This English version is a translation; the Spanish version prevails in case of discrepancy.
Privacy policy — My Climate Risk and Climate Note (Canal Meteo)
Last updated: 23/10/2026
This policy explains what personal data we process when you use My Climate Risk and when you buy the Climate Note, why, for how long, and what rights you have. We try to process as little data as possible: the public map does not require you to identify yourself; for the street-level building sheet we only ask for an email address, and payments are handled by Stripe.
1. Who the controller is
| Controller | Poniente Media Group LLC, trading as Canal Meteo (also the holder of the Stripe account) |
| Legal form | United States limited liability company (LLC), incorporated in Texas (file number 805980905) |
| Tax number | EIN 33-4452828 |
| Address | 5900 Balcones Dr Ste 100, Austin, TX 78731, United States |
| Contact and privacy email | hola@canalmeteo.tv |
| Website | miriesgoclimatico.com (formerly riesgo.canalmeteo.tv) and the Mi Riesgo Climático iPhone app |
| Representative in the European Union (Art. 27 GDPR) | Being appointed (EU Shield, Slovakia); we will publish its name, address and email here as soon as it is formalised. In the meantime, write to hola@canalmeteo.tv |
| Data protection officer | We have not appointed a data protection officer because, given the processing described, it is not mandatory (Art. 37 GDPR and Art. 34 LOPDGDD). |
As we have no establishment in the European Union but offer the service to people in Spain and the rest of the EU, the General Data Protection Regulation applies to us (GDPR, Art. 3(2)) and, for users in Spain, Organic Law 3/2018 (LOPDGDD). You can contact either us or our EU representative on any privacy matter.
2. What data we process and why
2.1 If you only view the public map (without an account)
- We do not ask you for data or create a profile.
- Server technical logs. As on any website, our server automatically logs each request: IP address, date and time, the address requested (for example, a map tile), browser and referring page. The tiles your browser requests may reveal the area you are looking at. We use these logs only to run the website, for its security and to detect abuse, and they are deleted after 14 days.
- Usage counters. We count how many times each feature is used (for example, how many building sheets are opened per day) with aggregate counters, without cookies or identifiers and without recording who does what.
- Third-party resources. The website currently loads fonts from Google Fonts (fonts.googleapis.com / fonts.gstatic.com) and libraries from cdnjs.cloudflare.com. When it does so, your browser sends your IP to Google and Cloudflare. When you open “My places” or a municipality panel, it also downloads the shared AEMET warnings file from Canal Meteo’s storage at DigitalOcean (canalmeteo-public.sfo3.digitaloceanspaces.com, United States), which receives your IP but not your places.
- We do not use third-party analytics or advertising tools.
2.2 If you create an account
| Data | What we use it for | Legal basis (Art. 6 GDPR) |
|---|---|---|
| Email address, chosen language, sign-up date and last access | Creating and managing your account, sending you the sign-in link (we do not use passwords) and essential service notices (purchase confirmations, changes to the terms, replies to a correction) | Performance of the contract (Art. 6(1)(b)) |
| Version of the terms accepted and date | Being able to prove what you accepted | Legitimate interest (Art. 6(1)(f)) and compliance with legal obligations (Art. 6(1)(c)) |
| Sign-in link requests: email, IP, date | Sending you the link and limiting requests to prevent abuse | Performance of the contract and legitimate interest in security (Art. 6(1)(f)) |
| Session: a cookie with a random code (in our database we only keep its hashed fingerprint), start and last-use dates | Keeping you signed in | Performance of the contract (Art. 6(1)(b)) |
| Address searches in the street-level building sheet | Finding the building. The search runs on our server; we do not store what you search for in your account, although the request remains in the technical logs for 14 days | Performance of the contract (Art. 6(1)(b)) |
| History of building sheets opened: municipality or area, cadastral reference, format (screen or PDF), date | Showing you your history and preventing abuse (scraping) | Performance of the contract and legitimate interest (Art. 6(1)(f)) |
| Messages you send us (for example, to report an error) | Replying to you, reviewing and correcting the data, and keeping a record of the correction | Legitimate interest (Art. 6(1)(f)); when you exercise a right, legal obligation (Art. 6(1)(c)) |
