Document history
| Version | Date | Summary |
|---|---|---|
| 1.0 | 1 June 2025 | Initial privacy policy. |
| 1.1 | 14 September 2025 | Expanded data-processing, retention and service-provider provisions. |
| 1.2 | 13 September 2026 | Updated WxVision terminology and clarified observational-data, location, licensing and anonymisation provisions. |
| 1.3 | 29 October 2026 | Named Cloudflare Web Analytics and Turnstile on the website, and removed unused Google Analytics wording. |
1. Who we are
Data controller:
Wx Labs Ltd
Nexus, University of Leeds
Discovery Way
Leeds
LS2 3AA
United Kingdom
Company number: 16487310 (registered in England & Wales).
ICO registration number: ZB954744.
Privacy contact email: privacy@wxlabs.co.uk.
Wx Labs Ltd is responsible for deciding how and why your personal data is used when you interact with us or our products.
2. What this policy covers
This policy applies to our websites on the wxlabs.co.uk domain and subdomains, our online store operated via Shopify, the WxVision (Personal) and WxVision (Industrial) devices and associated cloud services, and our mailing lists, events, support channels, recruitment processes and related business activities.
It does not apply to third-party platforms that you control yourself (for example, your own cloud storage destination that you configure your device to send data to). Those providers act as independent controllers for their part of the processing.
3. Personal data and observational data we collect
3.1. When you visit our website
We may collect basic technical data such as your IP address, browser type, operating system, pages viewed and timestamps, together with error and security logs. Forms may use Cloudflare Turnstile to distinguish people from automated submissions. We use Cloudflare Web Analytics to measure visits, page views and site performance. That beacon does not set cookies or use browser storage. Cloudflare receives the measurement request in the ordinary way, discards the visitor IP address at the nearest data centre, and keeps aggregate statistics. We do not use Google Analytics on this website.
3.2. When you use our online store (Shopify)
When you place an order or create a store account, we process identification and contact details (such as name, email address, billing and delivery address, and phone number if provided), order details, payment information and shipping information. We do not store your full payment-card number; payment handling is carried out by Shopify and its payment providers.
3.3. When you create a Wx Labs account or register a device
To operate WxVision devices, we may collect account information such as name, email address and account ID; device-registration information such as device identifiers, model and firmware version; installation location, including precise GPS coordinates where required for meteorological processing and forecasting; site name or description; and configuration data such as device settings and alert preferences. Accounts are currently handled using Google / Firebase Authentication.
Precise location materially improves the scientific usefulness of weather observations, including spatial analysis, weather-model validation and potential assimilation into forecasting systems.
3.4. WxVision (Personal) - crowdsourced network
WxVision (Personal) is designed as a crowdsourced weather and sky-observation device. Participation in the Wx Labs crowdsourced observation network is an integral feature of WxVision (Personal) and cannot be disabled. Customers who require private operation should use WxVision (Industrial), for which participation in the wider crowdsourced network is optional.
From WxVision (Personal) devices we may process sky imagery and timelapses, including raw images and image sequences and derived images such as contrast-enhanced, HDR, cropped or otherwise processed versions; audio recordings from on-device microphones used internally for environmental feature development; and associated metadata such as timestamps, device identifiers, precise location where scientifically necessary, and basic camera and exposure parameters.
We deliberately design the device to look primarily at the sky, including through mounting guidance, field of view and image-processing methods. Nearby buildings, gardens, vehicles or people may nevertheless be incidentally captured in some frames.
Where reasonably practicable, before data is supplied externally we minimise identifying information, including by cropping or masking non-sky regions, blurring identifiable people or vehicle registration plates, removing account identifiers, reducing location precision where exact coordinates are not required, and aggregating derived observations.
WxVision (Personal) imagery and derived observational data may be used, modified, analysed, combined with other datasets and commercially licensed by Wx Labs. Where imagery contains identifiable people or avoidable private-ground detail, we will normally crop, mask, blur or otherwise de-identify those elements before onward licensing where feasible.
