Privacy Policy

Who is responsible

SCI Ltd., Alamein Road, St. Julians, Pembroke PBK 1776, Malta (see the Imprint). Contact for all privacy questions: gopilot (at) wismeth.com.

Visiting the site

Firebase Hosting (Google Ireland Limited, Google LLC) delivers our pages. To do so and to protect the service it processes technical data of each request: your IP address, the time, the address requested and your browser. Legal basis: our legitimate interest in a secure and working website (Art. 6(1)(f) GDPR).

The default font, Noto Sans, comes from our own server; loading it sends nothing to third parties.

Your account and your dashboards

If you sign up, we store your e-mail address, a hash of your password (never the password itself), your dashboards with their links, descriptions and locations, your workspace settings (logo, font, brand name, Google Analytics ID), your themes, your subscription tier and the icons and logos we copy into our storage. Supabase, Inc. hosts this data as our processor; transfers to the USA rely on the EU Standard Contractual Clauses. Legal basis: providing the service you signed up for (Art. 6(1)(b) GDPR). We keep the data until you delete it or your account; deleting the account deletes the data.

A dashboard you mark as publicly listed can be opened by anyone who has its link. Private dashboards are visible to you only.

Dashboard statistics

When someone opens a dashboard or clicks one of its links, we count it for the dashboard's owner: which dashboard, view or click, which link (its ID and title) and when. We store no IP address, no cookie and nothing else about the visitor. Legal basis: the owner's and our legitimate interest in knowing how a dashboard is used (Art. 6(1)(f) GDPR). Only the owner sees these numbers.

Google Analytics, only with your consent

With your consent we use Google Analytics 4 of Google Ireland Limited (Gordon House, Barrow Street, Dublin 4, Ireland) to see how our pages and dashboards are used: the pages and dashboards viewed (address, title, dashboard name), the size of a clicked link tile (never its address or title), whether the search was used (never the search term), plus device, browser and approximate location. Google sets the cookies _ga and _ga_* (up to two years) and receives your IP address; Google Analytics 4 does not store IP addresses. Google keeps the data for the retention period set in our property, at most 14 months.

On a dashboard, its owner may have added their own Google Analytics property in the workspace settings. With the same consent, your visit is then also reported to that property; for it, the owner is responsible.

Google LLC in the USA may process the data; it is certified under the EU-U.S. Data Privacy Framework. Legal basis: your consent (Art. 6(1)(a) GDPR, and for the cookies the national rules implementing Art. 5(3) of the ePrivacy Directive). Without consent, Google Analytics is not loaded at all. You can change your decision at any time under “Cookie settings” at the bottom of the start page and of this page; the withdrawal does not affect the lawfulness of what happened before it.

Services a dashboard uses

• Weather: dashboards with locations load the weather from Open-Meteo and, if it is unreachable, from wttr.in. These services receive your IP address and the coordinates of the dashboard's locations, not your own location.
• Fonts: if the owner chose a font other than Noto Sans, your browser loads it from Google Fonts (Google Ireland Limited), which receives your IP address.
• Icons and logos: icons and logos we have copied into our storage come from our Supabase storage. Others are loaded from their original address, for example the one the owner entered or a favicon service of Google, which receives your IP address.

Legal basis: the owner's and our legitimate interest in showing the dashboard as it was set up (Art. 6(1)(f) GDPR).

Editing a dashboard

When you add a link, our own server function at Supabase looks for its icon: it asks the favicon services of Google and DuckDuckGo, which receive the link's host name, and for a few well-known services it loads their logo from their own website. An icon or logo address you enter yourself is loaded by the same function. These services see a request from the Supabase server, not your IP address. We copy the icon or logo into our storage; if that fails, the link keeps the address of the favicon service. The title suggested for a new link is its host name; no service is asked for it. Legal basis: providing the editor you use (Art. 6(1)(b) GDPR).

What your browser stores

To keep you signed in and to show dashboards quickly and offline, your browser stores your login session, a copy of the dashboards you opened, your theme and your cookie decision (local storage and IndexedDB), and our service worker keeps the app's files and images. This data stays on your device; signing out deletes the session and the copies of your dashboards. It is necessary for the service you requested.

Your rights

You have the right to access, rectify and erase your data, to restrict its processing, to data portability and to object to processing based on legitimate interests (Art. 15–21 GDPR), and to withdraw a consent at any time. Write to us at the address above. You can also complain to a data protection authority, in Malta the Information and Data Protection Commissioner (idpc.org.mt), or the one where you live or work.