Privacy policy

This text is a translation. In case of any discrepancy, the Spanish version prevails.

Data controller

HOLA MARTECH, S.L. (Four Martech) · B67943563 · Av. d'Ernest Lluch, 32 (TecnoCampus Mataró-Maresme), 08302 Mataró (Barcelona) · Contact: info@fourmartech.es

What data we process and why

• Without an account: we do not ask for any data. The place you look up is used to answer you, and its coordinates are rounded to about 1 km before we request the forecast. That request is made by our server, not your browser, to Open-Meteo: it receives the rounded coordinates and, if you use the search box, the text you type. Never your IP address or who you are. The response may stay in the server's memory for a few minutes, not linked to you.
• With an account: your email, your name and your password (stored only as a cryptographic hash with scrypt, never in plain text), your preferred view and the date on which you accepted the legal notice and this policy. Also whatever you save: alerts (place and threshold), notebook cases and places in the professional sectors (plots, events, routes with their origin and destination). If you turn on email delivery, we send you your alerts and daily reports. Your session is stored only as a fingerprint, not the session code itself, and it expires after 7 days without use and, at most, after 30 days. Legal basis: performance of the service you ask us for.
• Teams: if you create or join a team, its members can see each other's name and email and the shared places. If you invite someone by email, we store their address to send them the invitation. The invitation expires after 7 days and is deleted 30 days after it expires.
• API keys: we store only their fingerprint and a visible prefix so you can recognise them, plus how many requests you make each day.
• Push notifications: if you turn them on, we store the subscription address your browser generates, its encryption keys and the browser identifier (user agent), so you can tell your devices apart. The content travels encrypted through your browser's notification service (Google, Mozilla, Apple or Microsoft). If a subscription stops working for a month, it is deleted. You can withdraw them in your browser settings.
• Ratings: if you answer “Was this useful?”, we store the rating, the comment, the view and the place you looked up, to improve the service. If you are signed in, they are linked to your account.
• Our own metrics: daily aggregate counters (for example, “requests in the simple view”), with no IP address or identifiers.
• Account use (pilot): when you are signed in, we record which days you visited and which professional sector you looked at (only the date and the sector). If you provide them, we also store your rating of each alert (“Did we get it right?”), the decisions you note under “Did it change anything?” and your answers to the final survey. This is used to measure whether the service is useful; only the administrators see it and it is deleted with the account.
• Your places and the morning summary: the places you save (up to 10, with the name you give them and their coordinates rounded to about 1 km). If you turn on the morning summary for a place, also the time you want it and your language. Without an account, places stay only in your browser.
• Email confirmation: when you sign up we send you a single-use link that expires in 48 hours. We store only its fingerprint, not the link, and how many you have requested that day (so nobody can use the resend button against someone else's inbox).
• Evening-before report: if you sign up for it, we store which cases from the sectors you want, the time and the language, and which days we have sent it.
• Telegram (optional): if you link your account to our bot, we store your chat identifier, your Telegram username and your language, and whether you want your alerts there. Messages go through Telegram, under its own privacy policy. When you unlink it (from the panel or with /desvincular) we delete it. If you only ask the bot for the weather without linking anything, the last place you asked for is kept in memory until the server next restarts.
• Calendar (optional): if you create the calendar link, we store only its fingerprint. Anyone with the link can see the forecast for your places, so do not share it; you can revoke or change it at any time.
• “The weekend” (optional): if you turn it on, we store the time you want it and which weeks we have sent it (that record is deleted after 62 days).
• Language: with an account, we store the language you use the website in, to send you emails and notifications in that language.
• Local councils and civil protection: if your team uses the council report, we store its critical points (name, type and location) and which staff want its alerts. An account can belong to several teams (up to 10).
• “What's the weather like where you are?”: if you tell us what the weather is like, we store what you chose (rain, snow, hail, fog, sun, clouds or strong wind), the approximate location (rounded to about 1 km; your device's, if you allow it, or that of the place selected on the website) and the time. No account is needed. To prevent abuse we also store an encrypted fingerprint of your network, which does not reveal your IP address and is deleted after 48 hours, and, if you are signed in, which account it belongs to. For one hour the observation is shown on the map, with no data about you. We also use it, without personal data, to check how accurate the radar and our forecasts are. It is deleted after 30 days, or earlier if you delete your account. Legal basis: legitimate interest in providing and improving the service (Art. 6(1)(f) GDPR).
• Share as an image: the image is created in your browser; it is not sent to any server.
• School mode (class challenge): if you are a teacher, you can create classes with your account: we store the name you give them, the school's location (rounded to about 1 km) and the language. Pupils take part with no account and no personal data: they only type an invented nickname within the class and their forecast of the next day's maximum temperature and whether it will rain. So that nobody can change another nickname's forecast, we keep for two days a fingerprint of a random number generated by their browser. The class's observations are those of “What's the weather like where you are?”, at the school's location. Each class, with its nicknames and forecasts, is deleted automatically on 31 July of the school year, or earlier if the teacher deletes it or their account. Legal basis: performing the service the teacher requests and, for pupils, our legitimate interest in offering an educational activity with minimal, pseudonymous data. We recommend that teachers ask for nicknames that do not identify pupils.

