Privacy Policy
In short: we collect only what we need to run the conversion service and take payments. Your uploaded files are deleted after conversion unless you choose to share them with us. We don’t sell your data, don’t use advertising trackers and don’t set cookies.
1. Who We Are
Vertessia is an independent business operated by a sole proprietor in British Columbia, Canada (“we”, “us”). We are responsible for the personal information described here (the “controller” under the GDPR). If you are a business and need a data processing agreement for files you upload, contact us.
2. Privacy Contact
The person accountable for privacy at Vertessia (our Privacy Officer under Canadian law) is the owner of Vertessia, reachable at info@vertessia.com. We have not appointed a representative in the EU or UK; please contact us directly.
3. Information We Collect
| Category | What exactly | Source |
|---|---|---|
| Account | Email address, account ID, password (stored only as a hash by our sign-in provider), or your Google account email if you sign in with Google; the Terms version you accepted and when | You; Google |
| Conversions | File names, file sizes, conversion type and settings, status, error type, result metrics (e.g. face count, deviation figures), time | You; automatically |
| Uploaded files | The 3D files you upload and the results we produce (kept only briefly — see Section 5) | You |
| Request log | IP address, time, file size and conversion type of each upload (used for rate limiting and abuse prevention) | Automatically |
| Product usage events | Pages you view on our site, the domain of the website that linked you to us (not the full address), and steps such as “file selected”, “conversion started”, “download clicked” — with a random ID that lasts only for your browser tab, and your account ID if signed in. For page views we also record your country, your browser’s preferred language and whether you use a phone or a computer; the country is looked up on our own server from your IP address at the moment of the visit (using the DB-IP Lite database — IP Geolocation by DB-IP), and the IP address itself is not stored with these events | Automatically |
| Purchases | Credits bought and used, subscription plan and status, Stripe customer and subscription IDs | You; Stripe |
| Payment details | Handled entirely by Stripe — we never receive your full card number | Stripe |
| API keys | Key name and a one-way hash of the key (we cannot see the key itself after creation) | You |
| Support messages | What you send us by email | You |
We do not use advertising or third-party analytics tools. The product-usage events above are our own first-party statistics (which pages are used, where conversions fail, whether people who preview a result go on to download it). They are stored on our own servers, are not shared with anyone, are not used for advertising or profiling, and are deleted after 12 months. The random tab ID is held in your browser’s session storage and disappears when you close the tab. Where the law where you live requires consent for this kind of measurement, our basis is your consent given by continuing to use the site after this notice; you can object at any time by emailing info@vertessia.com and we will stop recording events for your account, or you can block requests to /v1/events in your browser — the service works without them.
4. Why We Use It (Purposes & Legal Basis)
| Purpose | GDPR legal basis |
|---|---|
| Running conversions, your account, downloads and purchases | Performance of a contract — Art. 6(1)(b) |
| Rate limiting, security, abuse and fraud prevention | Legitimate interests — Art. 6(1)(f) |
| Understanding which steps of the converter work or fail, to improve it (usage events) | Legitimate interests — Art. 6(1)(f) |
| Tax and accounting records | Legal obligation — Art. 6(1)(c) |
| Improving our algorithms with files you chose to share | Consent — Art. 6(1)(a); per upload, withdrawable at any time |
| Service and billing emails (receipts, verification, password reset) | Performance of a contract — Art. 6(1)(b) |
We do not send marketing emails, and we do not make automated decisions that have legal or similarly significant effects on you.
5. How Long We Keep It
| Data | Retention |
|---|---|
| Uploaded files (default) | Deleted as soon as the conversion finishes; at the latest within 24 hours |
| Uploaded files you chose to share (opt-in box) | Until you ask us to delete them, and no longer than 12 months |
| Results and previews | Within 24 hours; a STEP you paid for is kept 30 days so you can download it again |
| Request log and usage events | 12 months, then deleted automatically |
| Conversion history (file names and metrics, not files) | While your account is open; anonymous conversions up to 12 months |
| Purchase and billing records | 6 years, as required by Canadian tax law |
| Account data | Until you close your account, then deleted within 35 days |
| Database backups | Copies of our database, stored encrypted at rest by our storage provider, are kept for 14 days and then deleted; they contain no uploaded files |
We keep your files only if you ask us to. If you tick the optional “let Vertessia keep a copy of this file” box under the upload area, we keep that file (and, if the conversion failed, the error details) to test and improve our reconstruction algorithms. It is off by default, applies only to that upload, and you can withdraw at any time by emailing info@vertessia.com with the file name and roughly when you uploaded it — we will delete it. Shared files are never sold, published, or used for anything other than improving the Service.
