Privacy Policy

MeteoSound (the "Service", "we", "us") is operated by Studio VN – AI & Digital Solutions, based in Udine, Friuli-Venezia Giulia, Italy. This Privacy Policy explains what personal data we process when you use meteosound.com, why we process it, the legal basis for doing so, and the rights you have under the EU General Data Protection Regulation (GDPR), the UK GDPR and similar laws.

1. Data controller

MeteoSound is operated by Studio VN – AI & Digital Solutions, based in Udine, Friuli-Venezia Giulia, Italy.

• Support & privacy: hello@meteosound.com
• Certified Email (PEC): studiovn@pec.it
• VAT / Tax ID: IT03214670303

Please use hello@meteosound.com for all everyday privacy matters. Reserve studiovn@pec.it for formal legal notices and GDPR requests where certified delivery is required.

2. What we collect and why

2.1 Account data (only if you sign in)

• Email address — to identify your account and contact you about service-critical issues.
• Display name & avatar — supplied by your auth provider (e.g. Google) if applicable.
• Authentication token — to keep you signed in.

Legal basis: contract (Art. 6(1)(b) GDPR) — required to provide the account features.

2.2 Listening & preference data

• Saved frequencies (favourites) and custom playlists.
• Last-played station, volume, temperature unit, location behaviour.
• Recently-played history (kept locally and, when signed in, synced).

Legal basis: contract — to sync your library across devices.

2.3 Approximate location

We derive a coarse location (city / country) either from your browser's Geolocation API (with your permission) or from your IP address. We use this only to suggest nearby weather and stations. You can override it any time by searching another city. We do not log raw IP addresses beyond what is necessary for security and abuse prevention (max. 30 days).

Legal basis: legitimate interest (Art. 6(1)(f)) or consent for precise GPS coordinates.

2.4 Technical & analytics data

If you accept analytics cookies, we use PostHog (EU region) to collect anonymous usage events: page views, feature interactions, rough device class, browser language. PostHog is configured with IP-anonymisation. No cross-site tracking, no advertising IDs, no fingerprinting.

Legal basis: consent (Art. 6(1)(a)). Withdraw any time via the cookie bar or Privacy Preferences.

2.5 Feedback submissions

If you use the Feedback form, we store your message, optional contact email, optional screenshot, and the page path where you submitted it. This is used solely to triage and reply to your report.

3. What we do NOT do

• We do not sell, rent or trade your personal data.
• The web version of MeteoSound may show light, tasteful ads to help cover hosting costs. We avoid tracking-heavy ad networks and dark patterns, and we request consent where legally required.
• We do not access your microphone, camera, contacts or files.
• We do not build cross-site advertising profiles or share data with data brokers.

4. Sub-processors

We rely on a small number of carefully selected sub-processors:

• Supabase (EU region) — authentication, database, file storage.
• Cloudflare — CDN, DDoS protection and edge compute.
• PostHog Cloud EU — anonymous product analytics (only if you opt-in).
• Resend — transactional email (e.g. password resets, feedback notifications).
• Open-Meteo — weather data (no personal data shared, only coordinates).
• radio-browser.info — public radio-station directory.
• Stripe & Buy Me a Coffee — only if you choose to make a donation; handled entirely by those providers.

Each sub-processor is bound by a Data Processing Agreement and, where applicable, EU Standard Contractual Clauses for international transfers.

5. International transfers

Where data is processed outside the EEA (e.g. Cloudflare edge nodes), we rely on the European Commission's Standard Contractual Clauses and require equivalent safeguards.

6. Data retention

• Account & library: until you delete your account.
• Feedback: up to 24 months, then deleted.
• Analytics events (if opted-in): up to 12 months.
• Security logs: up to 30 days.

7. Your rights (GDPR / UK GDPR)

If you are in the EU, EEA or UK, you have the right to:

• Access the personal data we hold about you (Art. 15).
• Rectify inaccurate data (Art. 16).
• Erase your data ("right to be forgotten", Art. 17).
• Restrict or object to processing (Art. 18 & 21).
• Receive your data in a portable format (Art. 20).
• Withdraw consent at any time, without affecting prior lawful processing.
• Lodge a complaint with your national supervisory authority (in Italy: the Garante per la Protezione dei Dati Personali).

To exercise any right — including requesting an export of your personal data or deleting your account — email hello@meteosound.com. We respond within 30 days, free of charge. For formal legal notices you may also use our PEC: studiovn@pec.it.

8. Children

MeteoSound is not directed at children under 16. We do not knowingly collect data from children. If you believe we have done so, contact us and we will delete it.

9. Security

Data is encrypted in transit (TLS 1.2+) and at rest. Access to production data is limited, logged, and protected by multi-factor authentication. Row-Level Security policies in our database prevent users from accessing each other's records.

10. Changes to this policy

We may update this policy as the Service evolves. Material changes will be announced in-app and via email (where you have provided one). The "last updated" date at the top of this page always reflects the current version.

11. Contact

Privacy questions, requests or complaints: hello@meteosound.com. Certified Email (PEC): studiovn@pec.it.

Studio VN – AI & Digital Solutions · Udine, Friuli-Venezia Giulia, Italy · VAT / Tax ID IT03214670303