Privacy Policy
Version 1.0 - 14 August 2026
1. Introduction and Controller Identity
Gamma Earth Sàrl, registered in Switzerland with registered address at Chemin de la Scierie 10, 1162 St-Prex, Switzerland ("Gamma Earth", "we", "us", or "our") is the data controller for personal data processed as described in this Privacy Policy.
This Privacy Policy applies to the gamma.earth website (the "Website") and to the Gamma Earth Platform at app.gamma.earth (the "Platform"), including access via API, SDK, Google Colab, and the user dashboard. It describes what data we collect, how we use it, who we share it with, and the rights you have in relation to your personal data. It does not apply to third-party websites or services we may link to.
Contact: info@gamma.earth
Which sections apply to you
| If you… | Read sections |
|---|---|
| Only browse the gamma.earth website | 1–2, 4–6, 9–15 |
| Have a Platform account or use the software | All sections |
2. Applicable Law
Gamma Earth processes personal data in compliance with:
- the Swiss Federal Act on Data Protection (nDSG / LPD), as revised and in force from 1 September 2023;
- Regulation (EU) 2016/679 (GDPR), to the extent applicable to users located in the European Economic Area;
- any other applicable national data protection laws.
Where the GDPR applies, the legal bases for processing are as set out in Section 5 below.
3. Website Visitors
This section applies to everyone who visits the gamma.earth website, whether or not you hold a Platform account.
3.1 Analytics before you make a cookie choice
When you visit gamma.earth, our analytics tag (Google Analytics 4) loads on every visit. Before you make a cookie choice, it operates in a restricted mode: no cookies are written to your device and no identifier is stored. Google nevertheless receives your IP address, the page URL, and basic technical data as an anonymous, cookieless signal. We rely on legitimate interests (Art. 6(1)(f) GDPR) for this limited processing, which we use only to understand aggregate traffic volume.
If you accept analytics cookies, Google Analytics additionally stores identifiers on your device — see the Cookie Notice. That processing relies on your consent (Art. 6(1)(a) GDPR), which you may withdraw at any time via "Cookie settings" in the site footer.
3.2 Movement between our sites
When you navigate from gamma.earth to app.gamma.earth, a technical parameter may be appended to the address to join your session correctly across the two sites. This does not identify you personally.
3.3 Contact form
The Website contact form collects your first name, last name, company, email address, enquiry subject, and message. We use this information to respond to your enquiry and to manage the resulting commercial relationship. The lawful basis is the taking of steps at your request prior to entering into a contract (Art. 6(1)(b) GDPR). The form is provided through HubSpot, which acts as our processor (see Section 6). Enquiries that do not lead to an account are retained for up to 24 months.
Any checkbox in the contact form by which you acknowledge our legal documents is a confirmation that you have read them; it is not consent to receive marketing. If you separately opt in to receive communications, you may withdraw that consent at any time using the unsubscribe link in our emails.
4. Personal Data We Collect (Platform)
4.1 Account Registration Data
When you create an account on the Platform, we collect: full name; email address; company or organisation name; job title or role; country of residence or operations.
4.2 Usage and Technical Data
To operate, bill, and improve the Service, we collect:
- Software usage logs, including timestamps, API call records, credit consumption, and data processing volumes;
- Area of Interest (AOI) data (geographic polygons) and Sentinel-2 acquisition dates submitted for processing — strictly necessary for processing and billing. Users retain ownership of this data (see Section 9);
- Geolocation data (country or region of access), used to determine the applicable credit-to-km² conversion rate, which varies by region as set out in the Fee Policy;
- Device and browser technical information (IP address, browser type, operating system) collected automatically when you access the Platform.
4.3 Payment Data
For the purpose of processing payments and issuing invoices, Gamma Earth collects the company legal address and VAT number (where applicable) of the billing entity. Payment card transactions are processed by Stripe, Inc. ("Stripe"). Gamma Earth does not store full payment card details. Stripe may collect and process payment card information directly; please refer to Stripe's Privacy Policy at https://stripe.com/privacy.