6. Sensitive Data in Your Files (Dental and Medical Scans)
We do not ask for sensitive information, and we never look at the content of your files except through automated processing. A 3D file can nevertheless contain it — for example a dental, intraoral or body scan is health information about an identifiable person, even without a name, if it can be linked back to them.
- Roles. For files you upload, you (or the clinic, lab or company you work for) decide why and how the scan is used and are the controller (or “custodian”) of that data. We process the file only to perform the conversion you requested, on your instructions, as a processor / service provider. If you need a written data processing agreement, email info@vertessia.com and we will sign our standard one.
- Your responsibility. Upload a scan only if you are entitled to have it processed by a third party for this purpose — for example because your patient consented to the use, or your organisation’s privacy rules allow it. If you are not sure, do not upload it. Remove patient names, dates of birth and other identifiers from file names, and do not put them in the optional retention note.
- What we do with it. The file is processed by automated software on our servers in Canada (Montréal) and deleted when the conversion finishes, at the latest within 24 hours; a paid STEP result is kept for 30 days so you can download it again. We do not train or improve our algorithms on a scan unless you tick the optional “keep a copy” box for that upload — and for scans of identifiable patients you should only do so if you have that patient’s permission. Our sub-processors for files are listed in Section 8 (hosting and object storage only; no analytics provider ever sees a file).
- Where. Files stay in Canada. Your account details and payment records are handled by the providers in Section 8, some of which are outside Canada (see Section 9).
7. Cookies & Browser Storage
We do not set cookies. We use your browser’s local storage only to keep you signed in, to remember that you accepted the current Terms, and to hold the random usage-event ID described in Section 3, which is kept only for the current browser tab (session storage). If you are asked to log in or go to checkout while a file is selected, the file and your settings are also kept temporarily in your browser (IndexedDB) so the page can restore them when you return; this copy never leaves your device, is removed as soon as it is restored, and is ignored after 30 minutes. None of this is used for advertising or to track you across other websites.
8. Service Providers
We share personal information only with providers that process it for us:
- OVHcloud — our servers (Montréal, Canada), where conversions run and our database is stored;
- Cloudflare — R2 storage for uploaded files, results and database backups;
- Supabase — account sign-in;
- Google — only if you choose “Sign in with Google”;
- Stripe — payments, receipts and subscription management;
- Resend — account emails such as verification and password reset;
- Zoho — our email inbox, if you write to us;
- Sentry — error reports from our servers when something breaks (technical details of the failure; never your files, request contents or IP address);
- Google Fonts, jsDelivr and esm.sh — deliver fonts and code libraries to your browser, so they receive your IP address when a page loads.
We may disclose information if required by law. We do not sell or “share” your personal information as those terms are defined in California law.
9. International Transfers
We are based in Canada and our servers are in Canada. Some of the providers above process data in the United States or other countries. Where your information leaves your country, we rely on the provider’s contractual safeguards, such as the Standard Contractual Clauses in their data processing terms.
10. Your Rights
Depending on where you live, you can ask to access, correct or delete your personal information, receive a copy of it, object to or restrict certain uses, and withdraw consent. EU/UK: you may also complain to your data protection authority. California: you have the rights to know, access, delete and correct, and not to be discriminated against for using them; we do not sell or share personal information or use sensitive information for inferences. Canada: you can access and correct your information and challenge our compliance. To use any of these rights, email info@vertessia.com from your account’s email address (or through an authorized agent). We may need to confirm your identity, and we respond within 30 days.
Closing your account. Email info@vertessia.com from your account address and ask us to delete it. Within 35 days we: cancel any active subscription in Stripe; delete your sign-in account at our sign-in provider; delete your API keys, conversion history, shared files and usage events; and remove your email address from our database. What we keep: invoices and the credit ledger (amounts, dates, Stripe references — not your files) for 6 years for tax purposes, and the request log entry for each upload (IP, time, size) until it expires after 12 months. Database backups containing your account data are overwritten within 14 days. We confirm by email when it is done.
11. Security
We encrypt data in transit (HTTPS), process files in isolated, resource-limited sandboxes, store only hashes of passwords and API keys, and restrict access to our systems. No system is perfectly secure. If a breach creates a real risk of significant harm to you, we will notify you and the authorities as the law requires.
12. Children
The Service is not intended for children under 16. We do not knowingly collect their information and will delete it if we learn of it.
13. Complaints
Please contact us first at info@vertessia.com. You may also complain to the Office of the Privacy Commissioner of Canada, the Office of the Information and Privacy Commissioner for British Columbia, or — in the EU/UK — your local data protection authority.
14. Changes
We will post any changes here with a new date. If a change materially affects how we use information we already have, we will tell you before it takes effect.