Security and logs

• Your IP address: it is used in memory to limit login attempts and abuse of the service, and forgotten within an hour. It is not stored in the database.
• Web server access log: used to diagnose faults. It keeps a truncated IP address (only the first two blocks, which point to the provider's area, not to you), without the part of the address after “?” and without headers. Nor does it keep the secret part of calendar links. It is deleted after 14 days.
• Service log: it may include your email address if a message addressed to you fails to send. It is deleted after 30 days.

Forgotten password

If you ask to recover your password, we email you a single-use link that expires after 1 hour. We store only a fingerprint of the link, not the link itself, and that fingerprint is deleted 7 days after it expires. The response is the same whether or not you have an account, so that nobody can find out who is registered.

Your location

Only if you tap 📍 and give permission does your browser tell us where you are. The position is rounded to about 1 km and serves only to request the forecast for that point, just like searching for a town. It is not linked to your account. You can withdraw permission in the site settings.

Cookies

• Session cookie (__Host-sid): a technical cookie, created only if you sign in to your account. It is essential for the account to work, so it does not require consent. It expires after 7 days without use and, at most, after 30 days.
• “Do not count” cookie (atlas_nocuenta): a technical cookie used only by the service team, who switch it on in their own browsers so that their visits and tests do not add to the usage statistics. It contains no personal data and lasts one year or until switched off. It is never created for you.
• Widget for other websites: it uses no cookies or analytics and stores nothing about whoever views it.
• Technical errors: if the website fails in your browser, we anonymously receive the error message, the file and line of the website where it happened, the page (without parameters) and the browser and system family (for example, “Chrome · Android”). We do not store your IP, your account or your place, and each error is forgotten after 14 days without repeating.
• My trip: if you save a trip, we store its name, the origin and destination (coordinates to about 10 m), the departure and return times, the days and how you travel. We only use them to check the weather along your way shortly before you leave and warn you if needed. We don't share them with anyone or use them for anything else. They are deleted when you delete the trip or your account. Of each alert we only keep that it was checked that day, for 31 days, so it isn't repeated.
• Event pages: if you create an event page, we store what you enter (event name, place and its coordinates, dates, type, whether you have a plan B and whether you want it to appear in search engines) linked to your account, to show the page to anyone with the link. By default the page does not appear in search engines; it only does if you tick that box. It is deleted automatically 7 days after the event ends, when you delete it or when you delete your account. We keep nothing about the people who visit the page.
• The Sage: “The Sage says…” is a text written by an artificial intelligence (Claude, by Anthropic) from the weather data Atlas already computes for your area. Only that area's weather data (temperatures, rain, official warnings and the like) is sent to Anthropic, never your exact location, your IP address or your account details. The same text is shared with everyone in the area and stored to measure how accurate it is.
• Google Analytics 4 analytics cookies (_ga and _ga_<ID>): only if you press “Accept” in the cookie notice. Until then, nothing from Google is loaded. They last 13 months.
• How our analytics is set up: no Google Signals and no ad personalisation. We do not send Google the part of the address after “?”, where coordinates or personal links may appear, except the view and the sector. Of the page you came from, only the domain. Google Analytics does not log or store IP addresses.
• Transfers: Google (Google Ireland Ltd. / Google LLC) may process data in the US. That transfer is covered by the EU-US Data Privacy Framework.
• Legal basis and how to withdraw: your consent. You can withdraw it at any time with the “Cookies” link in the page footer; when you do, we delete those cookies. Rejecting is as easy as accepting and changes nothing in the service.