4.4 Google Colab Interface
Where you access Gamma Earth services through the Google Colab interface, you will be asked to provide your API Key. This identifier is used solely to associate your processing request with your account for authentication and billing. Usage data arising from such sessions is treated in the same manner as Platform usage data described in Section 4.2.
4.5 Communications Data
If you contact us by email or through the Platform, we retain a record of that communication, including your contact details and message content, for the purpose of handling your enquiry and for our records.
5. Purposes of Processing and Legal Bases
| Purpose | Data Used | Legal Basis (GDPR) |
|---|---|---|
| Website analytics — cookieless signals before consent | IP address, page URL, technical data | Legitimate interests (Art. 6(1)(f)) |
| Website analytics — cookies and identifiers after consent | Analytics identifiers, usage data | Consent (Art. 6(1)(a)) |
| Website contact form enquiries | Name, email, company, subject, message | Pre-contractual steps (Art. 6(1)(b)) |
| Account creation and authentication | Name, email, country, company, title | Performance of a contract (Art. 6(1)(b)) |
| Providing the Service and processing requests | Usage logs, AOI data, API Key | Performance of a contract (Art. 6(1)(b)) |
| Credit accounting and billing | Usage logs, credit balance, geolocation, company legal address, VAT number, payment data via Stripe | Performance of a contract (Art. 6(1)(b)) |
| Regional pricing determination | Geolocation (country/region) | Performance of a contract (Art. 6(1)(b)) |
| Platform analytics and service improvement | Aggregated/anonymised usage data | Legitimate interests (Art. 6(1)(f)) |
| CRM and commercial relationship management | Name, email, company, title, country | Legitimate interests (Art. 6(1)(f)) |
| Compliance with legal obligations | As required by applicable law | Legal obligation (Art. 6(1)(c)) |
| Responding to enquiries and support | Communications data | Legitimate interests (Art. 6(1)(f)) |
6. Third-Party Service Providers and Sub-Processors
Gamma Earth engages the following third-party sub-processors. All sub-processors are bound by data processing agreements and required to handle personal data in accordance with applicable law.
| Provider | Role | Data Processed | Location |
|---|---|---|---|
| Google Cloud Platform | Infrastructure hosting and storage | All Platform data | EU (europe-west-1, Belgium) |
| Google Analytics 4 (Google Ireland Ltd / Google LLC) | Website analytics | IP address, page URL, device and browser data, and analytics identifiers (after consent) | EU / USA (SCCs and EU–US Data Privacy Framework) |
| Stripe, Inc. | Payment processing | Payment data | USA (SCCs in place) |
| HubSpot, Inc. | CRM and marketing | Contact and commercial relationship data, which may be supplemented by professional information from HubSpot's built-in enrichment features | USA (SCCs in place) |
| Google Data Studio | Internal analytics reporting | Aggregated/anonymised usage data | USA (SCCs in place) |
| Auth0 (Okta, Inc.) | Authentication and identity management | Email address, authentication credentials, and login event metadata (including IP address and device information) | USA (SCCs in place) |
| Postmark (Wildbit LLC) | Transactional email delivery | Email address, name, and transactional email content including billing and invoice notifications | USA (SCCs in place) |
| Amazon Web Services, Inc. (AWS) | AI model inference and processing infrastructure | API keys and associated account identifiers, processing request data (including Area of Interest coordinates), and processing outputs temporarily stored pending transfer to primary storage | USA (SCCs in place) |
"SCCs" refers to Standard Contractual Clauses adopted by the European Commission pursuant to Article 46 GDPR. Gamma Earth does not sell personal data to third parties, and does not permit sub-processors to use personal data for their own independent purposes.
