Regulations

We collect the following types of information when you use our applications (including LogSnap) and website (vartis-studio.com): • Account Information: When you create an account via Google Sign-In or email, we collect your name, email address, and authentication identifiers. You may also use the app anonymously without providing personal information. • Device Information: Device type, operating system version, unique device identifiers. • Usage Data: How you interact with our apps, features used, session duration. Collected via Firebase Analytics (with your consent). • Crash & Performance Data: Error logs and performance metrics collected via Firebase Crashlytics to improve app stability (with your consent). • Location Data (optional): GPS coordinates for geotagging scan sessions. Location access is requested at runtime and can be denied or revoked at any time. Location data is stored locally on your device and in your scan history. • Scan Data: Photos captured within the app, AI detection results, measurement data, and edit history. This data is stored locally on your device. • Training Data (opt-in): If you enable "Help Improve LogSnap" in Settings, anonymized scan images and detection results may be uploaded to our servers. GPS coordinates and personal identifiers are stripped before upload. • Feedback Data: If you submit feedback, we collect your message, category, device information, and optionally your email address and user ID via Firebase Firestore. • Billing Data: Subscription status, purchase history, and product identifiers are managed by Google Play Billing. We do not have access to your payment card details. Legal basis for data collection: Art. 6(1)(a) GDPR — consent (analytics, crash reporting, training data); Art. 6(1)(b) GDPR — contract performance (account, billing); Art. 6(1)(f) GDPR — legitimate interest in improving our services (device information).

We use collected information to: • Provide and operate our applications (account management, scan processing, measurement results) • Process subscriptions and manage your access to features • Improve and optimize our applications (analytics, crash reports) • Improve AI detection accuracy (anonymized training data, only with your consent) • Fix bugs and enhance performance • Respond to feedback and support requests • Comply with legal obligations We do not sell, trade, or share your personal data with third parties for marketing purposes. All data processing is carried out in accordance with the GDPR and applicable Polish data protection law (Ustawa o ochronie danych osobowych).

Our applications use AI models (YOLO-based segmentation) to provide their core functionality — detecting and measuring logs and wood stacks from camera images. Regarding AI data processing: • All AI inference runs locally on your device. No images are sent to external servers for processing. • AI detection results (log positions, sizes, measurements) are stored locally on your device. • If you opt in to "Help Improve LogSnap," anonymized scan images and detection results are uploaded to improve future model accuracy. GPS coordinates and personal identifiers are removed before upload. • Training data is not shared with third parties or used to train third-party AI models. • AI-generated measurements are estimates and should not be treated as certified measurements for legal or commercial purposes. Where AI processing involves personal data, we conduct Data Protection Impact Assessments (DPIA) as required under Art. 35 GDPR.

Our apps and website integrate with the following third-party services: • Firebase Authentication — account management (Google LLC) • Firebase Analytics — anonymized usage analytics, enabled only with your consent (Google LLC) • Firebase Crashlytics — crash and error reporting, enabled only with your consent (Google LLC) • Firebase Cloud Storage — training data uploads when opted in (Google LLC) • Firebase Firestore — feedback storage (Google LLC) • Firebase App Check — app integrity verification (Google LLC) • Google Play Billing — subscription and in-app purchase management (Google LLC) • Google Play Services (Android) • Google Analytics 4 (GA4) — website analytics using cookies (_ga, _ga_*, _gid), enabled only with your consent (Google LLC). Google's privacy policy: https://policies.google.com/privacy Firebase services process data in accordance with Google's data processing terms. Data may be processed in data centers within the EU/EEA or in the United States under appropriate safeguards (EU-US Data Privacy Framework). Each third-party service operates under its own privacy policy, which we encourage you to review. Where third-party processors are used, we ensure appropriate data processing agreements are in place as required by Art. 28 GDPR.

We retain your data for the following periods: • Account data: Until you delete your account. • Scan history and measurement data: Stored locally on your device. Deleted when you uninstall the app or clear app data. • Analytics data: Retained by Firebase Analytics for up to 14 months, then automatically deleted. • Crash reports: Retained by Firebase Crashlytics for up to 90 days. • Training data uploads: Retained indefinitely for model improvement. Since data is anonymized, it cannot be linked back to you. • Feedback data: Retained until you request deletion or delete your account. • Billing data: Retained as required by applicable tax and accounting regulations. You may request deletion of your data at any time by contacting us or using the "Delete Account" feature in the app.

We implement appropriate technical and organizational measures to protect your data, as required by Art. 32 GDPR, including: • Encryption in transit (TLS) for all data transmitted to Firebase services • Firebase App Check to prevent unauthorized access to backend services • Minimal data collection principle (data minimization per Art. 5(1)(c) GDPR) • Anonymization of training data before upload (GPS coordinates and personal identifiers removed) • Secure cloud infrastructure provided by Google Cloud Platform • Local-first architecture: scan data and measurements remain on your device unless you explicitly choose to share or upload them

Under the GDPR (Articles 15–22) and applicable Polish law, you have the right to: • Access the data we hold about you (Art. 15) • Rectification of inaccurate data (Art. 16) • Erasure of your data — "right to be forgotten" (Art. 17) • Restriction of processing (Art. 18) • Data portability (Art. 20) • Object to processing (Art. 21) • Withdraw consent at any time (Art. 7(3)) — you can disable analytics and crash reporting in the app's consent settings, and disable training data uploads in Settings To exercise these rights, contact us at krzysztof@vartis-studio.com. We will respond within 30 days as required by law. You can also delete your account directly within the app via Settings > Delete Account. You also have the right to lodge a complaint with the Polish supervisory authority — Prezes Urzędu Ochrony Danych Osobowych (PUODO), ul. Stawki 2, 00-193 Warsaw, Poland.

Our services are professional tools designed for the forestry industry and are not directed at children under 16 (as per Art. 8 GDPR and Polish implementation setting the age of digital consent at 16). We do not knowingly collect information from children under 16. If we discover that a child under 16 has provided us with personal information, we will promptly delete it.

Our website (vartis-studio.com) uses cookies — small text files stored on your device. We use the following types of cookies: Necessary cookies: These are essential for the website to function properly (e.g., storing your cookie consent preference). They do not require consent and cannot be disabled. • vartis_cookie_consent — stores your cookie preferences (365 days) Analytics cookies (require consent): These help us understand how visitors interact with our website through anonymized data collection via Google Analytics 4. • _ga — distinguishes unique users (2 years) • _ga_* — maintains session state (2 years) • _gid — distinguishes unique users (24 hours) Our mobile applications (LogSnap) do not use cookies. Firebase SDKs in the app use device identifiers for analytics and crash reporting, which are enabled only with your consent. Legal basis: Art. 6(1)(a) GDPR — consent. Analytics cookies are only set after you provide explicit consent through our cookie banner. You may withdraw consent at any time by clicking "Cookie Settings" in the website footer. You can also manage cookies through your browser settings. Note that disabling certain cookies may affect website functionality.