Privacy policy
Last updated: 14 October 2026
This English version is a translation. If it differs from the German version, the German version applies.
1. Who we are
The controller is Bark and Beauty AG, Moosstrasse 35, 8134 Adliswil, Switzerland (UID CHE-251.390.557). Please send questions about data protection to support@noodlebx.com.
This policy applies to the website www.noodlebx.com and to Noodle (Noodle Book, Chat, Card, Shop, Till, Plan, Stow, Sums and Data), insofar as we are responsible for personal data ourselves. It follows the Swiss Federal Act on Data Protection (FADP) and, where applicable, the EU General Data Protection Regulation (GDPR).
2. Two roles
- We are the controller for the data of visitors to this website and of our customers – the businesses that use Noodle – and their team members: account, subscription, invoices and support.
- We process data on behalf of a business when it records data about its own customers or its team in Noodle, for example appointments, messages, pet profiles, orders or working hours. The business is then the controller; we process this data only for it. Questions about it are best sent directly to the business; we forward requests.
3. What data we process and why
3.1 Visiting this website
The website is delivered through Amazon CloudFront from storage in Zurich. This involves technical data such as IP address, browser and time, which are needed to deliver it. We have not enabled access logs for this website and use no analytics or advertising tools. Fonts and images are hosted on our own server.
3.2 Cookies and browser storage
| Name | Type | Purpose | Duration |
|---|---|---|---|
| lang | Cookie | Stores your language when you change it with the language switcher. Only the language, no identifier. | 1 year |
| nbx-theme | Browser storage | Your choice of light or dark design. | until you delete it |
| Google reCAPTCHA cookies | Cookies | Protect the contact form from spam; only when you fill in the form (3.3). | as set by Google |
We don't use tracking or advertising cookies.
3.3 Contact form and email
When you write to us, we process your name, email address, business (optional), topic and message in order to answer your enquiry. The form is processed by a server in Zurich (AWS) and forwarded by email to our mailbox at Microsoft 365; emails you send us directly also arrive there. To protect against spam, Google reCAPTCHA v3 loads as soon as you start filling in the form; Google receives technical details such as your IP address and browser data. We keep enquiries for up to three years, unless they lead to a business relationship.
3.4 Account and subscription
For your account and subscription, we process your company name, billing address, UID, the names and email addresses of your team members, roles, and subscription and billing data. Card details are collected by Payrexx; we don't receive full card numbers. The purpose is to perform the contract, to bill and to provide support.
3.5 Using Noodle
- Activity log: who changed what and who opened which customer record, visible to the business's admins, for security and traceability. Retention: two years.
- Usage volumes such as team members, tills, employees in Noodle Plan, contacts, messages and AI requests, for billing and for the notices at 80% and 100%.
- Error reports to Sentry (EU), to find and fix errors.
- No analytics or advertising tools, neither on this website nor in the apps. On the page where admins connect a WhatsApp number, Meta's sign-in window loads; it may set Meta cookies.
3.6 AI features
Reply suggestions, summaries, photo analysis and the design of booking pages run on Amazon Bedrock, exclusively in data centres in the EU and Switzerland. The provider of the AI model receives no customer data, and according to AWS, inputs aren't used to train models. We make no automated individual decisions.
4. Providers that support us
| Provider | Purpose | Location |
|---|---|---|
| Amazon Web Services | Servers, database, files, outgoing email; this website | Zurich |
| Amazon Web Services | Emails sent to a business's Noodle inbox | Frankfurt |
| Amazon Web Services (Amazon Bedrock) | AI features | EU and Switzerland |
| Sentry | Error monitoring | EU (Germany) |
| Apple | Push notifications in the iPhone app | USA |
| The browser's push service | Push notifications in the web app (content encrypted) | depends on the browser |
| Payrexx | Payment of your Noodle subscription | Switzerland |
| reCAPTCHA on the contact form; map preview when someone sends a location in the chat | USA | |
| Microsoft (Microsoft 365) | Our email mailbox, including for the contact form | Europe (Microsoft EU Data Boundary) |
We give these providers only the data they need for their task. We don't sell personal data or pass it on for advertising.
5. Services a business connects itself
Some services are used by a business with its own account and under its own contract. Noodle transfers the necessary data to them so that the feature works; the service's own terms and privacy policy apply there.
- WhatsApp: Noodle Chat connects the business's own WhatsApp Business account on Meta's WhatsApp Business Platform. Messages are encrypted in transit between Noodle and Meta; Meta processes them outside Switzerland, including in the USA.
- Payrexx: customers' online payments run through the business's own Payrexx account, in Switzerland.
- Zapier: only if a business connects it itself. The data the business chooses for its automations then goes to Zapier in the USA.
- Swiss Post: for shipping labels in Noodle Shop, a business connects its own Swiss Post business account. Noodle sends the recipient's name and delivery address and the parcel's weight, in Switzerland.
6. Disclosure abroad
Some providers process data outside Switzerland. According to the Swiss Federal Council, the states of the EU and the EEA provide adequate data protection. For the USA: Google is certified under the Swiss-U.S. Data Privacy Framework, and Apple uses standard contractual clauses. The browsers' push services receive only encrypted content. For Meta and Zapier, the contracts a business concludes with them apply (5.).
7. How long we keep data
- Enquiries: up to three years, unless they lead to a business relationship.
- A business's account and usage data: until the end of the contract. You can get a copy of all your business's data by writing to support@noodlebx.com. After the contract ends, we delete the data within 30 days, unless we're required to keep it.
- Invoices and accounting records: ten years, as required by law.
- Activity log: two years.
8. Your rights
You can ask what data we hold about you and have incorrect data corrected. You can ask for it to be deleted, unless we're required to keep it, and ask for your data in a common format. You can object to processing, and you can withdraw your consent at any time. Write to support@noodlebx.com; we reply within 30 days. If you're a customer of a business that uses Noodle, it's best to contact the business directly.
9. Security
We transfer data encrypted (TLS 1.2 or 1.3) and store the database and files encrypted, with keys in AWS KMS. We control access through roles; the activity log shows changes and opened customer records.
10. Complaints
You can lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC): www.edoeb.admin.ch. If you live in the EU or the EEA, you can also contact the supervisory authority in your country.
11. Changes
We update this policy when our processing or the law changes. The version published here applies.