ALASTA Weather Privacy Policy

1. Data controller and privacy contact

The controller of your personal data is Alasta sp. z o.o., Niałek Wielki 106, 64-200 Wolsztyn, Polska, KRS 0000771908, NIP 9231732328.
General contact: [email protected].
For privacy, data security and data subject rights, contact [email protected].

This Policy applies to ALASTA Weather, available as a mobile app for Android and iOS and as a web/PWA app at https://app.alasta.pl/. The alasta.pl online store, Google Play and the Apple App Store operate under their own privacy rules for their own services.

2. Data we process and sources

Depending on the features you use, we process:

• Account data: email address, optional first name, user identifier, encrypted password, account creation date, last login and email verification status;
• legal acceptance data: the accepted Terms and Privacy Policy versions and the acceptance date;
• weather station data: device identifier and name, account assignment, model, hardware and firmware version, local host address, display settings and configuration;
• mobile app data: Android or iOS platform, app version, app language, login session data and technical information required for API operation;
• local setup data: station QR code, Bluetooth identifiers, Wi-Fi network names visible to the station and the Wi-Fi password entered by the user only to send it locally to the station;
• weather location: city or locality name, country and related coordinates; we do not collect the phone's GPS location for this purpose;
• connection and diagnostic data: station IP address visible to the server, Wi-Fi network name without the password, signal strength, service status, uptime, restart reason, memory information, timestamps and technical station messages;
• security data: cryptographic hashes of device tokens, session tokens, reset events, station pairing attempts and data needed to detect abuse;
• communication data: support requests, correspondence and information provided to customer support.

We receive data from you, from the mobile app or browser, from the assigned station and from systems used for security and email delivery. The mobile app may request camera access to scan a QR code and Bluetooth/Nearby devices access to pair the station locally. On older Android versions, the operating system may technically require a location permission for Bluetooth scanning, but the app does not collect the phone's GPS location.

Account passwords are stored only as protected password hashes. Your home Wi-Fi password is processed locally in the mobile app only to send it to the station over Bluetooth. We do not send the Wi-Fi password to the ALASTA Weather backend, do not store it in your account and do not include it in logs or diagnostics.

3. Purposes and legal bases

The app does not use data for behavioural advertising, marketing profiling, third-party advertising tracking or newsletters. If such features are introduced, we will provide separate information and, where required by law, request separate consent.

4. Recipients of data

Data may be made available only where necessary to:

• providers of hosting, servers, databases, backups and security services;
• software maintenance and technical support providers acting on the controller's instructions;
• the email provider used for address verification and password reset messages;
• Zoomash Ltd (WeatherAPI.com) as the provider of location search and weather data for the location selected by the user;
• Google Play and Apple App Store operators, to the extent they independently handle download, installation, updates and security of mobile app distribution;
• public authorities, courts or authorised advisors where disclosure is required by law or necessary to protect legal claims.

ALASTA servers send WeatherAPI.com a request containing the locality name or coordinates of the selected location. WeatherAPI.com may also receive technical connection data of the ALASTA server, including its public IP address. We do not send the provider your email address, password, station code or account data. Details are described in the WeatherAPI.com privacy policy.

5. Transfers outside the European Economic Area

Zoomash Ltd, the operator of WeatherAPI.com, is based in the United Kingdom. The European Commission recognises the United Kingdom as providing an adequate level of data protection, so this transfer may take place under Article 45 GDPR.

If another technical provider processes data outside the EEA, the controller applies the mechanism required by GDPR, in particular an adequacy decision or standard contractual clauses, together with additional safeguards where needed. Information about the applicable safeguard can be obtained at [email protected].

6. Data retention periods

• Account data and current account settings are kept for the duration of the contract, until the account is deleted.
• The latest station state is kept as long as the device remains registered in the system and is needed for operation, service or updates.
• Station diagnostic history is kept for a limited period needed for diagnostics and security, normally no longer than 90 days.
• Unconfirmed station pairing attempts are deleted when no longer useful, normally after 30 days.
• Correspondence and complaint data are kept while the case is handled and then until the relevant limitation period for claims expires.
• Data needed to defend or pursue claims may be kept until the relevant limitation period expires, in principle no longer than 6 years, and usually 3 years for business-related claims, subject to legal rules for calculating such periods.
• Backups are overwritten according to the backup cycle; deleted data may remain in a secured backup until rotation and are not used for other purposes during that time.

7. Account and data deletion

If you created an account, you can start account deletion in the app settings, on the public account deletion page or by sending a request to [email protected]. The request covers deletion of the account and data linked to the account, unless further retention of specific data is required by law or necessary for security, abuse prevention, complaint handling or defence of legal claims.

In the app, you confirm deletion with your current password. The public deletion page sends a secure link to the account email address, valid for 24 hours. After final confirmation, the account and related data are deleted automatically and without undue delay. A request sent directly to support may require additional identity confirmation.

Account deletion does not factory reset the station and does not remove local Wi-Fi configuration stored in the device. Stations are disconnected from the account and may later be assigned to another account according to the available pairing procedure.

8. Your rights

In the cases provided by GDPR, you have the right to:

• access your data and receive a copy;
• rectify inaccurate data or complete incomplete data;
• erase data and restrict processing;
• data portability for data processed automatically on the basis of a contract;
• object to processing based on legitimate interest, for reasons related to your particular situation;
• withdraw consent at any time if specific processing is based on consent; withdrawal does not affect the lawfulness of earlier processing.

Send requests to [email protected]. You can also start account deletion in the app settings. To protect your data, we may ask you to confirm your identity. We will respond without undue delay, in principle within one month.

You also have the right to lodge a complaint with the President of the Polish Personal Data Protection Office if you believe that processing infringes GDPR. Current complaint information is available at uodo.gov.pl.

9. Whether providing data is required

Creating an account is voluntary. Providing an email address and password is required to create an account, log in and remotely manage the station. First name is optional. Providing a locality is needed if you want weather for a selected place. Without an account, you may use limited local station setup described in the device instructions. Refusing camera or Bluetooth access may prevent QR scanning or local station pairing, but it does not affect your rights under this Policy.

10. Automated decisions

Data is not used to make decisions about you based solely on automated processing that produce legal effects or similarly significantly affect you.

11. Cookies and local storage

The app uses only mechanisms necessary to provide the service requested by the user. It does not use advertising cookies or third-party analytics cookies. Therefore, the app does not display a marketing consent banner.

Cookies can be deleted or blocked in browser settings. This may prevent login or proper form operation. PWA cache can be removed by clearing site data or uninstalling the app from the phone. Mobile app local data can be removed by logging out, clearing app data in the operating system or uninstalling the app.

12. Security

We apply organisational and technical measures appropriate to the risk, including HTTPS encryption for app connections, password and token hashing, limiting station pairing attempts, secure storage of session data in the mobile app, access controls, backups and security updates. You should use a unique password, not share the QR code with unauthorised persons and install station updates.

13. Changes to this Privacy Policy

This Policy may be updated if app features, technical providers or legal requirements change. The document date and version are shown at the top of the page. We will inform you in the app or by email before a material change affecting the way data is processed enters into force.