Privacy Policy

The data controller for this website and for the Granite platform is Connectance, reachable at hello@connectance.ch and at www.connectance.ch.

Where Connectance processes personal data on behalf of a humanitarian organisation that is itself a data controller (for example, when an NGO uses Granite SaaS to register beneficiaries), Connectance acts as a data processor under that organisation’s instructions.

This website is informational. It does not have user accounts, does not run analytics or advertising trackers, and does not set third-party cookies.

• Local storage. We store two values in your browser’s local storage: your light/dark theme preference and your cookie-notice choice. Neither is transmitted to us. You can clear both at any time from your browser settings, or reopen the notice via “Cookie settings” in the footer.
• Contact form. The contact form opens your own email client with a pre-filled message. Nothing you type is sent to or stored on our servers until you choose to send the email yourself.
• Server logs. Our hosting provider may keep standard, short-lived access logs (IP address, user agent, requested URL) for security and abuse prevention.

Depending on how you use the Granite Services, we may collect the following categories of personal data:

We do not collect precise GPS coordinates or continuously track your location. When location services are enabled within the app, location is used only on your device to show nearby services and is not transmitted to or stored on our servers.

• Providing the Services. Creating and maintaining your account, generating your Personal ID, enabling you to discover and access humanitarian services, and processing referrals between organisations.
• Consent management. Recording and honouring your data sharing preferences, so that only the organisations you authorise can access your profile fields.
• Security. Detecting and preventing fraudulent registrations, account takeovers, and misuse of the platform.
• Platform improvement. Analysing aggregate, anonymised usage data to improve the Services. We do not use identifiable personal data for this purpose.
• Legal compliance. Fulfilling obligations under applicable data protection and humanitarian standards.

You may optionally register one or more emergency contacts within the Granite app. Emergency contacts are individuals you have chosen to be reached in the event of an emergency affecting you.

• Emergency contact information is stored securely in the Granite Registry, accessible only to Connectance and to partner organisations with a specific organisational agreement covering emergency response.
• Emergency contacts will only be contacted when Connectance or an authorised partner organisation receives credible information suggesting an emergency involving your safety, wellbeing, or whereabouts — for example, if a field worker reports that you are in danger, if you trigger an in-app emergency alert, or if your account is flagged following a documented crisis event in your area.
• Emergency contact data is not shared with organisations for general service delivery, data matching, referral management, or any purpose other than the emergency communication purpose described above.
• You may add, edit, or remove emergency contacts at any time from the Profile section of the Granite app.

By adding an emergency contact, you confirm that you have obtained the consent of that individual to store and potentially use their contact information as described.

We do not sell your personal data. We share it only in the following circumstances:

• Authorised organisations. When you grant consent to a humanitarian organisation using Granite SaaS, that organisation can access only the profile fields you have authorised. All access is logged and auditable by you.
• Service providers. We use third-party infrastructure providers (cloud hosting, database services) who process data on our behalf under data processing agreements. As of the effective date, our primary infrastructure providers are Supabase (database) and Railway (application hosting).
• Legal requirements. We may disclose data if required to do so by law, court order, or in response to a lawful request by a public authority. We will notify you of such requests to the extent permitted by law.
• Business transfers. If Connectance is acquired or merges with another organisation, your data may be transferred as part of that transaction. We will notify you before your data is transferred to a new data controller or becomes subject to a different privacy policy.

For users in Switzerland (FADP), the European Economic Area and United Kingdom (GDPR), or other jurisdictions with equivalent laws, we process your personal data on the following legal bases:

• Consent (Art. 6(1)(a) GDPR): for data sharing with third-party organisations, for emergency contact storage, and for optional features such as location services.
• Contract performance (Art. 6(1)(b) GDPR): for providing your account, generating your Personal ID, and delivering the core Services.
• Legitimate interests (Art. 6(1)(f) GDPR): for platform security, fraud prevention, and aggregate analytics. We do not override your fundamental rights with these interests.
• Legal obligation (Art. 6(1)(c) GDPR): where applicable law requires us to retain or disclose data.

We retain personal data for as long as your account is active. If you request deletion of your account:

• Your profile data and Personal ID record will be anonymised within 30 days of the confirmed deletion request.
• Emergency contact data will be deleted within 30 days of account deletion.
• Consent logs and audit records may be retained for up to 7 years to satisfy legal and organisational accountability obligations.
• Data held by third-party organisations (to whom you previously granted access) is subject to those organisations’ own retention policies. You should contact them directly to exercise deletion rights over their copies of your data.

• Access — request a copy of the data we hold about you.
• Rectification — correct inaccurate or incomplete data.
• Erasure — request deletion of your data (“right to be forgotten”).
• Restriction — request that we limit how we process your data in certain circumstances.
• Portability — receive your data in a structured, machine-readable format.
• Objection — object to processing based on legitimate interests.
• Withdraw consent — withdraw any consent you have given at any time, without affecting the lawfulness of prior processing.

Many of these rights can be exercised directly within the Granite app (Profile → Privacy). To submit a formal request, contact us at hello@connectance.ch. We will respond within 30 days.

You also have the right to lodge a complaint with your local data protection authority — in Switzerland, the Federal Data Protection and Information Commissioner (FDPIC).

• Encryption at rest and in transit (TLS 1.2+); this website is served over HTTPS only with HSTS enabled.
• Authentication tokens stored in device secure storage (never in plain localStorage or cookies).
• Role-based access control within Connectance systems.
• Regular security assessments of infrastructure providers.

No security system is infallible. If you believe your data has been compromised, contact us immediately at hello@connectance.ch.

The Granite platform is not directed to children under 16 years of age as independent users. Children may be registered as part of a household record managed by a parent or guardian. We do not knowingly collect personal data directly from children as primary account holders without parental consent.

Your data may be processed in countries other than the country in which you reside. When we transfer data internationally, we ensure appropriate safeguards are in place, such as Standard Contractual Clauses or equivalent mechanisms recognised under applicable law.

We may update this Privacy Policy as our Services evolve or as legal requirements change. We will notify platform users of material changes via email or in-app notification at least 14 days before they take effect. The effective date at the top of this page will always reflect the most recent revision.

For any questions about this Privacy Policy or to exercise your rights, contact our team at:

Connectance
hello@connectance.ch
www.connectance.ch

See also our Terms of Service.