Privacy Policy

1. Controller

The data controller for waveshed.io is:
See Impressum
Email: info@waveshed.io

2. What Data We Process

Waveshed is a browser-based RF simulation tool. All simulation computation runs locally in your browser. We process minimal data:

• Mailing list: Email address, consent timestamp, IP address at signup and confirmation (double opt-in)
• Contact form: Name, email, message content
• Analytics: Anonymized page views, browser type, country (via Cloudflare Web Analytics — no cookies, no personal data)
• Technical: IP address in server logs (Cloudflare), retained for security purposes
• Engine key for the QGIS plugin: Only if you request a free engine key on this site — the key is needed by the Waveshed QGIS plugin alone; the browser app needs none. The key service records a salted, non-reversible hash of your IP address, the machine fingerprint the plugin sends (a hash of hardware identifiers that locks the key to that machine; empty for keys without a machine lock), the accepted licence (EULA) version, the key's type, issue and expiry dates, its licence ID and a hash of the key. Neither the key itself nor your IP address is stored. The request passes Cloudflare Turnstile (bot check). These records enforce the issue limits (3 keys per IP address per 24 hours, 3 per machine per 30 days) and let a key be revoked.

To improve the product we may collect technical data about simulation runs, including the chosen settings and transmitter position. The run record contains no personal data such as your name, e-mail address or IP address. Except for the mailing list, the contact form and the engine-key request described above, Waveshed does not collect personal data. Results and exports stay in your browser.

3. Legal Basis (GDPR Art. 6)

• Consent (Art. 6(1)(a)): Mailing list subscription, contact form
• Legitimate interest (Art. 6(1)(f)): Security logs, anonymized analytics, simulation run statistics (product improvement)
• Contract (Art. 6(1)(b)) and legitimate interest (Art. 6(1)(f)): Issuing the free engine key for the QGIS plugin under its licence agreement, and limiting how many keys one address or machine can draw (abuse prevention)

4. Data Processors

We use the following third-party processors:

• Cloudflare, Inc. (USA, EU datacenters) — Hosting (Pages, Workers, D1), DDoS protection, Web Analytics. Privacy Policy
• MailerLite (Lithuania, EU) — Mailing list management, double opt-in, newsletter delivery. Data stored in EU (ISO 27001 certified). Privacy Policy · GDPR
• Formspark (Belgium, data stored in Ireland/EU) — Contact form submissions. Privacy Policy · GDPR

Cloudflare is certified under the EU-US Data Privacy Framework. MailerLite is headquartered in the EU (Lithuania) and stores all subscriber data in EU datacenters.

5. Cookies

Waveshed uses no tracking cookies. We use only essential browser storage (localStorage) to remember your map preferences and simulation settings. This data never leaves your device.

Cloudflare Web Analytics operates without cookies and does not track individual users.

6. Data Retention

• Mailing list: Until you unsubscribe
• Contact form messages: 12 months, then deleted
• Server logs: 30 days (Cloudflare default)
• Analytics: Aggregated, non-personal, retained indefinitely
• Simulation run statistics: Non-personal, retained indefinitely
• Engine key records (QGIS plugin): [Retention period to be set before publishing]

7. Your Rights

Under the GDPR, Swiss DSG, you have the right to:

• Access your personal data
• Rectify inaccurate data
• Request deletion of your data
• Withdraw consent at any time (e.g., unsubscribe from mailing list)
• Data portability
• Lodge a complaint with your supervisory authority

To exercise these rights, contact info@waveshed.io.

8. International Transfers

Your data is primarily processed in EU datacenters (Cloudflare). Where data is transferred to the USA (Cloudflare infrastructure), it is protected by the EU-US Data Privacy Framework and Standard Contractual Clauses.

9. Changes

We will update this policy as our services evolve. Material changes will be announced on the website. The "Last updated" date above reflects the current version.

10. Contact

For privacy-related inquiries:
info@waveshed.io

Supervisory authority (Switzerland): FDPIC (Federal Data Protection and Information Commissioner)