How WeatherLabs collects, uses and protects personal data, under the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018.
Last updated: 23 October 2026
The data controller for the personal data described here is WeatherLabs Ltd, a limited company registered in England and Wales (company number 17265453), with its registered office at 2 Arnewood House, Everton Road, Lymington, SO41 0HF, United Kingdom. You can contact us about privacy at contact@weatherlabs.io.
We aim to collect only what we need to run the Service. Specifically:
? or
#, how long the page was visible, and the previous WeatherLabs page you came
from or, if a link on another site brought you here, only that site's domain name. We add
these to daily totals per page (views, time visible, the pages people
move between and the sites that link to us) and keep nothing else from the visit. We use
no cookies or browser storage for this, and the totals hold
no IP address, browser details or link to you or your account. Browsers
that send Global Privacy Control or Do Not Track send
nothing.
localStorage/sessionStorage to remember your settings and
(optionally) your API key on your device, and sets two first-party cookies
(wl_apps_view and wl_home_folds, below) that only this website
can read.
We do not use advertising cookies or third-party tracking cookies. The
keys we set are:
| Key | Purpose |
|---|---|
wl_api_key |
Your forecast-API key, if you choose to store it (session-only by default; on this device only if you tick "remember"). |
wl_api_base |
The API endpoint the Explorer/Playground points at. |
wl_account_base |
The account/dashboard API endpoint. |
wl_apps_view |
A cookie, kept for a year: whether the Applications page shows applications as tiles or as a list. Sent only to this website, which does nothing with it on the server. |
wl_dev_email |
Identity in local development mode only. |
wl_home_folds |
A cookie, kept for a year: which sections of the front page you have folded away or opened. Sent only to this website, which does nothing with it on the server. |
wl_myweather_v1 |
My Weather: the places you save in it, the wind unit, the amount of rain it counts as a wet day and the models it shows. It stays in this browser; it is not sent to us. |
wl_notice_dismissed_v2 |
Remembers that you dismissed the site notice bar. |
wl_workspace_v1 (one per account on the device, as
wl_workspace_v1:<account id>)
|
Your workspace in this browser while you are signed out, or when you keep your saved data on your devices only: the places and routes you save, draft alerts, questions you asked that no application answers yet, and your display preferences (units, timezone, quiet hours, and the role, organisation and mobile number you choose to add). It is not sent to us unless you choose Import in Account › Your data; remove it by clearing your browser storage. |
wl_workspace_v2:<account id> |
A copy of your account's saved data in this browser, so pages show it at once and keep working offline, with what only this browser keeps: your mobile number, organisation, role, quiet hours, questions, notes and schedules, names and positions exactly as you entered them, and changes that have not reached your account (or that it did not accept). When you sign out, the copy of your account's data is dropped and what only this browser keeps stays here for your next sign-in. All of it is removed when you delete your account, or when you delete your saved data and choose to remove it from this browser too. |
wl_workspace_v2:<account id>~i~… |
A change you made in this browser, kept until it reaches your account. |
wl_workspace_v2:<account id>~kept |
When you keep your saved data on your devices only, or delete it from your account and keep a copy here: what this website's pages cannot show (such as plans an AI assistant made), kept in this browser until you put it back in your account in Account › Your data. It is removed then, when you delete your account, or when you choose to remove everything this browser keeps for your account. |
wl_workspace_v2:<account id>~gone |
A note that this account was deleted, so this browser never saves anything to it again. |
wl_workspace_v2:<account id>~lease |
A short lock (at most 30 seconds) so two tabs do not send the same change at once, in browsers without a built-in lock. |
wl_workspace_sync_preview |
Staff only: a preview of saving to the account before it opened to everyone (this tab only). |
wl_role_v1 |
Whether your account is an administrator, so the account menu can show the administration links (this tab only). |
wl_subscribe_intent |
An application you chose before signing in, so your account page can offer it afterwards (this tab only). |
wl_pending_app |
The application you have just paid for, while your account page waits for it to switch on (this tab only). |
wl_theme preference (light/dark). These items stay in your
browser; clearing your browser storage removes them.
| What | Why | Lawful basis (UK GDPR) |
|---|---|---|
| Account & authentication | Create and secure your account; provide the Service | Performance of a contract (Art. 6(1)(b)) |
| Billing & subscriptions | Take payment, apply your Applications' grants, issue records | Contract (Art. 6(1)(b)); legal obligation for tax/accounting (Art. 6(1)(c)) |
| Usage metering & quotas | Meter usage, enforce quotas, bill correctly | Contract (Art. 6(1)(b)) |
| Security, logging & abuse prevention | Keep the Service safe and available; investigate misuse | Legitimate interests (Art. 6(1)(f)) — protecting our service and users |
| Page visits | Understand which pages are used and how people move between them, and improve the site | Legitimate interests (Art. 6(1)(f)) — understanding and improving our website, from daily totals that identify no one |
| Service communications | Notify you about changes, incidents, billing | Contract (Art. 6(1)(b)); legitimate interests (Art. 6(1)(f)) |
| Saved data | Keep your places, routes, alerts and settings in your account across devices; let an AI assistant you connect read them or propose changes, when you switch that on | Contract (Art. 6(1)(b)) |
Where we rely on legitimate interests, we have considered your rights and freedoms and limit processing to what is necessary. You can object to processing based on legitimate interests — see your rights.
