Privacy Policy

This Privacy Policy explains how personal data is processed in connection with the website treeai.earth and its subpages (the "website"). The website is operated by the Forest Resources Management group at ETH Zurich for the TreeAI Global Initiative, a non-commercial research project. The privacy policy of ethz.ch does not apply to this website.

1. Controller and contact

Data Protection Officer:

2. General information

We process personal data in accordance with the Swiss Federal Act on Data Protection (FADP). We process as little personal data as possible and retain it only as long as necessary for the respective purpose or as required by law.

3. Provision of the website and server logs

The website is hosted by Vercel Inc. Each time the website is accessed, the following data is recorded automatically: IP address, date and time of access, requested page, referring page, browser type and operating system. This data is processed to deliver the website, to ensure the security and stability of the systems and to detect and prevent attacks. It is not used to create user profiles.

We do not use analytics, advertising or tracking tools.

4. User accounts

Registration requires an email address and a password. We process the email address, the account identifier and the access level of the account. The password is stored exclusively in hashed form. The account is used to provide access to downloads and to the user's submission history. The data is stored for as long as the account exists.

5. Data submissions and uploaded content

Users can contribute tree annotations and imagery to the TreeAI database. When data is submitted, we process the names of the contributors, email address, affiliation, country, year, chosen licence, consent to harmonization and publication (the wording agreed to and when), remarks and the uploaded files (for example shapefiles, images and annotations).

This data is processed to review the submission, to communicate with the contributor, to attribute the data and, subject to the contributor's consent, to offer co-authorship in TreeAI publications. The files and a metadata file with the contributor's details are stored with Dropbox, in a folder named after the contributor. A record of the submission is stored in the project database. The project team receives a notification by email, and the contributor is informed by email when the status of the submission changes. Species names contained in the files are validated against the species database of the Global Biodiversity Information Facility (GBIF); only the species names are transmitted.

Where data is published, the names and affiliations of the contributors may be published with it, in accordance with the chosen licence.

Please avoid uploading personal data. Uploaded files may contain precise geographic coordinates. If uploaded data shows identifiable persons or allows conclusions about private property, it is the responsibility of the contributor to obtain the necessary consent in advance or to anonymise or generalise the data. Affected persons may request the removal of such data by contacting us.

6. Downloads

Downloads require a user account. For each download, we record the account identifier, the file, its size and the time. This data is processed to document the use of the data and to enforce a daily download limit. Files are delivered by means of a link that is valid for one hour.

7. Contact

When you contact us through the contact form or by email, your details (name, email address, optional affiliation, purpose and message) are processed to handle your enquiry. Messages from the contact form are transmitted to the form service Web3Forms and forwarded to the project team by email. Emails to addresses at treeai.earth are forwarded by ImprovMX to the team mailbox hosted by GMX. The data is deleted once the enquiry has been dealt with, unless there is a legal obligation to retain it.

8. Content from third-party providers

Certain pages load content directly from third-party providers. When such content is loaded, the browser transmits the IP address and technical request data to the respective provider. This concerns:

• Google Fonts (typeface), on all pages;
• Google Maps (maps), on the dataset map and product pages;
• Google Earth Engine (map layers and statistics), and Google Earth Engine Apps embedded on certain product pages and operated on Google's servers;
• geodata services of the Federal Office of Topography swisstopo (place search, canton boundaries, base maps); search terms entered in the place search are transmitted to this service;
• Esri (map labels) and unpkg (map library), on the height explorer page;
• jsDelivr (formula rendering library), on certain pages;
• ETH Zurich (form.ethz.ch), for the TreeAI logo.

These providers process the data under their own responsibility and terms, in particular the Google Privacy Policy. The location function ("locate me") requests the position of the device from the browser; the position is processed only in the browser and is not transmitted to us.

9. Cookies and local storage

This website does not set cookies. The following data is stored in the local storage of the browser. It remains on the device until it is deleted by the user and is only used when the related function is used:

• display settings (theme and language);
• the login session;
• the most recent entries in the submission form (name, affiliation, email address, country, licence) and a list of past submissions, to pre-fill the form;
• temporary access tokens and map data caches, which contain no personal data.

Local storage can be cleared in the browser settings at any time; the login and form pre-filling will then no longer be available. Embedded third-party content (Google Maps, Google Earth Engine Apps) may store data in the browser in accordance with the terms of its provider.

10. Recipients of data

Personal data is disclosed to third parties only where required by law, where necessary to provide the services of this website, or with your consent. We do not sell personal data or use it for advertising. We engage the following service providers:

Vercel Inc.

Purpose: hosting of the website and server functions.
Data: server logs (IP address, time, browser), requests to the server functions.
Location: USA, global network.

Supabase

Purpose: user accounts, project database, email notifications.
Data: email address, account identifier, submission records, download records.
Location: Switzerland (data stored in Zurich).

Dropbox

Purpose: storage of submitted data.
Data: uploaded files and metadata (contributor names, email address, affiliation).
Location: USA.

Resend

Purpose: dispatch of notification emails.
Data: name and email address of the contributor, details of the submission.
Location: Ireland (EU).

Cloudflare

Purpose: storage and delivery of download files.
Data: IP address when a file is downloaded.
Location: files stored in the EU.

Web3Creative (Web3Forms)

Purpose: contact form.
Data: name, email address, affiliation, purpose and message; IP address.
Location: India; sub-processors in the USA and the EU. Stored submissions are deleted after three years at the latest.

ImprovMX

Purpose: forwarding of emails sent to addresses at treeai.earth.
Data: emails and their metadata.
Location: USA and Europe.

1&1 Mail & Media GmbH (GMX)

Purpose: team mailbox.
Data: emails and form messages received.
Location: Germany (EU).

Google LLC

Purpose: typeface, maps and Google Earth Engine.
Data: IP address, technical request data, map interactions.
Location: USA, global network.

11. Disclosure abroad

Personal data may be disclosed to recipients in the European Union, the United States of America and India. The countries of the European Union provide an adequate level of data protection according to Annex 1 of the Swiss Data Protection Ordinance. Recipients in the United States of America (Vercel, Dropbox, Cloudflare, Google) are certified under the Swiss-U.S. Data Privacy Framework, for which the Federal Council has recognised an adequate level of data protection. For recipients in other countries, in particular Web3Creative (India), data is disclosed on the basis of the Standard Contractual Clauses of the European Commission.

12. Data security

We take appropriate technical and organisational measures to protect personal data against unauthorised access, loss and misuse. All connections to the website are encrypted (HTTPS). Access to the database is restricted so that signed-in users can only access their own records. Download files are kept in non-public storage and are accessible only through time-limited links.

13. Your rights

Within the scope of the applicable data protection law, you have the right to:

• request information as to whether and which personal data concerning you is processed;
• request the correction of inaccurate personal data;
• request the deletion of your personal data, including the deletion of your user account;
• object to the processing of your personal data or request its restriction;
• receive personal data you have provided in a common electronic format;
• withdraw your consent at any time with effect for the future.

To exercise these rights, please contact us at admin@treeai.earth or the Data Protection Officer (section 1). Proof of identity may be required. Legal obligations to retain data remain reserved.

You also have the right to lodge a complaint with the Federal Data Protection and Information Commissioner (FDPIC), Feldeggweg 1, 3003 Bern, Switzerland (www.edoeb.admin.ch).

14. Changes to this Privacy Policy

We may amend this Privacy Policy as necessary. The current version is published on this website. Registered users may be informed of material changes by email.