Privacy policy

Privacy Policy

Effective date: 13 August 2026
Version: 2.0

This website is operated by Roofless Labs Sàrl. Throughout this policy, the terms "we", "us" and "our" refer to Roofless Labs Sàrl, and "you" refers to the visitor, customer, or Deposit holder.

We respect your privacy and are committed to being transparent about how we handle your information. We collect as little as possible, and we do not track you.

1. Who We Are

Roofless Labs Sàrl is the data controller for the personal data described in this policy.

Roofless Labs Sàrl
1 rue des Photographes
1207 Geneva
Switzerland

General and privacy contact: contact@rooflesslabs.com Early Access Deposit contact: deposit@rooflesslabs.com

2. Which Law Applies

We are based in Switzerland and process personal data under the Swiss Federal Act on Data Protection (FADP).

Because we offer products to people outside Switzerland, the EU General Data Protection Regulation (GDPR) and the UK GDPR may also apply to you if you are located in the European Economic Area or the United Kingdom. Where they do, we handle your data in accordance with them and you have the rights described in the "Your Rights" section below.

If you are located elsewhere, including in the United States, we apply the same standard to your data. We do not sell personal information.

3. What We Collect and Why

3.1. Early Access Deposit

If you place an Early Access Deposit, we collect and keep:

• your email address
• your name
• your Deposit transaction record, including amount, date, order number, and status

Why: to operate the Early Access list, to notify you in advance of the first sale of the camera, to apply your discount, to process refunds, and to answer your questions about your Deposit.

Legal basis: performance of a contract with you (GDPR Art. 6(1)(b)), and compliance with our legal accounting obligations (GDPR Art. 6(1)(c)).

Emails we send you about your Deposit, including launch notifications and purchase instructions, are service communications that form part of what you paid for. They are not marketing, and they cannot be unsubscribed from while your Deposit is active. If you no longer wish to receive them, you can request a refund at any time, which closes your Deposit and removes you from the list.

3.2. Orders

If you purchase a physical product, your order is processed by Shopify. Shopify collects the information necessary to complete the transaction, including your name, email address, billing and shipping address, and payment details.

We do not receive or store your full payment card details.

Why: to process, fulfil, and support your order. Legal basis: performance of a contract, and legal accounting obligations.

For details on how Shopify handles data, see Shopify's Privacy Policy.

3.3. Waitlist and Newsletter

Our waitlist and newsletter signup forms are hosted by Typeform. When you sign up, the information you provide, such as your name and email address, is collected and stored by Typeform on our behalf.

Why: to keep you informed about the product and the company. Legal basis: your consent, which you may withdraw at any time by unsubscribing or by contacting us.

Joining the waitlist is separate from placing a Deposit. Placing a Deposit does not subscribe you to marketing, and unsubscribing from marketing does not remove you from the Deposit list.

See Typeform's Privacy Policy for details.

3.4. When You Contact Us

If you email us, we receive your email address and whatever information you choose to include in your message.

Why: to answer you and to keep a record of the exchange. Legal basis: performance of a contract where your message concerns an order or Deposit, otherwise our legitimate interest in responding to enquiries.

Our email is hosted by Google Workspace, which processes and stores messages on our behalf.

3.5. Technical Data

Our hosting provider and the third party services listed below may automatically log technical information when your browser requests a page or a file, including your IP address, browser type, and the time of the request. This is a normal function of how the web works and we do not use it to build a profile of you.

4. Cookies and Tracking

We do not use cookies to track you. There is no analytics on this site, no advertising tags, no tracking pixels, no social media widgets, and no third party analytics scripts. We do not build a profile of you, we do not measure your behaviour, and we do not follow you across other websites.

Some technical cookies may be set while you use the site. These come from the services that make it work, and they exist for one of the following reasons:

• Security and availability. Our hosting and content delivery providers may set cookies to detect bots, mitigate attacks, and route your request correctly.
• Checkout. Purchases and Early Access Deposits are handled at checkout.k4mera.world, which runs on our domain but is operated by Shopify on our behalf. Shopify sets cookies that keep your cart and session working, support the payment process, and prevent fraud and tampering. Details are published in Shopify's Privacy Policy.
• Forms. Typeform may set functional cookies on our waitlist and newsletter forms.

None of these are used for advertising, profiling, or measuring your behaviour, and none of them are shared with us for those purposes.

Cookies of this kind are strictly necessary to deliver a service you have specifically asked for, and are exempt from consent requirements under Article 5(3) of the ePrivacy Directive. Because we set no analytics, advertising, or profiling cookies, we do not display a cookie consent banner.

