Privacy Policy
This policy explains how Synoptic AG processes personal data under the Swiss nDSG and the EU GDPR.
Effective date: March 19, 2026
Who we are
Synoptic AG, Limmatstrasse 118, 8005 Zürich, c/o Joshua Larsch, is the data controller for this website and the TimberTrace service.
What data we collect and why
| Data | Purpose | Legal basis |
|---|---|---|
| Name, email, password (hashed) | User account creation and authentication | Contract performance |
| LiDAR point cloud files | Core service delivery and improvement of TimberTrace and related AI models | Contract performance; legitimate interest |
| Reconstruction results (parameters, STL files) | Providing output to the user and improving service quality/model performance | Contract performance; legitimate interest |
| Payment information | Billing and subscription management | Contract performance |
| Contact form submissions | Support and communication | Legitimate interest |
| Vercel Analytics events (pageviews, referrers) | Product and UX improvement | Legitimate interest |
| Sentry monitoring and session replay data (errors, performance, interaction events) | Incident diagnosis, security monitoring, and product reliability improvement | Legitimate interest |
Data storage and processors
| Processor | Location | Purpose |
|---|---|---|
| Supabase | EU region | Database and file storage |
| RunPod | United States | AI inference compute |
| Stripe | United States / global infrastructure | Payment processing |
| Vercel | United States / global infrastructure | Hosting and cookieless analytics |
| Sentry | EU and/or United States (depending on service routing/configuration) | Error monitoring, performance telemetry, and session replay |
Some processors are located outside Switzerland and/or the EU/EEA (including RunPod, Vercel, and Sentry depending on routing). In such cases, we rely on appropriate safeguards such as Standard Contractual Clauses (SCCs) or equivalent legal transfer mechanisms.
Retention periods
- Account data: retained while your account is active, plus 30 days after a deletion request.
- Point cloud files and reconstruction results: retained until you delete them or your account is closed.
- Payment records: retained for 10 years (Swiss accounting law, OR Art. 958f).
- Contact form data: deleted after resolution, with a maximum retention period of 12 months.
Your rights (GDPR + nDSG)
You may request to access, correct, delete, export, restrict, or object to processing of your data.
To exercise these rights, contact us at joshua.larsch@synoptic.vision.
Cookies and tracking
We use Vercel Analytics (cookieless) and Sentry monitoring tooling. Sentry may capture technical telemetry and interaction events (for example clicks, scroll depth, and cursor movement) to diagnose errors and improve reliability.
We do not use advertising cookies or cross-site marketing trackers.
Contact for data matters
For privacy-related requests and inquiries, contact joshua.larsch@synoptic.vision.