Privacy Policy

1. Data Controller

Martin Bohnenblust
Sulzerallee 80, 8404 Winterthur
Switzerland
Email: hello@sapling.ch

2. What data we collect

When you use SAPLING, we collect and process the following personal data:

• Account data: email address and password (hashed)
• Profile data: display name
• Usage data: orders, budgets, suppliers, and team information you create
• Technical data: IP address, browser type, and access timestamps (server logs)

3. Purpose of processing

We process your data for the following purposes:

• Providing and operating the SAPLING service
• User authentication and account management
• Enabling team collaboration features
• Technical operation and security of the platform

4. Legal basis

We process your data based on:

• Performance of contract (Art. 6(1)(b) GDPR / Art. 31 nDSG): to provide the service you signed up for
• Legitimate interest (Art. 6(1)(f) GDPR / Art. 31 nDSG): for security, fraud prevention, and service improvement

5. Cookies

SAPLING uses only essential cookies required for the service to function:

• sessionid — Keeps you logged in during your session
• csrftoken — Protects against cross-site request forgery attacks
• django_language — Stores your language preference (English/German)

We do not use analytics, tracking, or advertising cookies. No data is shared with third-party advertisers.

6. Data sharing and international transfers

Your data is hosted on servers operated by:

Railway Corp.
San Francisco, CA, USA

This means your data is transferred to the United States. Railway is certified under the EU-U.S. Data Privacy Framework and the Swiss-U.S. Data Privacy Framework, which the European Commission and the Swiss Federal Council recognise as ensuring an adequate level of data protection. Where these frameworks do not apply, transfers are safeguarded by the European Commission's Standard Contractual Clauses.

We plan to migrate to EU-based hosting in the future.

Transactional e-mails (such as account verification and password reset messages) are sent through our Swiss e-mail provider:

Hostpoint AG
Rapperswil-Jona, Switzerland

E-mail data is processed in Switzerland; this adds no further international transfer.

All scripts, styles, and fonts used by SAPLING are served from our own servers — no third-party content delivery networks receive your IP address when you use the service.

We do not sell, rent, or otherwise share your personal data with third parties, except as required by law.

7. Data retention

We retain your data for as long as your account is active. You can request deletion of your account at any time by emailing us; your personal data will then be removed within 30 days. Anonymised, aggregated data may be retained for statistical purposes.

Server logs containing IP addresses and access timestamps are automatically deleted after 30 days at the latest.

Team data (orders, budgets, suppliers) belongs to the team and is retained as long as the team exists, regardless of individual account deletion.

8. Your rights

Under the Swiss Data Protection Act (nDSG) and, where applicable, the EU General Data Protection Regulation (GDPR), you have the following rights:

• Right of access: request a copy of your personal data
• Right to rectification: correct inaccurate data
• Right to deletion: request deletion of your data
• Right to data portability: receive your data in a structured format
• Right to object: object to processing based on legitimate interest

To exercise any of these rights, contact us at hello@sapling.ch.

You also have the right to lodge a complaint with a supervisory authority: in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC); if you are in the EU/EEA, the data protection authority of your country of residence.

9. Data security

We implement appropriate technical and organizational measures to protect your data, including:

• Encrypted connections (HTTPS/TLS)
• Hashed passwords (never stored in plain text)
• Secure session management
• Content Security Policy headers

10. Changes to this policy

We may update this privacy policy from time to time. Changes will be posted on this page with an updated revision date. Continued use of the service after changes constitutes acceptance.

11. Contact

For questions about this privacy policy or your personal data, contact:

Martin Bohnenblust
hello@sapling.ch