1. Data controller
Simon Donike, trading as Hyperalis Labs, is responsible for the personal data described here. Business location: Manresa, province of Barcelona, Catalonia, Spain. Contact hello@hyperalis.com. The legal notice uses the same operator details as Hyperalis Labs.
2. Information handled by the service
- Contact: your email, message and any name or organisation you provide.
- Accounts: email, optional display name, authentication/session records, preferences, API-key identifiers and hashes. Passwords are handled by the authentication provider.
- Processing: scene identifiers, coordinates, saved areas, model/settings, job status, outputs, download metadata and usage. Areas of interest may reveal sensitive business locations and may be personal data when linked to an individual.
- Billing: packages, payment references, credit-ledger entries, refunds and disputes. Stripe handles payment details through hosted checkout; HyperSR does not collect card numbers in its own forms.
- Technical operation: IP addresses and request metadata handled by hosting/security services, errors, timestamps and account-linked activity used for operation and internal usage reporting.
3. Purposes and legal bases
Enquiries, accounts, requested processing, downloads and support rely on pre-contractual steps or contract performance (GDPR Article 6(1)(b)). Organisation contacts may instead be handled under legitimate interests. Security, abuse prevention and internal service measurement rely on legitimate interests (Article 6(1)(f)); accounting and legal obligations rely on Article 6(1)(c). Optional tracking, if introduced, requires appropriate consent before loading.
Account and processing details are necessary for the relevant request; without them, that feature cannot be provided. Optional profile fields may be blank. Image reconstruction is automated; it is not intended to make decisions about individuals with legal or similarly significant effects.
4. Providers and recipients
The architecture uses Supabase for authentication and database records, Cloudflare for web delivery and private output storage, and Stripe for payments when enabled. Transactional email uses Supabase's authentication mail service and Resend for configured application notifications. Sentry is optional error monitoring. Only enabled providers receive the corresponding data.
Microsoft Planetary Computer is the selected source for public Sentinel-2 imagery. Provider requests concern scenes and data access; HyperSR account credentials are not intended for that provider. This provider integration is being prepared for the service.
The public demo and dashboard use an OpenStreetMap basemap. Opening a map discloses your IP address and viewed map area to the tile provider; switching the basemap off stops new tile requests. The demo uses precomputed public examples and requires no account or processing submission. External links have their own policies. This website does not embed the Hyperalis HubSpot calendar.
Provider legal entities, hosting regions and any international transfer safeguards must be confirmed before public registration. This draft does not certify those arrangements. Where data is transferred outside the EEA, the applicable mechanism and how to obtain its safeguards will be stated in the final notice.
5. Retention and confidentiality
Processing files are temporary; download them before the expiry shown for each job. Account, job and billing records have separate lifecycles from imagery. The final schedule for account closure, correspondence, security logs, accounting records and backup rotation remains to be confirmed before commercial use.
Customer jobs and outputs are private to the account and authorised service operators. Output access uses temporary signed links; protect them as credentials. Internal service statistics do not make customer imagery public. Account deletion may require retaining records subject to legal obligations.
6. Your rights
For access, correction, erasure, restriction, portability or objections, email hello@hyperalis.com. Rights apply under data-protection law; proportionate identity verification may be needed. Consent can be withdrawn without affecting earlier lawful processing. You can complain to the Spanish Data Protection Agency (AEPD) or another competent supervisory authority.
7. Cookies and browser storage
The marketing website does not add advertising, analytics trackers or a booking embed. The account application uses authentication cookies for sessions and browser storage for the light/dark appearance. Hosting/security services and Stripe checkout can use service-related cookies. The final deployment's cookie inventory must be checked before publication.
Optional analytics, advertising or third-party embeds must stay disabled until required consent is obtained. Browser settings can clear or block storage; blocking authentication storage may prevent sign-in. You can contact the operator by email without an account.