overpass.ch

Privacy policy

Last updated: 20 October 2026

This policy explains which personal data we process when you use overpass.ch, and why. It follows the Swiss Federal Act on Data Protection (FADP) and, where it applies, the EU General Data Protection Regulation (GDPR).

1. Controller

The operator named in the imprint.

2. Data we process

  • Account data: e-mail address, password (stored only as an Argon2id hash), and optionally name and company. Purpose: providing your account (contract).
  • Billing data: payments are processed by Stripe. We receive and store the Stripe customer and subscription identifiers, plan, billing period and payment status, but no card details. Invoices and the billing address and VAT ID you enter are held by Stripe. Purpose: contract and statutory bookkeeping.
  • API usage data: for each request: time, key identifier, HTTP status, duration, response size, a cryptographic hash of the query and whether the cache answered. We do not store the content of your queries. Purpose: enforcing plan limits, usage statistics in your dashboard, billing, abuse prevention (contract, legitimate interest).
  • Technical logs: IP address, time, requested path (without query strings or full API keys) and status, to operate and secure the service (legitimate interest).
  • E-mails: transactional messages such as address confirmation, password reset and billing notices. We send no newsletters without your consent.

3. Cookies

We only use cookies that are technically necessary: a session cookie when you are logged in, a security token against cross-site request forgery, and a short-lived cookie for status messages. There is no tracking, analytics or advertising.

4. Service providers

  • Hetzner Online GmbH, Germany: server hosting.
  • Stripe Payments Europe Ltd., Ireland (with group companies in the USA): payment processing, invoices, customer portal. Transfers to the USA are covered by the EU-US / Swiss-US Data Privacy Framework and standard contractual clauses.
  • Infomaniak Network SA, Switzerland: sending e-mails.

We do not sell personal data and do not share it with anyone else unless the law requires it.

5. Retention

  • Account data: until you delete your account. On deletion we remove your e-mail address, name, company and password; anonymous usage totals remain.
  • Per-request usage records: 30 days. Daily usage totals: as long as needed for billing and statistics.
  • Technical logs: deleted automatically by log rotation, generally within 30 days.
  • Billing records: 10 years, as required by Swiss law (Art. 958f CO).

6. Your rights

You can request access to your data, its correction or deletion, data portability, and object to processing based on legitimate interest. Much of it you can do yourself in your dashboard (profile, e-mail, account deletion). Otherwise write to us. You may also lodge a complaint with the Swiss Federal Data Protection and Information Commissioner (FDPIC) or, in the EU, with your local supervisory authority.

7. Security

All connections are encrypted (HTTPS). API keys and passwords are stored only as hashes. Access to the systems is restricted and protected by key-based authentication.

8. Changes

We update this policy when our processing changes. The current version is always on this page.