Privacy Policy

1. Data controller

The data controller responsible for the processing of your personal data through this Site is:
Terraris GmbH
Canton of Zug, Switzerland
CHE-101.131.421
hello@terraris.ai
Data Protection Officer: TODO Harvey: confirm DPO designation requirement under Swiss nDSG + GDPR Art. 37

2. Data we collect

When you use this Site, we may collect the following categories of personal data:

• Contact information: name, email address, phone number, company name, when you submit an inquiry or book a Sprint.
• Technical data: IP address, browser type, operating system, pages visited, time spent, referral source (collected via server logs or analytics tools).
• Communications: content of messages you send us via the contact form or email.
• Engagement data: information shared during pre-sales calls or scoping sessions.

3. Purpose and legal basis (GDPR Art. 6)

We process your personal data on the following legal bases:

• Performance of a contract (Art. 6(1)(b)): processing necessary to respond to your inquiry, scope an engagement, or deliver contracted services.
• Legitimate interests (Art. 6(1)(f)): understanding how the Site is used, improving our services, preventing fraud and abuse. Our legitimate interests do not override your fundamental rights.
• Consent (Art. 6(1)(a)): for optional communications such as newsletters or case study notifications. You may withdraw consent at any time.
• Legal obligation (Art. 6(1)(c)): where required by Swiss law, EU law, or other applicable jurisdiction. TODO Harvey: confirm Swiss nDSG Art. 31 processing grounds alignment

4. Retention

We retain personal data only as long as necessary for the purpose it was collected or as required by applicable law. Contact inquiry data is retained for up to 24 months after last interaction. Engagement data is retained for the duration of the engagement plus 7 years for accounting and legal compliance purposes. TODO Harvey: confirm 7-year retention aligns with Swiss CO Art. 958f (accounting obligations)

5. Your rights (GDPR Art. 15–22)

If you are located in the EU/EEA or Switzerland, you have the following rights regarding your personal data:

• Access (Art. 15): request confirmation of whether we process your data and obtain a copy.
• Rectification (Art. 16): request correction of inaccurate data.
• Erasure (Art. 17): request deletion of your data, subject to legal retention obligations.
• Restriction (Art. 18): request restricted processing in certain circumstances.
• Portability (Art. 20): receive your data in a structured, machine-readable format.
• Objection (Art. 21): object to processing based on legitimate interests.
• Withdrawal of consent (Art. 7(3)): withdraw consent at any time without affecting prior processing.

To exercise any of these rights, contact hello@terraris.ai. We will respond within 30 days. You also have the right to lodge a complaint with the supervisory authority in your jurisdiction, in Switzerland the Federal Data Protection and Information Commissioner (FDPIC).

6. Brazilian users (LGPD)

If you are located in Brazil, your personal data is also processed in compliance with the Lei Geral de Proteção de Dados (LGPD, Law 13.709/2018). You have analogous rights to those described in Section 5, exercisable through the same contact address. The legal bases for processing under LGPD correspond to those in Section 3. TODO Harvey: confirm LGPD Art. 7 basis mapping and DPA notification requirement for Brazil operations

7. Third parties

We do not sell your personal data. We may share data with:

• Service providers (hosting, email, analytics) acting as data processors under written data processing agreements.
• Professional advisors (legal, accounting) under confidentiality obligations.
• Public authorities when required by law.

TODO Harvey: enumerate specific sub-processors once hosting and analytics stack is confirmed

8. Cookies

This Site uses strictly necessary cookies to function (session management, security). We do not deploy advertising or tracking cookies without consent. Analytics, if enabled, uses privacy-preserving configuration (anonymised IP, no cross-site tracking). TODO Harvey: confirm cookie banner requirement under ePrivacy Directive for EU users once analytics tool is selected

9. Updates to this policy

We may update this Privacy Policy to reflect changes in our practices or applicable law. We will notify you of material changes by updating the "Last updated" date at the top of this page. Continued use of the Site after changes constitutes acknowledgement of the revised policy.

10. Contact

For any privacy-related questions or to exercise your rights, contact us at hello@terraris.ai.

Last updated: 2026-05-13