Terms and privacy.

01Purposes of processing

Your data is processed for the following purposes:

• Meeting our legal and contractual obligations.
• Creating and managing your user accounts.
• Enabling reports and analyses to be produced, stored and shared.
• Ensuring the security, maintenance and continuous improvement of the service.
• Informing you of updates, technical incidents or new features (push notifications).

02Third-party services

We use providers that process certain data on our behalf:

Google Cloud Platform (GCP) — hosting and storage.

Supabase — database and authentication.

Sentry — error tracking and technical performance monitoring (limited logs).

OneSignal — push notifications (web & mobile).

These providers undertake to comply with the applicable legislation and may, where relevant, transfer data outside Switzerland/the EU.

03Retention period

We apply the maximum periods compatible with our obligations:

User accounts: kept for as long as the account is active, then for up to 5 years after deactivation.

Business data (reports, analyses, documents): kept for up to 10 years after their creation.

Technical logs (Sentry): kept for a maximum of 12 months.

Push notifications (OneSignal): kept only for as long as you have consented to them.

Once these periods expire, the data is securely deleted or anonymised.

04Users’ rights

In accordance with the Swiss Federal Act on Data Protection (FADP), you have the following rights:

• Access to your personal data.
• Rectification of inaccurate or incomplete data.
• Erasure of your data, within the limits set by law.
• Data portability, where applicable.
• Objection to certain processing (e.g. marketing).

To exercise your rights, contact us: info@polluscan.ch.

05Data security

We implement appropriate technical and organisational measures to protect your data against unauthorised access, loss, alteration or disclosure. This includes in particular:

• encryption of data in transit and at rest (where applicable);
• role-based access controls;
• audit logs and incident monitoring;
• internal incident-management procedures and regular backups.

Data is stored securely on servers located in Switzerland and/or the EU through our partners (GCP, Supabase).

06Transfers of data abroad

In some cases, your data may be transferred to third countries (for example the USA for OneSignal or Sentry). These transfers are governed by appropriate safeguards (standard contractual clauses, certifications and specific agreements) to ensure an adequate level of protection.

07Changes to this policy

We may update this policy to reflect legal, technical or operational changes. In the event of a substantial change, we will inform you by email or through the application.

08Contact

For any question about this policy or your personal data, contact:

PolluScan SA · Avenue du Temple 13 · 1012 Lausanne

Email: info@polluscan.ch

Phone: +41 (0)58 861 70 60