Maijin Shield is published by Maijin Sàrl, Route de Saint-Julien 184, 1228 Plan-les-Ouates, Switzerland (CHE-300.778.667). Contact: contact@maijin.ch, +41 22 566 74 60.

Maijin Sàrl is the controller for the data of your account and your team (email addresses, sessions, invitations, settings), billing, usage statistics, the audit log, the site's forms and the demo without an account. For the personal data contained in the documents you process, in their mapping tables and in their anonymised versions, you (or your organisation) remain the controller; Maijin Sàrl acts as a processor, solely to carry out the anonymisation and the restoration of real values that you request. When an organisation uses Maijin Shield as a team, it decides who belongs to it and which data is masked.

The data processing agreement (Art. 9 FADP) applies to every subscription: it forms part of the terms and conditions and is accepted with them when you subscribe.

2. Your documents

The original document (Word, Excel, PowerPoint, PDF or XML) you upload is read in memory on our server in Switzerland, for the time it takes to analyse it and generate the anonymised document. It is never saved: not on disk, not in a database, not in our logs. The same applies to the document reworked by the AI that you upload to get the real values back. Only the anonymised version produced is kept, encrypted, in your workspace (section 3).

The data to be masked is identified in two steps:

• Fixed-format identifiers (AHV/OASI number, IBAN, email, phone, dates, postcodes): identified by deterministic rules, on our server.
• Contextual data (names, addresses, health data, opinions…): the text of the document is sent, over an encrypted connection, to language models hosted by Infomaniak in Switzerland (Infomaniak AI Tools), which return to us the list of passages to mask. The request contains neither the file name nor the identity of your account. According to Infomaniak, this data is neither kept nor used to train its models.

By email. You can also forward a document to your personal drop-off address (…@depot.maijinshield.ch). The email arrives in a mailbox of Infomaniak's Service Mail, in Switzerland; our server collects it immediately, processes its Word, Excel, PowerPoint, PDF and XML attachments in memory like an upload in the signed-in area, then deletes it permanently from the mailbox, whether or not it was processed; the mailbox's spam folder and bin are purged every hour. The text of the email is neither read nor kept; its subject is reused in the reply.

Only emails sent from your account's address and authenticated (DMARC, DKIM and SPF checks aligned with that address) are processed. The reply (the anonymised document, or the document with its real values) is sent by Infomaniak only to that address.

Your mailbox. The attachment you send and the reply you receive, including a restored document containing the real values, remain in your own mailbox, which is often hosted outside Switzerland (Microsoft 365, Gmail…), and are kept by your email provider according to its rules. Maijin has no control over it. If this is not acceptable for your documents, upload them in your signed-in area instead.

The browser extension

The Maijin Shield extension (Chrome, Edge) only acts on the AI sites it knows (ChatGPT, Claude, Gemini, Copilot, Le Chat, Perplexity, DeepSeek, Grok) and on maijinshield.ch. When you upload a file there, it reads it on your computer to spot personal data, before the site receives it. At this stage, nothing leaves your computer.

The file is only sent to Maijin Shield, in Switzerland, if you choose “Anonymise then send” or “Review first”; it is then processed exactly like a document uploaded to your workspace (original never stored, mapping table and anonymised version encrypted for 90 days, or nothing at all with permanent anonymisation). The “Review first” window is a maijinshield.ch page, never shown inside the AI site's page. Only the anonymised version is handed to the AI site you use; the real values are never sent to it.

The extension keeps in your browser the device key (which you can remove in your Settings), the email address and team name of the linked account, the language and your “Be able to restore the real values” choice. To measure its use, it sends us the decision taken (alert shown, anonymised, sent anyway, cancelled), the number of files and the number of items per category, never the content, the file name or the site. It reads neither your conversations nor what you type, except when you click “Get the real values back”: it then takes the selected text, or the AI's last answer containing labels, and sends it to Maijin Shield, in Switzerland, which shows it with the real values in its own window, never in the AI site's page. Nothing of it is kept. It does not collect your browsing history and passes no data to third parties.

3. The mapping table and the anonymised version (signed-in area)

To put the real values back into the document the AI returns to you, we keep, for each anonymised document, the mapping table that links each label (for example [PERSON_1]) to its real value, together with the name of the original file and that of the anonymised file. We also keep the anonymised version of the document (the one you give to the AI), so that you can download it again from your history; with permanent anonymisation, neither the table nor this version is kept. This information may contain sensitive personal data within the meaning of the FADP (for example health data).

