Privacy policy

The public pages (home, documentation, capabilities, status, and these legal pages) require no account. BUMIT does not use advertising or third-party analytics on these pages. Fonts are loaded from Google Fonts.

The REST API is anonymous; no account or API key is required. Business identifiers are submitted in JSON request bodies and are used only to answer the request. Verification may look up authoritative external sources, such as the Swiss commercial register (Zefix), and may keep a stored copy of the public register record it receives. BUMIT also holds source datasets needed to answer checks, such as the sanctions list. Details of each source are in the documentation.

The MCP endpoint exposes one tool, verify_business, which runs the same verification path as the REST API. It requires no account. Each completed call records exactly one anonymous usage event (see below).

Each completed business verification records one usage event using a closed, predefined vocabulary (for example: input type, outcome, reason code, timestamp). The usage event does not record the submitted UID, business name, address, MCP client identity, session identity, IP address, or request headers.

Call counts are counts of calls; they are not counts of people or machines.

BUMIT keeps operational logs to run and protect the service. Its logging layer is designed to drop or scrub business identifiers, names, addresses, credentials, request bodies and caller identity before anything is written. The hosting infrastructure may process technical connection data to deliver requests.

Only BUMIT operators sign in, using an email address and password, to reach the administration console. Their email address and sign-in session are processed for that purpose. Public API and MCP use never requires sign-in.

No public contact address has been published yet. It will be listed on this page once available.