We use a small number of carefully chosen providers to deliver the Service. They process personal data on our behalf, under contract, only for the purposes we set:
| Provider | Role | Data involved |
|---|---|---|
| Clerk, Inc. | Identity / authentication | Email, user id, session data; name and profile picture if you sign in with Google or Apple |
| Paddle (Paddle.com Market Limited) | Payments & merchant of record | Billing details, payment data (held by Paddle), customer/subscription ids |
| Amazon Web Services (AWS) | Hosting & infrastructure — region eu-west-2 (London) |
Application data, usage records, server logs |
This list may change as the Service evolves; we will keep it current and give notice of material changes. Our primary hosting region is AWS London (eu-west-2).
Content loaded from other providers. Some pages ask your browser to fetch files directly from the providers below. Each one therefore receives your IP address and browser details when that happens, under its own privacy terms, and may be outside the UK. We send them no account data, and they are not our processors.
| Provider | What your browser fetches | Where |
|---|---|---|
| Google Fonts (Google) | Typefaces | Most pages |
| jsDelivr | Clerk's sign-in script, which checks whether you are signed in | Most pages |
| unpkg | Map-drawing libraries | The API explorer and the integration examples |
| MapTiler | Base-map tiles | The Explorer and the map applications |
| EUMETSAT | Satellite images | Aviator’s satellite view (the Satellite application reads its images from WeatherLabs) |
| MapTiler | Place and address searches: the text you type | The Site and Rail applications |
| postcodes.io | UK postcode searches: the postcode you type | The Site and Rail applications |
Our hosting is in the UK (AWS London). However, some providers — in particular Clerk and Paddle — may process personal data outside the UK (including in the United States). Where personal data is transferred outside the UK, we rely on appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or the UK Addendum to the EU Standard Contractual Clauses (SCCs), and/or transfers to countries the UK government has deemed adequate.
We keep personal data only as long as we need it:
| Data | Retention |
|---|---|
| Detailed usage charts / request-level metadata | Approximately 45 days |
| Billing & monthly usage records | 6 years (to meet HMRC / UK tax record-keeping obligations) |
| Server logs (incl. IP) | 90 days or less |
| Daily page totals (no personal data) | 13 months |
| Account data | Until you delete your account (then erased, subject to records we must keep by law, and the note about saved data below) |
| Saved data (places, routes, plans, alerts and settings) | Until you delete it, keep it on your devices only, or delete your account; deleted automatically 2 years after it was last changed or opened |
| The list of recent changes to your saved data | 30 days |
| A change an AI assistant proposed | 10 minutes, or until it is applied |
| A record that saved data was deleted (no content: your account id and the time) | 40 days, so that restoring a backup repeats the deletion |
| A note that your saved data is kept on your devices only, or was deleted (no content: your account id, which of the two, and when) | No fixed limit: until you store saved data in your account again, and after you delete your account too, so that a browser still signed in to it elsewhere never uploads your saved data again |
Under UK GDPR you have the right to: access your personal data; have it rectified if inaccurate; have it erased; restrict or object to its processing; and request portability of data you provided to us. To exercise these rights, contact us (below) — we will respond within the statutory timeframe (normally one month).
Your saved data. In Account › Your data you can download everything we hold about you (your account, keys, usage and saved data) as a file, keep your saved data on your devices only, or delete it from your account.
Self-service account deletion. You can delete your account from your Account page. Deleting your account revokes your API keys, cancels your subscription, and erases your personal data from our systems — except records we are required to keep by law (for example, billing records retained for tax purposes), and copies in routine backups which are overwritten on our normal cycle.
We take appropriate technical and organisational measures to protect personal data, including encryption in transit and at rest, access controls, and storing API keys as secrets rather than in plain logs. No system is perfectly secure, but if a personal-data breach occurs that is likely to result in a risk to your rights and freedoms, we will notify the ICO within 72 hours where required, and will inform affected users without undue delay where the breach is likely to result in a high risk to them.
If you have a concern about how we handle your personal data, please contact us first so we can try to resolve it. You also have the right to complain to the UK supervisory authority, the Information Commissioner's Office (ICO) — ico.org.uk.
Privacy enquiries and rights requests: contact@weatherlabs.io (general: hello@weatherlabs.io). The controller's full legal details are in section 1.