• It is encrypted (AES-256-GCM), with a key kept outside the database: a copy of the database alone does not allow it to be read.
• It is attached to your account and is used only to give you back your values, when you upload a reworked document, to display your history and to hand you the anonymised version when you download it again.
• It is deleted automatically after 90 days (the period is set when the document is anonymised). You can delete a document (its table and its anonymised version) at any time from “My documents”, or delete everything by deleting your account.
• To recognise the original document automatically, we also keep a fingerprint of the anonymised text: a series of numbers calculated with a secret key, from which the text cannot be reconstructed.

Label register. The same value keeps the same label in all your documents, so that the AI can link documents that were anonymised separately; the numbering is shared across your team, so that a label refers to only one value within it. For this purpose we keep a register: each value is encrypted in it and looked up by a keyed fingerprint, never in clear. A label is deleted with the last document that uses it: a value can therefore remain stored beyond 90 days after it first appeared, if it is contained in a more recent document.

In a team. The anonymised document is attached to the team. For their colleagues' documents, administrators see only the anonymised name of the file, its date and its author's email address, and can delete them; they never see the real values. Only the person who anonymised a document can get its real values back and download its anonymised version again, and only for as long as they are a member of the team: a person removed from the team, or who leaves it, no longer has access. The documents they anonymised in a personal capacity, outside the team, remain theirs.

4. The demo without an account

The demo on the home page works like the signed-in area, without an account; Maijin Sàrl is the controller for this processing. As in the signed-in area, the text of the document is sent to Infomaniak's AI, in Switzerland: preferably use a fictitious or test document. The document is never kept. The mapping table is kept, encrypted, in the server's memory only (never in the database), and deleted 1 hour after the last document uploaded (the countdown restarts with each document); a server restart also erases it. It is linked to a technical cookie, “shield_demo”: random, HttpOnly, valid for 1 hour, sent only to the demo's addresses and strictly necessary to try getting the real values back.

To protect the service against abuse, your browser solves a small calculation (ALTCHA anti-bot, computed in your browser, with no third-party service) and the number of attempts is limited per IP address. That address is used only in memory, to apply that limit: it is never recorded. Each attempt leaves one line of statistics, made up of numbers and codes, with no content and no IP address.

5. Your account

Your account is opened by your team's administrator, who invites you, or by our team after a demo. We only need your email address: you sign in with a link received by email, without a password. This link is valid for 15 minutes and can be used only once. A session lasts 7 days; it is extended when you use the service (at most once a day) and ends when you sign out. We record neither the IP address nor the browser of your sessions. One strictly necessary cookie keeps you signed in; it serves no other purpose.

To apply the limits of your plan, we count the number of pages anonymised per month. This counter contains neither file names nor content.

Teams. If you create or join a team, we record its name, its members (email address and role: owner, administrator or member) and the invitations sent (invited address, author, date; valid for 7 days). Members of a team see the email addresses of the other members. The plan (chosen according to the number of members, pending invitations included), the month's page counter and the masking settings (the types of data to leave in clear) are those of the team.

Subscription. Payment is made on Stripe's secure page: your card details are entered with Stripe and never reach us. We receive from Stripe the status of your subscription (active, cancelled, due date) and a customer identifier. Stripe keeps the billing data (name, billing address, VAT number where applicable, email, payment history) to issue your invoices. Stripe also processes this data for its own obligations (fraud prevention, anti-money-laundering, legal obligations), as an independent controller: see its privacy policy (stripe.com/privacy).

6. Hosting, sub-processors and recipients

• Infomaniak Network SA (Rue Eugène-Marziano 25, 1227 Les Acacias, Geneva, Switzerland): hosting of the server, in Geneva, and of the database; language models for detection (AI Tools); email (Service Mail): the mailbox for email drop-off and the sending of all our emails (sign-in links, invitations, notifications, drop-off replies). All of this in Switzerland.
• Stripe Payments Europe, Ltd. (Ireland) and Stripe, LLC (United States): payment and invoicing for subscriptions. Stripe receives only the billing data described above, never a document or any data processed by the tool.
• The members of your team see the email addresses of the other members; what administrators see is described in section 3.

Disclosure of data abroad (Art. 16 FADP). Only billing data leaves Switzerland, to Stripe. Ireland is among the states whose legislation, according to the Federal Council, ensures an adequate level of protection. Stripe, LLC is certified under the Swiss-U.S. Data Privacy Framework, recognised as ensuring an adequate level of protection since 15 September 2024. No document and no data processed by the tool is disclosed abroad by Maijin (for your own mailbox, see section 2).

