Privacy Policy
This policy explains what personal data WeatherFinder and SunFinder process, why, and what rights you have. We have written it to match what the service actually does.
1. Who is responsible
The controller of your personal data is MultiConsult OÜ, a private limited company registered in Estonia, registry code 10722800, Metsa tn 38, 90505 Haapsalu, Estonia (“we”, “us”). We operate weatherfinder.app, including SunFinder.
For any privacy question or request, write to privacy@weatherfinder.app. We have not appointed a data protection officer because we are not required to.
2. In short
- You can use the whole service without an account. We do not ask for your name.
- To show results we need a starting point. You can let your browser share your location or type a place yourself.
- Our servers record technical request data (such as IP address and browser type) for security, fair-use limits and troubleshooting.
- Visitor statistics use Plausible, which sets no cookies. Google Analytics runs only on the landing page and only if you accept it.
- Free-text searches may be sent to OpenAI to interpret them.
- We do not sell personal data and do not use it for advertising profiles.
3. What we process, why, and on what basis
3.1 Visiting the website
When you open any page, your browser sends your IP address, browser and device type, the page requested, the referring page and the time. Our hosting provider records this in server logs.
Purpose: delivering the website, security, detecting abuse and fixing faults. Legal basis: our legitimate interest in running a secure, working website (GDPR Article 6(1)(f)). Retention: according to the hosting provider’s log rotation, normally a few weeks.
3.2 Your starting point and location
SunFinder compares the weather where you are with places you can reach, so it needs a starting point. You can either allow your browser to share your location (you will be asked first and can refuse) or type a town. The chosen coordinates and place name are:
- stored in your own browser, so you do not have to set them again;
- sent from your browser to OpenStreetMap’s Nominatim service to find the place name;
- sent to our API and to weather providers to calculate forecasts, travel times and results.
Purpose: providing the search you asked for. Legal basis: taking the steps you request when using the service (Article 6(1)(b)) and our legitimate interest in providing relevant results (Article 6(1)(f)). Access to precise device location additionally relies on your permission in the browser, which you can withdraw at any time in your browser settings. We do not build a location history about you.
3.3 API request logs and fair-use limits
When the site calls our API, we record the IP address, browser identification (user agent), the random visitor identifier stored in your browser, the type of request, the time, and technical details of the request, which can include the coordinates used for the search.
Purpose: preventing abuse and automated scraping, enforcing fair-use limits, protecting the paid services we rely on, measuring load and fixing errors. Legal basis: legitimate interest (Article 6(1)(f)). Our interest is keeping a free service available and affordable; the data is used only for these operational purposes. Retention: fair-use records and request logs for up to 12 months, after which they are deleted or anonymised.
3.4 Free-text searches
If you describe what you want in your own words (for example “warm beach within 3 hours next weekend”), the text and your starting place may be sent via our API to OpenAI to turn it into search settings, and SunFinder may ask OpenAI to write a short summary of results. We store the typed phrase and how it was interpreted, so that similar searches can be understood without contacting OpenAI again.
Purpose: understanding your request and improving how searches are interpreted. Legal basis: legitimate interest (Article 6(1)(f)). Retention: up to 24 months. OpenAI processes the data as our service provider under its API terms, which state that API data is not used to train its models.
Please do not type names, contact details or other personal information into the search box. It is not needed for any search.
3.5 Visitor statistics (Plausible)
We use Plausible Analytics to count visits, popular pages and which features are used (for example which destination was opened). Plausible sets no cookies and does not store IP addresses; it derives a daily-changing anonymous identifier that cannot be used to recognise you on another day or on other websites. Data is stored in the EU.
Legal basis: legitimate interest in understanding how the service is used, in aggregate (Article 6(1)(f)). You can object at any time; blocking plausible.io in your browser also stops it.
3.6 Google Analytics (landing page only, with consent)
On the landing page we ask whether you accept analytics. Only if you accept, Google Analytics 4 is loaded. It sets cookies (_ga, _ga_*, lasting up to 2 years) and sends usage data to Google, which may transfer it to the United States. SunFinder pages do not load Google Analytics.
Legal basis: your consent (Article 6(1)(a)). You can withdraw consent at any time with the “Cookie settings” button on the landing page. To remove cookies already set, also clear this site’s data in your browser. Withdrawal does not affect processing before it.
3.7 Search statistics (only with consent)
The service contains an optional feature for anonymous search statistics. It is used only if you have agreed to analytics. In that case we store the search settings, a shortened (anonymised) IP address, a one-way hash of the browser identification and the starting area, for up to 90 days.
3.8 Emails and the newsletter
If you email us, we use your address and message to reply and keep the correspondence as long as needed to deal with your request, and for up to 3 years in case of follow-up questions or claims (Article 6(1)(f)).
If you subscribe to our newsletter, we store your email address, the time of sign-up, IP address and browser identification as proof of consent. Legal basis: consent (Article 6(1)(a)). You can unsubscribe at any time by replying to any newsletter or writing to privacy@weatherfinder.app; we then delete your address, keeping only a minimal record that you unsubscribed.