2.3 If you buy the Climate Note or subscribe to a plan
| Data | What we use it for | Legal basis |
|---|---|---|
| Notes generated: cadastral reference or address typed, result, whether it came from the website or the API, how it was charged (plan, credit, request), date and the PDF | Delivering the Note, letting you download it again, counting the Notes in your plan and billing the API | Performance of the contract (Art. 6(1)(b)) |
| Plan subscribed, available credits and subscription status (including a failed payment) | Giving you access to what you paid for | Performance of the contract (Art. 6(1)(b)) |
| Stripe identifiers (customer and subscription) and a record of each payment: product, amount, currency and date | Managing payments, renewals, cancellations and refunds, and complying with tax and accounting obligations | Performance of the contract (Art. 6(1)(b)) and legal obligation (Art. 6(1)(c)) |
| Your brand name and logo (Pro plan only, if you provide them) | Putting them on your Notes | Performance of the contract (Art. 6(1)(b)) |
| API keys (we only keep their hashed fingerprint, a prefix, a name and the creation and last-use dates) | Identifying your API requests | Performance of the contract (Art. 6(1)(b)) |
What we do not see. Your card details, cardholder name and billing address are collected directly by Stripe on its payment page. We do not receive or store them.
What we do not do: - We do not sell or pass on your data to anyone, including estate agents, insurers or financial institutions. - We do not use your data for advertising or build commercial profiles. - We do not take automated decisions about you with legal effects (Art. 22 GDPR). The score describes a building and its surroundings, not a person. - We do not ask you for special categories of data.
2.4 If you use the Mi Riesgo Climático iPhone app
- Email address, to sign in: we send you a one-time code that expires after 15 minutes. It is the same account as on the website and is handled in the same way (section 2.2).
- Addresses you search for: they are sent to our server to find the building. We do not store them in your account or in the technical logs (the search box leaves no log).
- Sheets, maps and PDFs you request: a building's sheet (with its cadastral reference), PDFs, the aerial photo around a point and the street-level map tiles are requested from our server with your session. We do not store them in your account; the requested address stays in the technical logs for 14 days (section 4). Climate Reports you buy are kept in your account (section 2.3).
- Location: if you allow it, the app uses it only on the iPhone to centre the map or find your building. It never reaches us.
- Weather alerts in the app (optional). If you turn on alerts in the iPhone app, we store the notification identifier Apple assigns to your device (and, if you use Live Activities, their identifiers), the language, the app environment and the homes you choose: the name you give them, municipality, cadastral reference if any, and coordinates. We also store which alerts we have already sent you, so as not to repeat them, and delete them when each alert ends. We use this only to match your homes with the official AEMET warnings and send you the notification through Apple's notification service (APNs), which receives the identifier and the text of the alert. Legal basis: your consent when you turn them on (Art. 6.1.a GDPR). It is deleted when you turn alerts off in the app, when Apple tells us the identifier is no longer valid, or when you delete your account.
- In-app purchases. Apple charges them under its own privacy policy: we do not see your card, your name or your Apple ID. To give you the credits, the app sends us the signed purchase receipt and we check it with Apple. We store the transaction number (and the original one), the product, the credits, the environment (production or testing), the date and any refund. To link the purchase to your account we generate a random account identifier (
appAccountToken) that the app passes to Apple when you buy. Apple also tells us about refunds and revocations, and we then remove unused credits. Legal basis: performance of the contract (Art. 6.1.b) and legal obligation (Art. 6.1.c). Retention: as for payment records (section 4). - IP address: only for the security of the service and to limit abuse (for example, how many codes are requested): it stays in the technical logs for 14 days and, with each code request, for 7 days.