7. Retention periods

• Uploaded documents (originals): none (processed in memory only).
• Mapping tables, file names, fingerprints and anonymised versions of documents: 90 days, or less if you delete them; nothing with permanent anonymisation.
• Label register: until the last document that uses the label is deleted.
• Demo without an account: mapping tables in memory only, encrypted, deleted 1 hour after the last document uploaded; demo cookie: 1 hour.
• Emails received at your drop-off address: deleted from the mailbox as soon as they are processed; spam and bin purged every hour.
• Account: until it is deleted; sessions: 7 days, extended with use, or until you sign out; sign-in link: 15 minutes, single use.
• Team: until its owner deletes it; invitations: valid for 7 days, deleted within the hour after they are used, declined, cancelled or expire.
• Forms (contact, demo request, feedback): 12 months, then deleted.
• Usage statistics: attached to the account for 13 months, then detached; deleted after 25 months. Page views: 25 months.
• Audit log: 13 months.
• Backups: daily, on the server in Switzerland, deleted after 14 days. Deleted data therefore also disappears from the backups within that period. The mapping tables and anonymised versions remain encrypted there.
• Server technical logs: limited in volume (the oldest are overwritten), with no IP address, no headers and no URL parameters.
• Billing data (subscriptions): with Stripe, 10 years, the period required by Swiss law for accounting records (Art. 958f of the Swiss Code of Obligations, CO), including after the account is deleted.

8. Usage statistics

To improve the tool and adjust our plans, we record, on our server in Switzerland, the actions carried out with your account: sign-in, analysis, anonymisation and restoration of a document, deletion of a document, team activity (creation, invitation, joining, leaving), change of masking settings, subscribing to or changing a plan and cancellation (with the reason chosen from Stripe's list, never a free-text comment).

For each action, we keep only numbers and codes: the date, the format (Word, Excel, PowerPoint, PDF or XML), the number of pages and characters, the number of items masked by type (for example “3 names, 1 IBAN”), the number of corrections made in the preview, the processing time and, where applicable, the reason for a refusal (quota reached, unreadable file…). Never the content of a document, a file name or a detected value.

These statistics are attached to your account for 13 months, then detached from you; they are deleted after 25 months. If you delete your account, they are immediately and permanently detached from you. Only the Maijin team has access to them, in a password-protected internal dashboard.

We also count page views of the public site (the day, the page and the language), with no cookie, no IP address and no visitor identifier. Each attempt at the demo without an account leaves one line of statistics, with no content and no IP address.

9. Audit log

To ensure the traceability required by Art. 4 of the Data Protection Ordinance (DPO), we keep a log of operations on documents: who analysed, created, restored, viewed or deleted which document, when, and to which recipient the text was sent for detection (Infomaniak AI Tools). Each entry includes its author's email address, but never any content (no text, no file name, no value). The log is append-only and kept for 13 months; only the people responsible for security at Maijin have access to it.

10. Security

Encrypted connections (HTTPS), encrypted mapping tables and anonymised versions (AES-256-GCM), database not reachable from the Internet, firewall, server access by SSH key only and without “root” login, append-only audit log, checked daily backups with an alert in case of failure, technical logs without IP addresses, strict content security policy (your browser only communicates with our domain), size limits and checks on uploaded files. The details are on the Data security page.

11. Your rights

In accordance with the Federal Act on Data Protection (FADP, Arts 25 to 32) and, by alignment, the GDPR, you have the following rights:

• Access: to know whether we process data concerning you, which data, and to receive the information provided for by law.
• Delivery or transfer (Art. 28 FADP): to receive the data of your account in a commonly used electronic format, or to have it transferred to another controller. You download it yourself with the “Download my data” button in your Settings.
• Rectification: to have inaccurate data corrected. You change your settings and your team yourself; to change your account's email address, write to us.
• Erasure: delete each stored document (table and anonymised version) from “My documents”, leave a team, delete your account (with all its tables and anonymised versions) from your Settings, or ask us to do so. Only the billing data, the audit log and the backups remain, for their respective periods (section 7).
• Objection: to object to a processing of your data.

We reply to any request within 30 days. To check that it really comes from you, we may ask you to send it from your account's email address.

Data contained in a document. If your request concerns a document that an organisation (practice, employer, insurer…) has processed with Maijin Shield, that organisation is the controller for it: contact it directly. If you write to us, we forward your request to it when you ask us to, and we help it reply to you.

Complaint. You can also contact the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, www.edoeb.admin.ch.

To exercise your rights: contact@maijin.ch.

12. After anonymisation

The anonymised document that you then entrust to a third-party AI no longer contains the masked data. Use of that third-party assistant is your responsibility and subject to its own terms. Always review the preview before downloading: you can mask a forgotten item there.

13. Known limitation

Anonymisation greatly reduces the risk of identification, but there is no 100% guarantee: combining indirect data (for example a postcode, an age and a rare diagnosis) could in theory allow re-identification. The content of images (photos, scanned text) is not anonymised: you can choose to remove the images from the document. Mask generously when in doubt.

14. Changes

This policy may change as the tool evolves. The date of the last update appears at the top of this page.