Privacy Policy

1. Who we are

Meteoscience OÜ ("Meteoscience," "we," "us") is the data controller for the personal data described in this policy. We are registered in Estonia, Registry Code 17543147, legal domicile Pudisoo küla, Kuusalu vald, Harju maakond, 74626, Estonia. You can reach us at info@meteoscience.com for any privacy question or request.

2. What data we collect, and why

We collect meaningfully less personal data than most SaaS products, because most of what our products do runs on public weather data, not personal data. Specifically:

• Climate Risk Report Portal. When you submit an address or place name to generate a report, that text is sent to Open-Meteo's Geocoding API and, as a fallback, OpenStreetMap's Nominatim service, to resolve it into coordinates. We do not store submitted addresses in a database — but if report generation fails, the address may appear temporarily in our hosting provider's server error logs for debugging, and is not otherwise analyzed, sold, or retained beyond ordinary log rotation.
• S2S Energy Weather Widget — subscriptions. If you subscribe to the licensed tier, our payment processor, Stripe, collects your name, email address, billing address, and payment details directly — we never see or store your full card number. Stripe shares with us your name, email, and a Stripe customer identifier, which we use to recognize your account, keep your subscription active, and let you manage billing.
• Authentication. We use two first-party session cookies to keep you logged in — see our Cookie Policy for details. No personal data beyond a signed session token is stored in either.
• Server logs. Like virtually all websites, our hosting provider (Vercel) logs standard web request metadata (IP address, timestamp, requested URL) for security, abuse prevention, and operating the service.
• LightningSentry — location. With your permission, the app uses your device's GPS location (including, if you separately grant it, background location while an outdoor session is active) to calculate your distance from publicly reported lightning strikes and to trigger local proximity alerts. This calculation happens entirely on your device — your location is never transmitted to Meteoscience or any third party. The app's only network request is an anonymous, unauthenticated read of a public strike-data file; no location, device identifier, or other personal data is sent as part of it.
• LightningSentry — notifications. Sound and push-style alerts are generated locally on your device (via the operating system's local notification APIs) based on the on-device distance calculation above. We do not operate a remote push-notification server and do not receive a device token or any data when an alert fires.
• LightningSentry — subscriptions. If you subscribe to Pro features, purchases are processed by Apple App Store or Google Play and managed on our behalf by RevenueCat, which receives a device/purchase identifier and your entitlement status to keep your subscription active across sessions. We do not receive or store your payment details.
• LightningSentry — local preferences. Settings like distance units, alert radius, and theme are stored only in local on-device storage and are not transmitted to us.

We do not run advertising or analytics trackers of any kind on these products — there is nothing else collecting data about you as you browse or use our apps.

3. Legal basis for processing

Under the GDPR, we rely on:

• Performance of a contract (Art. 6(1)(b)) — to generate the report you requested, or to provide and bill your Widget subscription.
• Legitimate interests (Art. 6(1)(f)) — to keep our services secure, prevent abuse, and maintain server logs necessary to operate the product.
• Consent (Art. 6(1)(a)) — for LightningSentry's location access, which is only requested and used after you grant the relevant OS-level permission, and which you can withdraw at any time in your device settings.

Outside of mobile location permissions, we do not currently rely on consent as a legal basis, because we do not use any cookies or tools that would require it (see our Cookie Policy).

4. Who we share data with

We use the following processors and third-party services, each acting under its own privacy terms:

• Stripe — payment processing and subscription billing.
• Open-Meteo — weather, climate, and geocoding data (receives coordinates, and address text for geocoding).
• OpenStreetMap / Nominatim — fallback geocoding service.
• Vercel — website and application hosting.
• RevenueCat — subscription and entitlement management for our mobile apps, on top of Apple App Store / Google Play billing.
• Apple App Store / Google Play — process mobile subscription payments directly; we never see your card details.

Our typefaces (Inter, Space Grotesk, and JetBrains Mono) are self-hosted on our own servers rather than loaded from Google Fonts, so no font-related request is made to Google or any other third party.

We do not sell personal data, and we do not share it with third parties for their own marketing purposes.

5. International data transfers

Some of the providers above (including Stripe and Vercel) may process data on servers located outside the European Economic Area, including in the United States. Where this occurs, it is carried out under those providers' own data transfer safeguards (such as Standard Contractual Clauses). We recommend confirming the current status of each provider's transfer mechanism as part of a full legal review of this policy.

6. How long we keep data

• Session cookies expire automatically — 12 hours for the shared demo login, 30 days for a subscriber's login.
• Subscription and billing records are retained by Stripe under its own policy, and by us for as long as your subscription is active plus any period required by Estonian accounting and tax law.
• We do not retain report-generation addresses beyond the request itself, other than the limited, incidental appearance in error logs described in Section 2.
• LightningSentry's location data is never transmitted off your device, so we do not store it at all. Local app preferences and premium/entitlement status are retained on your device until you uninstall the app or clear its data; RevenueCat retains subscription/entitlement records under its own policy for as long as needed to keep your subscription functioning.

7. Your rights

Under the GDPR, you have the right to request access to, correction of, or erasure of your personal data, to restrict or object to our processing, to receive your data in a portable format, and to withdraw consent where consent is the basis for processing. To exercise any of these, contact info@meteoscience.com. You also have the right to lodge a complaint with the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon, AKI), or with the supervisory authority in your own EU member state.

8. Children's privacy

Our products are intended for business and professional use and are not directed at children under 16. We do not knowingly collect personal data from children.

9. Changes to this policy

We may update this policy as our products or legal obligations change. We will update the "Last updated" date above when we do; material changes will be noted here.

10. Contact

Meteoscience OÜ, Pudisoo küla, Kuusalu vald, Harju maakond, 74626, Estonia. info@meteoscience.com.