- The app carries no advertising or third-party tracking tools.
2.5 If you agree to receive news and offers
It is optional: an unticked box when you create the account, separate from accepting the terms. Not ticking it does not limit any part of the service.
| Data | Purpose | Legal basis | How long |
|---|---|---|---|
| Email, language, date of consent | Emailing you news about the service and offers from Mi Riesgo Climático (Art. 21 LSSI) | Your consent (Art. 6.1.a GDPR) | Until you unsubscribe or delete the account |
- You can withdraw it at any time: with the «Unsubscribe» link in every email (one click, without signing in), from Account, or by writing to hola@canalmeteo.tv. Withdrawing it does not affect the emails your account needs (sign-in and purchases).
- We may email customers who have bought from us about similar products of ours, unless they object (Art. 21.2 LSSI); every email lets them object with one click.
- The emails are sent with Twilio SendGrid (section 5). We do not share the list with anyone.
3. Information about properties and the people who live in them
The building sheet and the Note describe a building using public data: the Catastro footprint and characteristics (year, use, number of dwellings, floors), flood zone mapping, terrain, surface temperature, ground motion, the aerial photo and the surrounding vegetation.
- We do not show or process the name, tax ID (NIF) or tax address of the owners, or the cadastral value, which are protected data under Art. 51 of the Consolidated Text of the Cadastre Law.
- We do not link buildings to the people who live in them.
- Building sheets and Notes by address are not indexed by search engines, so as not to create a public "house-by-house risk" register.
Even so, for a single-family house, information about a building may indirectly relate to the person who lives there. If you are an owner or occupant and have a question, or wish to exercise your right to object (Art. 21 GDPR) regarding the information about your property, write to hola@canalmeteo.tv. We will assess each case, bearing in mind that the information comes from public sources and serves an informative purpose of general interest..
4. How long we keep the data
| Data | Period |
|---|---|
| Account data | While the account is active. If you delete it, they are deleted immediately (and from backups when they are renewed) |
| Sign-in link requests (with the IP) | 7 days |
| Sessions | Until you sign out or, at most, 90 days |
| History of building sheets and Notes | While the account is active |
| Note PDFs | 30 days from generation |
| Payment records (product, amount, currency, date) | As long as tax and accounting rules require. If you delete your account, they are kept without any link to your account |
| Server technical logs | 14 days |
| Error reports and corrections | 3 years after closure, to document the service's correction history |
| Inactive accounts | Until you delete them or ask us to |
When the period ends, we delete the data or anonymise them irreversibly (for example, counting how many Notes are generated per municipality, without addresses or accounts).
If you delete your account: we first cancel your subscription with Stripe; then we delete your Note PDFs, your history, your API keys, your sessions and your sign-in requests, and unlink from you the payment records, which we keep only because tax law requires it. If we cannot cancel the subscription, we delete nothing and ask you to cancel it from the payment portal. The effects on your purchases are in the Terms of use, section 8.
5. Who we share the data with
With providers of technical services acting as processors, under a contract in accordance with Art. 28 GDPR:
| Provider | Purpose | Where the data are processed |
|---|---|---|
| Hetzner Online GmbH (Germany) | Hosting of the server, the database and the PDFs | Data centre in Hillsboro, Oregon (United States) |
| Twilio Inc. (SendGrid) | Sending sign-in and service emails and, if you agree, news and offers | United States |
| Apple Inc. (APNs) | Delivery of the app's notifications | United States |
| Stripe | Payments, subscriptions, receipts and refunds | EU and United States |
Stripe acts as a processor for your payments and also as an independent controller for its own legal obligations (fraud and money-laundering prevention, financial obligations). Its privacy policy applies to that: https://stripe.com/privacy.
Google and Cloudflare receive your IP while the website loads fonts and libraries from their servers (section 2.1).
The aerial photo and orthophoto tiles are requested by our server from the Instituto Geográfico Nacional: the IGN does not receive your data.
