Privacy

This document is available in English only. A translation would risk saying something slightly different from the version that governs, so we would rather publish one text everyone can point at than five that might disagree.

What we hold

• Your email address, because signing in works by sending a code to it.
• Your API keys, as hashes. We store a SHA-256 hash and the first few visible characters. We cannot recover a key, and neither can anyone who reads our database.
• Request counts per key, per hour, per endpoint. Which endpoint you called is retained alongside the count - not the parameters you sent, not the responses you received.

What we do not hold

No advertising identifiers, no third-party trackers, no profile of what you look at. We do not sell or share personal data.

Why we are allowed to

Your email and keys are processed to perform the contract of providing you the service. Request counts are processed on the basis of our legitimate interest in keeping the service running and in deciding what to charge for later.

How long

Account data lasts as long as your account. Delete your account and it goes, along with your keys. Usage counts are kept for 13 months, then removed.

Your rights

Under the GDPR you may request access to your data, correction, deletion, restriction, or a portable copy, and you may object to processing. Write to support@spotforecast.eu and we will answer within a month. You may also complain to your national supervisory authority - in Czechia, the Úřad pro ochranu osobních údajů.

Processors

• Supabase - database and authentication, hosted in the EU (Frankfurt).
• Vercel - website and API hosting.

Who controls this data

The controller is Jan Mucha, Ostrava, Czech Republic, reachable at support@spotforecast.eu. That is the "we" throughout this page.

Contact

support@spotforecast.eu