3.9 Booking and partner links
Some links lead to travel partners (for example flight, hotel, ferry or activity booking sites), partly through the Travelpayouts network. We do not pass your personal data to them. When you click, you leave our site and the partner may set its own cookies to record that you came from us, so that we can receive a commission. Their processing is governed by their own privacy policies. We receive only aggregated commission reports.
3.10 Content from third parties loaded by your browser
To show maps, place names, weather icons and fonts, your browser loads content directly from third parties (see section 5). As with any web request, these providers receive your IP address and browser details. We use them because the service cannot work without maps and weather data (Article 6(1)(f)).
4. Cookies and browser storage
Our own pages do not set cookies. We use your browser’s local storage for the functions below. These are needed for features you use, or store preferences you chose, and none of them is used for advertising. Google Analytics cookies are set only after consent (section 3.6). You can delete all entries at any time by clearing this site’s data in your browser.
| Entry | Purpose | Lifetime |
|---|---|---|
detectedLocation, userLocation, userTimezone | Remembers your starting point and time zone so you do not have to set them on every visit. | Until you clear it; refreshed after 10 minutes |
weatherfinder-visitor-id | Random identifier used for fair-use limits on searches. It contains no personal details. | Until you clear it |
weatherfinder-session-id, last-search-log-id | Groups actions within one visit (session storage). | Until the tab is closed |
wf_geo_*, wf_weather_*, wf.score.v1.*, wf_ai_recs_v1 | Short-lived caches of place names, forecasts and results, so pages load faster and fewer requests are sent. | 10 minutes to 24 hours |
analytics-consent, analytics_consent, language | Remembers your analytics choice and language. | Until you clear it |
5. Who receives data
We use the following service providers. Where they act on our behalf they are bound by data processing terms; where your browser contacts them directly they act under their own policies.
| Provider | Role | Location |
|---|---|---|
| Namecheap, Inc. | Website hosting, server logs and our database | Servers in the European Union; company based in the United States |
| Vercel Inc. | Hosting of our API (weather, routes, search) | United States, with EU edge locations |
| OpenAI, L.L.C. / OpenAI Ireland Ltd | Interpreting free-text searches and writing short summaries | United States |
| Plausible Insights OÜ | Privacy-friendly, cookieless visitor statistics | European Union |
| Google Ireland Ltd / Google LLC | Google Analytics on the landing page, only after you consent; Google Fonts | EU / United States |
| OpenStreetMap Foundation (Nominatim, map tiles) | Turning coordinates into place names and showing maps; your browser contacts them directly | United Kingdom / EU |
| Open-Meteo, MET Norway, WeatherAPI.com | Weather forecasts and history; some requests come directly from your browser | Europe / United Kingdom |
| HeiGIT gGmbH (OpenRouteService) | Travel-time calculation; receives coordinates from our server only | Germany |
| Cloudflare, Inc. (cdnjs, Turnstile) | Delivery of map library files; bot protection | United States / global |
We may also disclose data when required by law or to defend legal claims.
6. Transfers outside the EU
Some providers (in particular Vercel, OpenAI, Google, Namecheap and Cloudflare) are based in the United States. Transfers rely on the EU–US Data Privacy Framework where the provider is certified, and otherwise on the European Commission’s Standard Contractual Clauses (Article 46(2)(c)). The United Kingdom is covered by an EU adequacy decision. You can ask us for more information about these safeguards.
7. Your rights
Under the GDPR you have the right to:
- access the personal data we hold about you and receive a copy;
- have inaccurate data corrected;
- have data erased, or its processing restricted;
- object at any time to processing based on legitimate interest;
- receive data you provided in a portable format, where applicable;
- withdraw consent at any time, without affecting earlier processing.
Because there are no accounts, we usually cannot link data to you by name. To help us find it, tell us the approximate time of your visit and, if you know it, your IP address or the visitor identifier from your browser. We will reply within one month.
You also have the right to lodge a complaint with a supervisory authority, in particular in the EU country where you live. In Estonia this is the Estonian Data Protection Inspectorate (Andmekaitse Inspektsioon), Tatari 39, 10134 Tallinn, Estonia, info@aki.ee, aki.ee. We would appreciate the chance to resolve your concern first.
8. Other information
No automated decisions. SunFinder’s verdicts (such as “worth the trip”) are weather-based suggestions. They have no legal or similarly significant effect on you, and we do not profile you.
You are not obliged to provide data. Without a starting point, results cannot be calculated, but you can always type a town instead of sharing your precise location.
Children. The service is not directed at children. Where processing relies on consent (analytics cookies, newsletter), it is intended for people aged 16 or over, or the lower age of digital consent in their country of residence; younger users need a parent’s permission. We do not knowingly collect children’s data, and will delete it if we learn that we have.
Security. Connections are encrypted (HTTPS), access to servers and databases is restricted, and IP addresses are shortened or hashed where full values are not needed.
Changes. We will update this policy when the service or the law changes, and show the date at the top. Significant changes will be highlighted on the site.