Storage in your browser

These are not cookies. They do not require consent because they are needed for the website to work or they store preferences you choose.

• localStorage: your preferred view, the last place you looked up, the base map and theme, the guided tours you have already seen, the alerts we have already told you about (so we do not repeat the notice) and your choice about analytics cookies. Without an account, also your saved places.
• sessionStorage (cleared when you close the tab): a team invitation you have yet to accept and the “answer the survey later” option.
• Service worker: keeps a copy of the app and of the latest “weather in your area”, so it works offline.

If you have an account, your preferred view and the places you save are also on our server.

Third-party services

• Leaseweb (Leaseweb Netherlands B.V.): hosts our server, in Amsterdam (Netherlands, EU).
• Google Drive (Google Ireland Ltd.) and OneDrive (Microsoft Ireland Operations Ltd.): store encrypted backups for 14 days. Only we hold the key to open them, so they cannot read their contents. They may store them outside the EU; that transfer is covered by the EU-U.S. Data Privacy Framework.
• Our email provider (Nominalia): sends our emails: alerts, reports, password links and invitations.
• Open-Meteo: receives the rounded coordinates or the text you search for, from our server (also for air quality, pollen and the climate normal).
• Anthropic (Anthropic PBC, USA): for «The Sage says…», receives from our server only weather data for an area (temperatures, rain, official warnings and the like). No personal data: not your location, your IP or your account.
• Telegram (Telegram FZ-LLC): only if you use our bot; it receives the messages you write to it and those we send you.
• OpenStreetMap / FOSSGIS (route calculation): receives the origin and destination of the routes you save in the transport sector, from our server.
• EFFIS (European Commission): receives the area of your forest plots, from our server.
• Map images (OpenStreetMap, Esri, RainViewer, EUMETSAT and EFFIS): requested by our server, which keeps them for a while. Those services do not receive your IP address or any of your data.
• Browser notification services: only if you turn on push notifications (see “What data we process and why”).
• Google Analytics: only with your consent (see Cookies). It is the only external service that your browser loads directly, and only if you accept.
• Ko-fi: if you make a donation, Ko-fi handles it on its own website, under its own privacy policy. We do not see or store your payment details; we only receive what Ko-fi tells us about the donation (name or alias, amount and message, if you leave one).

Retention

• Account data: for as long as you keep the account.
• Sessions: 7 days without use and, at most, 30 days.
• Record of “The weekend” messages: 62 days.
• Password link fingerprints: 7 days after they expire.
• Team invitations: 30 days after they expire.
• Web server access log: 14 days.
• Service log: 30 days.
• School mode classes, with their nicknames and forecasts: until 31 July of the school year (the device fingerprint, 2 days).
• “What's the weather like where you are?” observations: 30 days (your network fingerprint, 48 hours).
• Fingerprints of email confirmation links: 7 days after they expire.
• Database backups: 14 days.

Your rights

You can access, rectify, object to the processing of, erase, restrict or port your data by writing to info@fourmartech.es.

From the dashboard itself you can delete your account (menu under your name → “Borrar mi cuenta”). This deletes the account and everything linked to it, including your rating comments, the invitations you sent and the places you created, even if they are shared with your team. Only the aggregate counters remain, plus whatever is in backups and logs until they expire (14 and 30 days).

You can also lodge a complaint with the Spanish Data Protection Agency (AEPD).

Last updated: November 2026.