We may also have to disclose data to authorities or courts when required by law (for example, to the tax authorities).
6. International transfers
Poniente Media Group LLC is in the United States, and so are our server, SendGrid and part of Stripe, so your data are processed there.
7. Your rights
You can exercise at any time, free of charge, the rights of: - access: to know what data we hold about you; - rectification: to correct inaccurate data; - erasure: to delete your data; you can delete your account from the account settings or ask us to do so (with the effects in section 4); - objection: to object to processing based on legitimate interest; - restriction of processing; - portability: to receive the data of your account, your history and your Notes in a structured format; - withdrawal of consent, where processing is based on it, without affecting what was done before.
How to exercise them: write to hola@canalmeteo.tv (or, once appointed, to our EU representative) from your account email, stating which right you wish to exercise. If we have reasonable doubts about your identity, we may ask you for additional information, but never more than necessary. We will reply within one month, which may be extended by two further months in complex cases, and we will tell you if there is an extension (Art. 12(3) GDPR).
Complaint to the authority: if you believe we have not handled your data properly, you can lodge a complaint with the Spanish Data Protection Agency (AEPD), C/ Jorge Juan 6, 28001 Madrid, https://www.aepd.es, or with the data protection authority of the EU country where you live or work. We would appreciate it if you wrote to us first, in case we can resolve it.
8. Minimum age
To create an account you must be at least 18 years old. In Spain, the minimum age to consent to data processing is 14 (Art. 7 LOPDGDD), but the service is designed for adults making decisions about a home, and buying requires legal capacity to contract.. If we learn that an account belongs to a minor below that age, we will delete it.
9. Security
We apply proportionate technical and organisational measures: encrypted connection (HTTPS), sign-in by a single-use link that expires after 30 minutes (no passwords), links, sessions and API keys stored only as a hashed fingerprint (SHA-256), PDFs accessible only to the account that generated them, signature verification of Stripe notifications, restricted access to data within the company and minimisation of logs. If a security breach occurred that posed a risk to you, we would notify the supervisory authority within 72 hours and, where appropriate, you (Arts. 33 and 34 GDPR).
10. Cookies and browser storage
| Name | Type | Purpose | Duration |
|---|---|---|---|
riesgo_sesion |
First-party technical cookie | Keeping you signed in (only if you sign in to your account) | Until you sign out or 90 days |
mrc.lang |
Browser local storage | Remembering the language you chose | Until you delete it |
riesgo_satelite |
Browser local storage | Remembering whether you want the aerial photo as background | Until you delete it |
mrc.favoritos |
Browser local storage | Saving the municipalities and buildings you add to “My places” (municipality code or cadastral reference and name). It is not sent to our server: to show AEMET warnings, the browser downloads a file that is the same for everyone and filters your places on your device | Until you remove them or clear your browser data |
These are technical, or preferences that you choose, so they do not require consent (Art. 22.2 LSSI and the AEPD cookie guide). We do not use analytics or advertising cookies, and the usage counters (section 2.1) store nothing in your browser. Stripe's payment page uses its own cookies to process the payment and prevent fraud; they are explained in its cookie policy: https://stripe.com/legal/cookies-policy.
11. Users in the United States (including Texas)
The service is designed mainly for the public in Spain. If you use it from the United States, we process your data in the same way described in this policy and you can exercise the same rights by writing to hola@canalmeteo.tv. We do not sell personal data or use it for targeted advertising.
12. Changes to this policy
If we change this policy, we will publish the new version with its date. If the change is significant (for example, a new purpose or a new recipient), we will email you before it takes effect.
13. Contact Poniente Media Group LLC (Canal Meteo) · 5900 Balcones Dr Ste 100, Austin, TX 78731, USA · hola@canalmeteo.tv
EU representative: being appointed (EU Shield, Slovakia); we will publish its name, address and email here as soon as it is formalised