overpass.choverpass.ch
CHF
Automatic (USD) CHFEURUSD

Privacy policy

Last updated: 28 October 2026

This policy explains which personal data we process when you use overpass.ch, and why. It follows the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).

1. Controller

Chavdar Dutsov, Spycherweg 3, 5223 Riniken, Switzerland, info@overpass.ch

2. Data we process

  • Account data: e-mail address, password (stored only as an Argon2id hash), optionally name and company, and the language of your dashboard and our e-mails (English or German). Purpose: providing your account (contract).
  • Sign-in with Google (optional): if you choose “Continue with Google”, Google tells us your Google account identifier, e-mail address and name; we store the identifier to recognise you next time. Google learns that you sign in to our service. Purpose: providing your account (contract).
  • Billing data: subscriptions are sold through Link (Sold through Link, LLC, a Stripe company) as reseller, and Stripe processes the payments. Link is responsible for the payment data it collects at checkout itself (see the Link privacy policy). We receive and store the Stripe customer and subscription identifiers, plan, billing period and payment status, but no card details. Invoices and the billing address and VAT ID you enter are held by Stripe. Purpose: contract and statutory bookkeeping.
  • API usage data: for each request: time, key identifier, HTTP status, duration, response size, a cryptographic hash of the query and whether the cache answered. We do not store the content of your queries. For map tiles we keep no record per request, only totals per key and day (tiles, errors, data volume). Purpose: enforcing plan limits, usage statistics in your dashboard, billing, abuse prevention (contract, legitimate interest).
  • Technical logs: IP address, time, requested path (without query strings or full API keys) and status, to operate and secure the service (legitimate interest).
  • Page views: for each public page we count, per day, how often it was opened and where the visitors came from: the website their browser names as referrer (for example a search engine), or the campaign name in a link with utm_source. We store no IP address and set no cookie for this, and visits while you are logged in are not counted. When you create an account, we store the page on which you clicked the sign-up link. Purpose: knowing which pages are useful and lead to sign-ups (legitimate interest).
  • Abuse prevention: to enforce the fair use rules (one account per person or organisation, no resale or published keys), we keep the IP address of sign-ups and logins in a security log; it is removed after 90 days. For each API key and day we also keep an estimate of how many different IP addresses used it (the addresses themselves are not stored) and the host names of websites that sent requests with it, for 8 days. These signals are reviewed by a person; nothing is blocked automatically (legitimate interest).
  • E-mails: transactional messages such as address confirmation, password reset, billing notices and the warning when 80% or 100% of a monthly allowance are used. We send no newsletters without your consent.

3. Cookies

We only use cookies that are technically necessary: a session cookie when you are logged in, a security token against cross-site request forgery, a cookie that lives for ten minutes while you sign in with Google, a short-lived cookie for status messages, and, when you choose a language or a currency at the top of the page, a cookie for each that keeps only that choice (en or de; chf, eur or usd) for a year; choosing “Automatic” deletes the currency cookie. There is no tracking or advertising, and no analytics service; we count page views ourselves, without cookies (section 2).

4. Service providers

  • Hetzner Online GmbH, Germany: server hosting.
  • Stripe Payments Europe Ltd., Ireland (with group companies in the USA): payment processing, invoices, customer portal. Transfers to the USA are covered by the EU-US / Swiss-US Data Privacy Framework and standard contractual clauses.
  • Sold through Link, LLC, USA (a Stripe company): sells the subscriptions as reseller, collects the taxes and sends the invoices.
  • Infomaniak Network SA, Switzerland: sending e-mails.
  • Google Ireland Limited, Ireland (with group companies in the USA): optional sign-in with a Google account. Transfers to the USA are covered by the EU-US / Swiss-US Data Privacy Framework.

We do not sell personal data and do not share it with anyone else unless the law requires it.

5. Retention

  • Account data: until you delete your account. On deletion we remove your e-mail address, name, company and password; anonymous usage totals remain.
  • Per-request usage records: 30 days. Daily usage totals: as long as needed for billing and statistics.
  • Page view counts: daily totals per page and source, without personal data, for 400 days.
  • Technical logs: deleted automatically by log rotation, generally within 30 days.
  • Billing records: 10 years, as required by Swiss law (Art. 958f CO).

6. Your rights

You can request access to your data, its correction or deletion, data portability, and object to processing based on legitimate interest. Much of it you can do yourself in your dashboard (profile, e-mail, account deletion). Otherwise write to us at info@overpass.ch. You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, with your local supervisory authority.

7. Security

All connections are encrypted (HTTPS). Passwords are stored only as Argon2id hashes. API keys are stored as a hash, which the gateway checks on every request, and in addition encrypted (AES-256-GCM), so that you can see them again in your dashboard. Access to the systems is restricted and protected by key-based authentication.

8. Changes

We update this policy when our processing changes. The current version is always on this page.