Privacy Policy
Last updated: August 2026
1. Data Controller
Sanox Oy
Business ID: 3140647-6
Kalasatamankatu 32 A 28, 00580 Helsinki, Finland
Email: [email protected]
2. What Data We Collect
- Account data: email address used to create and manage your account.
- Content you add: 3D scenes and topo data, together with any annotations, notes, markers, lists, or other information you attach to them within the service.
- Usage data: anonymised visit statistics collected by Umami Analytics. No cookies are used; no personal data or cross-site identifiers are stored.
- Technical data: session identifiers and CSRF tokens stored in cookies strictly necessary for the service to function securely.
3. Purpose and Legal Basis
| Purpose | Legal basis (GDPR) |
|---|---|
| Providing and operating the service | Art. 6(1)(b) – performance of a contract |
| Security (session & CSRF cookies) | Art. 6(1)(f) – legitimate interest |
| Anonymised analytics | Art. 6(1)(f) – legitimate interest (no personal data processed) |
4. Data Retention
- Account data is retained for the duration of the account and deleted upon request or account closure.
- Scenes, topo data, and any annotations or other content you add are retained until deleted by you or upon account closure.
- Anonymised analytics data contains no personal identifiers and is retained indefinitely in aggregated form.
5. Your Rights
Under the GDPR you have the right to:
- Access the personal data we hold about you
- Rectify inaccurate data
- Request erasure of your data ("right to be forgotten")
- Request restriction of processing
- Data portability
- Object to processing based on legitimate interest
To exercise any of these rights, contact us at [email protected]. You also have the right to lodge a complaint with the Finnish Data Protection Ombudsman (tietosuoja.fi).
6. Third-Party Services
- Hetzner (Finland, EU): cloud storage for uploaded scenes and related content.
- Scaleway (EU): transactional email delivery (account verification, notifications).
- Umami Analytics: privacy-focused, cookieless analytics. No personal data is shared.
7. Changes to This Policy
We may update this policy from time to time. Material changes will be communicated via the service or by email. The date at the top of this page indicates when it was last revised.