Privacy Policy

The controller responsible for the processing of personal data is:

Roriz Gama Via Originis

Zürcherstrasse 62

8406 Winterthur

Switzerland

Email: [email protected]

This Privacy Policy applies to:

• viaoriginis.com;
• Via Originis user accounts;
• digital route purchases;
• My Routes;
• route access and walking features;
• offline route functionality;
• transactional emails;
• account, invoice and support features.

Third-party websites or services linked from Via Originis may be subject to their own privacy policies.

Depending on how you use Via Originis, we may process the following categories of personal data.

Account information

This may include:

• name;
• email address;
• authentication provider;
• account identifier;
• account language or profile settings.

Purchase and transaction information

This may include:

• purchased route;
• purchase date;
• order and invoice number;
• payment status;
• billing name and address where supplied;
• payment method summary, such as card brand and last four digits;
• Stripe transaction identifiers.

Via Originis does not directly receive or store your complete payment card number.

Route ownership and use

We may process information relating to:

• routes owned by your account;
• route access rights;
• route progress stored on your device;
• route completion state;
• offline/download status;
• route content accessed on your device.

Technical information

Our systems and service providers may process technical data required to operate the service, such as:

• browser information;
• device-related signals;
• internet connectivity status;
• authentication/session information;
• server request information;
• technical and operational logs.

Via Originis application code does not currently maintain a user-facing analytics or behavioural advertising profile.

Certain Via Originis walking features may request access to your device location.

Location data may be used to:

• determine your position relative to the route;
• help determine whether you have reached the route start;
• detect proximity to route stops or discoveries;
• help identify whether you are moving away from the intended route.

Your live GPS coordinates are currently processed on your device.

Via Originis does not currently upload your live walking coordinates to its servers or maintain a server-side history of your walking location.

Your device may store your most recent route position locally to support the walking experience.

You can deny location permission through your browser or device settings. Some route features may then be limited or unavailable.

We process personal data where necessary to:

• create and operate user accounts;
• authenticate users;
• provide purchased digital routes;
• process payments;
• maintain route ownership;
• provide invoices;
• send transactional emails;
• allow route access and offline functionality;
• provide support;
• prevent misuse and maintain security;
• comply with accounting, legal and regulatory obligations;
• operate and improve the technical reliability of the service.

Via Originis currently supports authentication through:

• email Magic Link;
• Google authentication.

Authentication services are provided through Supabase.

Authentication information, session identifiers and related account data may be processed by Supabase and, where Google login is used, by Google.

Payments are processed by Stripe.

Stripe processes payment information entered during checkout.

Via Originis receives transaction-related information needed to:

• confirm payment;
• grant route access;
• create purchase records;
• issue invoices;
• handle customer support and refunds.

Via Originis does not directly handle or store full payment card numbers.

Via Originis may send transactional emails relating to:

• authentication;
• account creation;
• route purchases;
• route access;
• account deletion;
• customer support.

Transactional email may be provided through Supabase and Resend.

Email delivery records may include:

• recipient email;
• delivery status;
• provider message identifier;
• related transaction identifier;
• error information required for delivery troubleshooting.

Via Originis uses third-party service providers to operate the service.

Current providers include, depending on the feature:

Supabase

Authentication, database and account services.

Stripe

Payment processing and payment-related transaction services.

Resend

Transactional email delivery.

Vercel

Website and application hosting.

Cloudflare / R2

Storage and delivery of media assets.

Google

Google authentication when selected by the user.

Map and public-data providers

Map tiles, map rendering and destination-related public information may be provided through services such as OpenFreeMap, MapLibre-compatible resources, MeteoSwiss, geo.admin.ch and public Zurich data services.

These providers process data according to their own services, infrastructure and privacy terms.

Some of our service providers operate internationally.

As a result, personal data may be processed in countries outside Switzerland.

Where Swiss data protection law requires safeguards for cross-border disclosure, Via Originis relies on applicable legal mechanisms and contractual safeguards provided by the relevant service provider.

The countries and processing locations may depend on the provider and technical configuration.

You may contact us at [email protected] for current information about relevant processors and international data transfers.

Via Originis uses cookies and similar browser storage where required for the operation of the service.

This may include:

• authentication cookies or tokens;
• account/session information;
• return-to-page information after authentication;
• route ownership cache;
• route progress;
• offline route data;
• service-worker caches;
• install-prompt preferences;
• local interface preferences.

Further details are provided in the Cookies Policy.

Via Originis does not currently use advertising cookies or behavioural marketing cookies in the application.

Via Originis does not currently operate:

• Google Analytics;
• Google Tag Manager;
• Meta Pixel;
• TikTok tracking;
• Hotjar;
• PostHog;
• Mixpanel;
• Plausible;
• behavioural advertising or remarketing tools.

If analytics or marketing technologies are introduced in the future, this Privacy Policy and the relevant cookie controls will be updated before or when required.

We retain personal data for as long as reasonably necessary for the purposes described in this Policy or where required by law.

Account-related data

Account data is generally retained while the account exists.

When an account is deleted, authentication data and certain account-linked records are deleted.

Purchase and invoice records

Certain transaction, invoice and purchase records may be retained after account deletion where necessary for:

• accounting;
• tax obligations;
• legal obligations;
• fraud prevention;
• dispute resolution;
• transaction reconciliation.

Where possible, the direct link between those records and the deleted account is removed.

Transactional email records

Certain email delivery records linked directly to the account may be deleted when the account is deleted.

Third-party providers may maintain their own legally or operationally required records under their respective policies.

Device-local data

Route progress and other user-linked local data are cleared through the Via Originis account reset or deletion process where supported.

Some shared offline route files or browser cache files may remain on the device until removed by the browser, operating system or user.

Users can initiate account deletion through the available account controls.

Account deletion may remove:

• authentication account;
• route entitlements;
• user-linked application records;
• certain local account state.

Certain transaction records may continue to be retained as described above.

Account deletion does not necessarily delete data independently retained by payment providers or other third-party providers where they have their own legal or contractual retention obligations.

Subject to applicable law, you may have rights regarding your personal data, including the right to:

• request information about whether personal data concerning you is being processed;
• obtain information or a copy of relevant personal data;
• request correction of inaccurate data;
• request deletion where legally available;
• object to certain processing;
• request restriction of processing where applicable.

Some rights may be limited by legal obligations or legitimate retention requirements.

To exercise a privacy right, contact:

[email protected]

We may request reasonable information to verify your identity before responding.

Via Originis uses reasonable technical and organisational measures intended to protect personal data against:

• unauthorised access;
• loss;
• misuse;
• alteration;
• disclosure.

No online system can guarantee absolute security.

Via Originis is not specifically directed at young children.

Users who are not legally capable of entering into a contract independently should use the service only with the involvement of a parent or legal guardian.

This Privacy Policy may be updated to reflect changes in:

• the Via Originis product;
• service providers;
• legal requirements;
• technical systems.

The current version will be published on Via Originis with the latest update date.

For privacy questions or requests:

Roriz Gama Via Originis

Zürcherstrasse 62

8406 Winterthur

Switzerland

[email protected]