You can block or delete cookies through your browser settings at any time. Blocking strictly necessary cookies will prevent checkout from working.

5. Third Party Services

Our website relies on the following external services:

Service	Purpose	Location
Shopify	Payments, checkout, order and Deposit records	Canada and United States
Typeform	Waitlist and newsletter forms	European Union, with United States infrastructure
Google Workspace	Email correspondence	United States and European Union
Google Fonts	Typefaces	United States
cdnfonts	Typefaces	United States
FontAwesome	Icons	United States

Font and icon services receive your IP address when your browser requests a file from them. They do not receive your name, email address, or any information about your order or Deposit.

We do not use social media tracking pixels or embedded widgets.

6. International Transfers

Some of our service providers are located outside Switzerland and the European Economic Area, including in the United States. Where personal data is transferred to a country that does not offer an equivalent level of protection, we rely on the safeguards put in place by those providers, including Standard Contractual Clauses and, where applicable, certification under the EU-US and Swiss-US Data Privacy Framework.

7. Data Sharing

We do not sell, rent, or trade your personal information.

We share data only with the service providers listed in Section 5, who act on our instructions, and only to the extent necessary for them to perform their function.

We may also disclose data where required by law, by a court order, or by a competent authority, or where necessary to establish, exercise, or defend a legal claim.

If our business is transferred, including through our conversion to an SA, a reorganisation, a merger, or a sale of assets, your data may be transferred to the successor entity, which will remain bound by this policy or by a policy offering equivalent protection.

8. How Long We Keep Your Data

Deposit data is kept for as long as your Deposit is active. Because a Deposit may be held for a long time, this may be several years. Once your Deposit is refunded or cancelled, we remove you from the Early Access list.

Transaction records, including invoices, order records, and payment records for both Deposits and merchandise, are retained for ten years after the end of the relevant financial year, as required by Swiss accounting law (Art. 958f of the Swiss Code of Obligations). This obligation applies even after you ask us to delete your data. In that case we restrict the record so that it is used only to satisfy that legal obligation.

Waitlist and newsletter data is kept until you unsubscribe or ask us to delete it.

Email correspondence is kept for as long as needed to handle your request, and thereafter for a reasonable period in case of follow up or dispute.

9. Your Rights

You have the right to:

• access the personal data we hold about you
• correct data that is inaccurate or incomplete
• delete your data, subject to the retention obligations set out in Section 8
• object to processing based on our legitimate interests
• restrict processing in certain circumstances
• withdraw consent at any time, where processing is based on consent, without affecting the lawfulness of processing carried out before withdrawal
• receive your data in a structured, commonly used, machine-readable format, and have it transmitted to another controller where technically feasible

To exercise any of these rights, write to contact@rooflesslabs.com. We will respond within 30 days. We may ask you to confirm your identity, normally by writing from the email address on file.

9.1. Deletion and Your Deposit

Your place on the Early Access list exists only because we hold your email address. If you ask us to delete your personal data while you hold an active Deposit, we cannot keep you on the list. We will therefore treat your request as a request for a refund of your Deposit, refund you, and cancel your priority access and your discount.

If you would rather keep your Deposit, tell us and we will explain your options before acting.

As set out in Section 8, the underlying transaction record cannot be deleted, because Swiss accounting law requires us to keep it.

10. Complaints

If you believe we have handled your data improperly, please contact us first so that we can try to resolve it.

You also have the right to lodge a complaint with a supervisory authority. In Switzerland, that is the Federal Data Protection and Information Commissioner (FDPIC). If you are in the European Economic Area or the United Kingdom, you may complain to the supervisory authority in your country of residence.

11. Security

We keep the amount of data we hold deliberately small. Payment data is handled entirely by Shopify and never reaches our own systems. Access to the Early Access list is limited to the people at Roofless Labs who need it.

No method of transmission or storage is completely secure, and we cannot guarantee absolute security.

12. Children

Our products and this website are not directed at children. We do not knowingly collect personal data from anyone under 18. If you believe a minor has provided us with personal data, contact us and we will delete it.

13. Automated Decision-Making

We do not use automated decision-making or profiling that produces legal effects or similarly significant effects for you.

14. Changes to This Policy

We may update this policy from time to time. The current version is always published on this page with its effective date.

If we make a material change that affects Deposit holders, we will notify them by email at the address on file.

Last updated: 13 August 2026