Privacy policy

ctrl-design Sàrl
Route de Derborence 29 — 1976 Aven — Valais, Switzerland
Company no.: CHE-231.340.102
Contact: contact@situ.ch

No Data Protection Officer (DPO) has been appointed. To exercise your rights, contact contact@situ.ch directly.

We only collect data necessary for the operation of the service:

• Email address — for 6-digit code authentication and service-related communications
• Project content — project name and number, imported plans (PDF/images), photos, comments, rooms concerned, and locations on plans (including viewing direction), dot colours and labels
• Profile and preferences — first name, last name, company name, logo, office address, business sector, interface language, PDF report layout, favourite dot colours
• Subscription and referral data — status, plan type, Stripe identifiers, usage counters (reports generated, estimated minutes saved), referral code and number of referrals
• Communication preferences — consent to commercial emails, email reminders before project expiry
• Technical data — IP addresses, access logs, device type, browser and version

To enable offline use, the application temporarily stores your projects, photos and plans in your browser (via IndexedDB) pending synchronisation. This data remains on your device and is under your exclusive control. It is synchronised with our servers upon reconnection and can be cleared by clearing the site data in your browser settings.

Payments are processed by Stripe (Stripe, Inc. / Stripe Payments Europe, Ltd.). SITU never stores your bank card data. Stripe collects the information required for payment (encrypted card number, billing address, optional VAT number for B2B purchases) directly and securely.

Stripe is PCI DSS Level 1 certified. For more information: stripe.com/privacy

SITU uses two types of cookies:

• Essential cookies (authentication) — required for the service to function, stored under the sb-*-auth-token prefixes. These cookies cannot be disabled without interrupting the service.
• Analytics cookies (PostHog) — we use PostHog (EU instance, eu.i.posthog.com) to measure and improve the service. PostHog collects anonymised browsing data: pages visited, interactions, in-app actions (e.g. session creation, report export). These cookies are placed with your consent, which you can withdraw at any time.

No advertising or third-party tracking cookies are used. Analytics data is not sold or shared with third parties.

Your data is processed for the following purposes:

• Authentication and account access — basis: performance of contract (Art. 6(1)(b) GDPR)
• PDF report generation and delivery — basis: performance of contract
• Data synchronisation across devices — basis: performance of contract
• Subscription management and billing — basis: performance of contract / legal obligation
• Service improvement (aggregated analytics) — basis: legitimate interest (Art. 6(1)(f) GDPR), subject to your consent for analytics cookies
• Commercial communications about SITU — basis: legitimate interest for active/former clients, with opt-in collected at first login and opt-out available at any time

If you agreed at your first login to the application, we may send you emails about SITU (updates, offers, tips). You can unsubscribe at any time by clicking the unsubscribe link in any email, or by writing to contact@situ.ch.

We never share your email address with third parties for marketing purposes.

SITU uses the following sub-processors, all GDPR-compliant:

• Supabase Inc. — database, file storage, authentication (Dublin, Ireland/EU) — supabase.com/privacy
• Stripe Inc. / Stripe Payments Europe Ltd. — payment processing — stripe.com/privacy
• Infomaniak Network SA — situ.ch hosting and transactional email delivery (Geneva, Switzerland) — infomaniak.com/en/cgv/privacy-policy
• PostHog Inc. — analytics (EU instance) — posthog.com/privacy
• Vercel Inc. — web server for app.situ.ch (United States) — vercel.com/legal/privacy-policy

No personal data is transferred outside the EU/EEA or Switzerland, except to Vercel which hosts the application code without processing users' personal data.

• Projects and associated files (plans, photos, ZIP folders) — 90 days after creation for drafts, or 30 days after folder delivery, then automatic and permanent deletion
• Folder download links — valid for 20 days
• Email address and account data — retained until deletion is requested
• Analytics data (PostHog) — 12 months, after which it is aggregated or deleted
• Billing data (Stripe) — retained in accordance with legal accounting obligations (10 years under Swiss law)

Your data is never sold to third parties.

Under the revised FADP and GDPR, you have the following rights:

• Right of access — obtain a copy of your personal data
• Right to rectification — correct inaccurate data
• Right to erasure — request deletion of your data
• Right to data portability — receive your data in a structured format
• Right to object — object to processing based on legitimate interest
• Right to withdraw consent — withdraw your consent at any time, without affecting the lawfulness of prior processing

To exercise these rights, write to contact@situ.ch. We will respond within 30 days.

You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC): edoeb.admin.ch

For any questions about the protection of your personal data:

ctrl-design Sàrl — contact@situ.ch
Route de Derborence 29 — 1976 Aven — Valais, Switzerland