7. International Data Transfers
Personal data is primarily hosted on Google Cloud Platform infrastructure located in the EU (Belgium, europe-west-1 region). Where data is transferred outside the EEA or Switzerland — including to Google, Stripe, HubSpot, Auth0, Postmark, and Amazon Web Services in the United States — such transfers are subject to appropriate safeguards, including Standard Contractual Clauses or equivalent mechanisms recognised under Swiss data protection law, and, where applicable, the EU–US Data Privacy Framework.
8. Data Retention
- Account data: for the duration of the active account, plus a further period as required for legal, tax, and compliance purposes (typically up to 10 years under Swiss law);
- Usage logs and billing records: retained for a minimum of 10 years in compliance with Swiss accounting and tax obligations;
- AOI and project data: retained for the duration of the account. Upon account closure, active project data is retained for 30 days to allow export, then permanently deleted. Anonymised aggregated usage data may be retained indefinitely;
- Website analytics (Google Analytics 4): user- and event-level data is retained for 14 months;
- Contact-form enquiries that do not become accounts: retained for up to 24 months;
- Cookie consent record: 180 days;
- Communications: retained for as long as reasonably necessary to handle the relevant enquiry.
- Anonymised or aggregated data that cannot be used to identify individuals is not subject to these retention periods.
9. Ownership of User Input Data
Users retain full ownership of the input data they submit to the Platform, including AOI definitions and Sentinel-2 acquisition dates. By submitting such data, users grant Gamma Earth a limited, non-exclusive, royalty-free licence to process that data solely for the purpose of delivering the requested service and for billing.
Gamma Earth may use anonymised, aggregated usage data that cannot be linked to any individual user or organisation to improve its services, develop new features, and for internal analytics. Such use does not require further consent.
10. Cookies and Tracking Technologies
The Website and Platform use a limited set of cookies and similar technologies. There are two categories: strictly necessary and analytics. Analytics cookies are set only with your consent. Full details — including cookie names, purposes, durations, and how to withdraw consent — are set out in our Cookie Notice.
11. Your Data Protection Rights
Subject to applicable law, you have the following rights in relation to your personal data: right of access; right to rectification; right to erasure; right to restriction of processing; right to data portability; right to object to processing based on legitimate interests; and, where processing is based on consent, the right to withdraw that consent at any time. Gamma Earth does not make solely automated decisions that produce significant legal effects on users.
To exercise any of these rights, please contact us at info@gamma.earth. We will respond within 30 days.
You also have the right to lodge a complaint with the competent supervisory authority. In Switzerland: the Federal Data Protection and Information Commissioner (FDPIC) at www.edoeb.admin.ch. EEA residents may also contact the data protection authority in their country of residence.
12. EU Representative
Where required under Article 27 GDPR, Gamma Earth will designate a representative in the European Union and publish its contact details here. [EU representative details to be inserted upon appointment.] Until then, data subjects in the EEA may contact us directly at info@gamma.earth or through the supervisory authority in their country of residence.
13. Data Security
Gamma Earth implements appropriate technical and organisational measures to protect personal data against unauthorised access, loss, alteration, or disclosure. Measures include access controls, encryption in transit, and infrastructure hosted within certified cloud environments.
In the event of a personal data breach likely to result in a risk to your rights and freedoms, we will notify the competent authority and, where required, affected individuals in accordance with applicable law.
14. Minors
The Website and Platform are intended for use by businesses, governmental entities, academic institutions, and professional users. We do not knowingly collect personal data from individuals under the age of 18.
15. Changes to This Policy
Gamma Earth may update this Privacy Policy from time to time. Material changes will be communicated to registered users by email and/or by a notice on the Platform or Website. The date of the latest revision is indicated at the top of this document. Continued use following notification of changes constitutes acceptance of the updated Policy.
16. Contact
For any questions, requests, or complaints relating to this Privacy Policy:
Gamma Earth Sàrl
Chemin de la Scierie 10, 1162 St-Prex, Switzerland
Email: info@gamma.earth
Website: www.gamma.earth
Related documents: Cookie Notice · Website Terms of Use · Platform Terms of Service