Privacy Policy

Last updated: September 6, 2026.

At Aurora Cast, we prioritize the privacy and data protection of our visitors. In accordance with Articles 13 and 14 of the EU General Data Protection Regulation (GDPR, 2016/679), this Privacy Policy transparently explains what data is processed, on what legal grounds, and how your rights are protected.

1. Data Controller & Contact Details

The data controller responsible for this website is:

2. Processed Data and Legal Bases (GDPR Art. 6)

We do not operate user account databases or collect personal data without user action. Data processing is strictly limited to:

• Server Log Files & Technical Security: The web server automatically records technical log entries (visitor IP address, timestamp, requested URI, browser type, and referring page).
  Legal Basis: Legitimate interest of the controller (GDPR Art. 6(1)(f)) to ensure system stability, cybersecurity, and troubleshooting.
• Functional Client Storage (localStorage): We store your preferred language (FI / EN) and consent preferences directly on your local device so that preferences persist across page reloads without transferring them to our servers.
  Legal Basis: Strictly necessary storage to provide the requested service (ePrivacy Directive / Finnish Act on Electronic Communications Services Sec. 205).
• Geolocation Data: When you click the "Use my location" button, your browser requests permission to access your geographic coordinates. Coordinates are used strictly client-side to fetch local weather and aurora conditions and are not saved on our servers.
  Legal Basis: Explicit user consent (GDPR Art. 6(1)(a)).
• Email Communications: If you send us an email, we process your name, email address, and message content to answer your inquiry.
  Legal Basis: Legitimate interest in customer support (GDPR Art. 6(1)(f)) or steps taken prior to entering a contract (GDPR Art. 6(1)(b)).

3. Cookies & Consent Management

Aurora Cast does not place third-party tracking or marketing cookies by default. We only use local device storage (localStorage) to retain your selected language and consent choices.

Should third-party advertising partners (such as Google AdSense) or analytics services be integrated in the future, they will only be loaded after you give prior, informed, and explicit consent in accordance with the GDPR and Google's EU User Consent Policy.

4. Third-Party Services & Cross-Border Data Transfers

To deliver live forecasts and maps, the application accesses public APIs and trusted providers. In doing so, the user's IP address is transmitted as part of standard HTTP requests:

• Open-Meteo: Used for weather, cloud cover, and solar calculations. Coordinates are included in queries. Servers are located in Europe.
• NOAA SWPC (USA): Public space weather observation data is fetched from the US National Oceanic and Atmospheric Administration.
• Esri & OpenStreetMap: Map tiles and visual layers (Esri World Dark Gray Canvas).
• Google Analytics 4 (Google LLC): Anonymous visitor analytics and usage statistics to improve the service. Configured with Google Consent Mode v2, ensuring analytics tracking is only enabled after explicit user consent. Google complies with the EU-U.S. Data Privacy Framework.
• Google Fonts (Google LLC): Web typography delivery. Google complies with the EU-U.S. Data Privacy Framework.

5. Data Retention Periods

We retain personal data only for as long as necessary for the purpose:

• Server logs: Stored for a maximum of 90 days for cybersecurity, after which they are deleted or anonymized.
• Email correspondence: Kept for the duration of customer assistance (typically up to 12 months).
• Client localStorage: Retained on your browser until you clear cache or modify settings.

6. Data Subject Rights (GDPR Art. 15–21)

Under the GDPR, you have the following rights:

• Right of access: You can request confirmation of whether we process any data concerning you.
• Right to rectification and erasure: You may request correction of inaccurate data or erasure ("right to be forgotten").
• Right to restriction & objection: You may object to data processing based on legitimate interest.
• Right to withdraw consent: Where processing is based on consent (such as geolocation), you may revoke it at any time with immediate effect.

To exercise your rights, please email us at info@auroracast.fi.

7. Right to Lodge a Complaint with a Supervisory Authority

If you consider that the processing of personal data relating to you infringes the GDPR, you have the right under Article 77 to lodge a complaint with a supervisory authority. In Finland, the competent authority is the Office of the Data Protection Ombudsman:

8. Automated Decision-Making & Profiling

We do not perform automated decision-making or profiling producing legal effects concerning users.