Privacy policy

This text is a translation. In case of any discrepancy, the Spanish version prevails.

Data controller

HOLA MARTECH, S.L. (Four Martech) · B67943563 · Av. d'Ernest Lluch, 32 (TecnoCampus Mataró-Maresme), 08302 Mataró (Barcelona) · Contact: info@fourmartech.es

What data we process and why

• Without an account: we do not ask for any data. The place you look up is used to answer you, and its coordinates are rounded to about 1 km before we request the forecast. That request is made by our server, not your browser, to Open-Meteo: it receives the rounded coordinates and, if you use the search box, the text you type. Never your IP address or who you are. The response may stay in the server's memory for a few minutes, not linked to you.
• With an account: your email, your name and your password (stored only as a cryptographic hash with scrypt, never in plain text), your preferred view and the date on which you accepted the legal notice and this policy. Also whatever you save: alerts (place and threshold), notebook cases and places in the professional sectors (plots, events, routes with their origin and destination). If you turn on email delivery, we send you your alerts and daily reports. Your session is stored only as a fingerprint, not the session code itself, and it expires after 30 days. Legal basis: performance of the service you ask us for.
• Teams: if you create or join a team, its members can see each other's name and email and the shared places. If you invite someone by email, we store their address to send them the invitation. The invitation expires after 7 days and is deleted 30 days after it expires.
• API keys: we store only their fingerprint and a visible prefix so you can recognise them, plus how many requests you make each day.
• Push notifications: if you turn them on, we store the subscription address your browser generates, its encryption keys and the browser identifier (user agent), so you can tell your devices apart. The content travels encrypted through your browser's notification service (Google, Mozilla, Apple or Microsoft). If a subscription stops working for a month, it is deleted. You can withdraw them in your browser settings.
• Ratings: if you answer “Was this useful?”, we store the rating, the comment, the view and the place you looked up, to improve the service. If you are signed in, they are linked to your account.
• Our own metrics: daily aggregate counters (for example, “requests in the simple view”), with no IP address or identifiers.
• Account use (pilot): when you are signed in, we record which days you visited and which professional sector you looked at (only the date and the sector). If you provide them, we also store your rating of each alert (“Did we get it right?”), the decisions you note under “Did it change anything?” and your answers to the final survey. This is used to measure whether the service is useful; only the administrators see it and it is deleted with the account.

Security and logs

• Your IP address: it is used in memory to limit login attempts and abuse of the service, and forgotten within an hour. It is not stored in the database.
• Web server access log: used to diagnose faults. It keeps a truncated IP address (only the first two blocks, which point to the provider's area, not to you), without the part of the address after “?” and without headers. It is deleted after 14 days.
• Service log: it may include your email address if a message addressed to you fails to send. It is deleted after 30 days.

Forgotten password

If you ask to recover your password, we email you a single-use link that expires after 1 hour. We store only a fingerprint of the link, not the link itself, and that fingerprint is deleted 7 days after it expires. The response is the same whether or not you have an account, so that nobody can find out who is registered.

Your location

Only if you tap 📍 and give permission does your browser tell us where you are. The position is rounded to about 1 km and serves only to request the forecast for that point, just like searching for a town. It is not linked to your account. You can withdraw permission in the site settings.

Cookies

• Session cookie (sid): a technical cookie, created only if you sign in to your account. It is essential for the account to work, so it does not require consent. It lasts 30 days.
• Google Analytics 4 analytics cookies (_ga and _ga_<ID>): only if you press “Accept” in the cookie notice. Until then, nothing from Google is loaded. They last 13 months.
• How our analytics is set up: no Google Signals and no ad personalisation. We do not send Google the part of the address after “?”, where coordinates or personal links may appear, except the view and the sector. Of the page you came from, only the domain. Google Analytics does not log or store IP addresses.
• Transfers: Google (Google Ireland Ltd. / Google LLC) may process data in the US. That transfer is covered by the EU-US Data Privacy Framework.
• Legal basis and how to withdraw: your consent. You can withdraw it at any time with the “Cookies” link in the page footer; when you do, we delete those cookies. Rejecting is as easy as accepting and changes nothing in the service.

Storage in your browser

These are not cookies. They do not require consent because they are needed for the website to work or they store preferences you choose.

• localStorage: your preferred view, the last place you looked up, the base map and theme, the guided tours you have already seen, the alerts we have already told you about (so we do not repeat the notice) and your choice about analytics cookies.
• sessionStorage (cleared when you close the tab): a team invitation you have yet to accept and the “answer the survey later” option.
• Service worker: keeps a copy of the app and of the latest “weather in your area”, so it works offline.

If you have an account, your preferred view and the places you save are also on our server.

Third-party services

• Google Cloud (Google Cloud EMEA Ltd.): hosts our server, in Madrid (EU).
• Our email provider (Nominalia): sends our emails: alerts, reports, password links and invitations.
• Open-Meteo: receives the rounded coordinates or the text you search for, from our server.
• OpenStreetMap / FOSSGIS (route calculation): receives the origin and destination of the routes you save in the transport sector, from our server.
• EFFIS (European Commission): receives the area of your forest plots, from our server.
• Map images (OpenStreetMap, Esri, RainViewer, EUMETSAT and EFFIS): requested by our server, which keeps them for a while. Those services do not receive your IP address or any of your data.
• Browser notification services: only if you turn on push notifications (see “What data we process and why”).
• Google Analytics: only with your consent (see Cookies). It is the only external service that your browser loads directly, and only if you accept.
• Ko-fi: if you make a donation, Ko-fi handles it on its own website, under its own privacy policy. We do not see or store your payment details; we only receive what Ko-fi tells us about the donation (name or alias, amount and message, if you leave one).

Retention

• Account data: for as long as you keep the account.
• Sessions: 30 days.
• Password link fingerprints: 7 days after they expire.
• Team invitations: 30 days after they expire.
• Web server access log: 14 days.
• Service log: 30 days.
• Database backups: 14 days.

Your rights

You can access, rectify, object to the processing of, erase, restrict or port your data by writing to info@fourmartech.es.

From the dashboard itself you can delete your account (menu under your name → “Borrar mi cuenta”). This deletes the account and everything linked to it, including your rating comments, the invitations you sent and the places you created, even if they are shared with your team. Only the aggregate counters remain, plus whatever is in backups and logs until they expire (14 and 30 days).

You can also lodge a complaint with the Spanish Data Protection Agency (AEPD).

Last updated: October 2026.