Privacy Policy
putch.ch website · PUTCH Scan app (web and iOS) · Customer account · Version 2 — 25 September 2026
PUTCH designs made-to-measure garments from your measurements. This data describes your body: we handle it with the care that requires, and here we tell you exactly what we do with it — on the website, in the PUTCH Scan app and in your customer account. This policy applies under Swiss law (revised FADP) and, for people residing in the European Union, in accordance with the GDPR.
In short. With PUTCH Scan, the photos taken for the scan are turned on your device into black-and-white silhouettes, with no face or recognisable detail; those silhouettes, your measurements and your declared height, weight and sex are what is sent to our servers in Switzerland. Body data is used only to design your garment and stays in Switzerland. You can delete a scan at any time from the app.
1. Data controller
Pierre-Emmanuel Saurais, PUTCH, Rue du Progrès 18, 2300 La Chaux-de-Fonds, Switzerland. For any question or request: hello@putch.ch.
2. Which data and why
| Processing | Data | Purpose |
|---|---|---|
| Account | E-mail, first and last name, phone, gender, date of birth, profile photo, language, address; password (hashed, never readable by us). | Create and manage your account, contact you about your orders. |
| Orders | Delivery address, items, amounts, history, digital product passport. | Make, deliver and invoice your garment; provide follow-up and warranty. |
| Measurements and scans | Body measurements, black-and-white silhouettes, declared height, weight and sex, 3D model and shape parameters, morphopass (identifier of your set of measurements), device and app version. | Design a pattern to your measurements; let you find your scans and avatar again; diagnose anomalies. |
| 3DLook scan (legacy) | For scans made with our former provider 3DLook: e-mail, measurements, 3D model transmitted by 3DLook. | Keep the measurements already taken for your orders. |
| Visit statistics | Account identifier if you are signed in, pages viewed, city and country derived from the IP address, device type, browser, language, visit source. No advertising cookies. | Measure the website’s audience and understand how it is used — only after your consent. |
| Invitations | First name, last name, e-mail or phone of the invited person, entered by the referrer; name of the referrer. | Send and personalise the invitation, link the referral. Kept 12 months. |
| PUTCH LAB events | Registration, chosen pack, amount, optional message. | Organise events and support packs, confirm your registration. |
| Support | Messages exchanged with PUTCH, in the app or by e-mail. | Answer your requests and keep a record of them. |
We do no advertising tracking and never sell or rent any data.
3. Legal basis of each processing
- Performance of the contract: account, orders, delivery, invoicing, events.
- Explicit consent: body measurements and scans. We treat them as sensitive data; consent is requested at the first scan, recorded with its date and version, and can be withdrawn at any time. Visit statistics: only after your consent in the banner provided for that purpose.
- Legitimate interest: support, security of the service, fraud prevention, access logging.
- Legal obligation: retention of accounting records (orders, invoices).
4. Retention periods
| Data | Period |
|---|---|
| Account | As long as the account is active, then 3 years. |
| Scans and silhouettes | 24 months after the last scan, or immediately on request (deletion possible from the app). |
| Orders and invoices | 10 years (Swiss accounting obligation). |
| Visit statistics | 13 months. |
| Invitations | 12 months. |
| Consents | Lifetime of the account, then 3 years (proof of consent). |
5. Recipients and processors
Your data can only be read by you and by the people at PUTCH who prepare your garment or answer your requests. We use the following providers, bound by contract:
| Provider | Role | Country |
|---|---|---|
| Supabase | Database, authentication, storage (AWS Zurich region). | Switzerland |
| Infomaniak | Website hosting and e-mail. | Switzerland |
| Stripe | Payment (card, TWINT). PUTCH never sees your card data. | EU / United States |
| 3DLook | Smartphone body scan, for scans made with this provider (your e-mail is transmitted to it to link the scan to your account). | United States |
| Vercel | Hosting of PUTCH’s internal application. | United States |
| GitHub | Code and technical backups. | United States |
| Apple TestFlight | Distribution of the iOS test app. | United States |
| Fonts and detection models loaded by the browser. | United States | |
| jsDelivr | Software libraries loaded by the browser. | United States |
| ipapi.co | Approximate geolocation of the IP address for statistics (after consent). | United States |
| ntfy.sh | Internal notifications to the team, with no body data or contact details. | Germany / United States |
We may also disclose data where the law requires it (authorities, courts).
6. Transfers outside Switzerland
Some providers are established in the United States or in the European Union. These transfers rely on the Swiss-US Data Privacy Framework where the provider is certified under it, or on the standard contractual clauses recognised by the Federal Commissioner. Your body data (measurements, silhouettes, 3D models) remains hosted in Switzerland, except for scans made with 3DLook, which are processed by that provider in the United States.
7. Security
- Encryption of all exchanges (HTTPS) and of data at rest with our host.
- Row-level access control in the database: each person only accesses their own data.
- Logging of access and of sensitive changes.
- Regular, encrypted backups.
- Your session credentials are kept in your device’s secure storage.
8. Your rights
You can at any time request access to your data, its rectification, its erasure, its portability (a copy in a readable format), object to a processing or withdraw your consent — without affecting processing already carried out.
- How: write to hello@putch.ch from your account’s e-mail address. We reply within 30 days.
- Scans: you can delete each scan directly from the app.
- Complaint: you may contact the Federal Data Protection and Information Commissioner (FDPIC, Bern) and, if you reside in the European Union, the data protection authority of your country.
9. Minors
The service is intended for people aged 16 and over. Below that age, the consent of a parent or legal guardian is required; we delete any data collected without that consent as soon as we become aware of it.
10. Cookies and local storage
- No third-party cookies, no advertising cookies.
- Your browser’s local storage is used to keep your session and preferences (language, consent choice).
- Visit statistics are only enabled after your consent in the banner; you can withdraw it by clearing the site’s data in your browser.
11. Changes
Any change to this policy is published on this page with its date and version number. A substantial change is notified to you by e-mail or in the app.
Version 2 — 25 September 2026