Under our WxVision Terms of Sale / Terms of Service, customers retain their rights in imagery generated by their own device while granting Wx Labs the licence required to use, modify, analyse and commercially use and license the observational data in accordance with those terms. This Privacy Policy explains the data-protection aspects of that processing; the contractual licence itself is governed by the applicable product terms.
3.5. WxVision (Industrial)
WxVision (Industrial) is intended for professional and organisational users. By default, we process only the data needed to provide the agreed services, including sky imagery and metadata, optional audio data, device configuration and related operational information.
Industrial customers may opt in to participation in the wider Wx Labs crowdsourced dataset for AI training, research and commercial data products. If an industrial customer later withdraws that participation, we will stop using future data for those optional purposes from that point onwards. We may continue to use models and derived datasets already generated from earlier data where those outputs cannot practicably be reversed and no longer permit reasonable identification of individuals.
3.6. Support, communications and CRM
When you contact us or we interact as part of a project, we may process your contact details, organisation and role, the content of emails and support messages, troubleshooting information you provide, and notes of interactions kept in our internal CRM, currently Notion, for business relationship management.
3.7. Mailing lists, events and marketing
If you sign up for updates or attend events we organise, we may process contact details and preferences, subscription status, email engagement information, and event-registration information. Mailing lists may be operated using providers such as Brevo. Marketing email is opt-in, with double opt-in where supported, and you can unsubscribe at any time.
3.8. Recruitment
When you apply for a role, we may process CVs, covering letters and application details, the application source, interview notes and evaluation outcomes, and references where you have authorised us to collect them. We do not ask for unnecessary special-category information and only process what is reasonably needed for recruitment.
4. How and why we use personal data (lawful bases)
Under UK GDPR we must have a lawful basis for each use of personal data. We mainly rely on contract, legitimate interests, consent and legal obligation.
4.1. Contract
We use data where necessary to perform a contract with you or to take steps at your request before entering into one. This includes processing and delivering orders, creating and managing your Wx Labs account, registering and operating your WxVision device and associated dashboards, providing support, handling warranties, returns or repairs, and communicating with you about orders, service changes and safety notices. Our legal basis in these cases is performance of a contract (UK GDPR Art. 6(1)(b)).
4.2. Legitimate interests
We use data where necessary for our legitimate interests, balanced against your rights and reasonable expectations. These interests include operating the Wx Labs crowdsourced network; training and improving AI and signal-processing models; developing meteorological products and services; generating research and commercial datasets; licensing observational imagery and derived data in accordance with the applicable WxVision product terms; improving reliability and security; understanding how the website and products are used, including cookieless website analytics; and managing B2B relationships with customers, suppliers, partners and prospects. Our legal basis here is legitimate interests (UK GDPR Art. 6(1)(f)).
For WxVision (Personal), crowdsourcing is a core and prominently communicated feature of the product. For WxVision (Industrial), participation in the wider crowdsourced dataset is optional and may be withdrawn for future data.
4.3. Consent
We rely on consent for marketing emails and newsletters, non-essential cookies if we use them, and other situations where we ask for clear, specific permission for an optional use of data. You can withdraw consent at any time, for example through an unsubscribe link. Our legal basis in these cases is consent (UK GDPR Art. 6(1)(a)). Cloudflare Web Analytics does not use cookies, so we do not ask for cookie consent for it.
4.4. Legal obligations
We may process data where necessary to comply with legal obligations, including maintaining accounting records, responding to lawful requests from public authorities, and dealing with complaints, disputes or regulatory investigations. Our legal basis here is legal obligation (UK GDPR Art. 6(1)(c)).
5. Audio and environmental sound data
WxVision devices may use microphones for meteorological and environmental purposes. Raw audio may be used internally to research and develop features such as detection or estimation of rain intensity, hail, thunder, wind or fan behaviour, wildlife and environmental noise.
We do not use raw audio for speech transcription, do not attempt to identify individuals from their voices, and do not share raw audio with third parties. We may share derived parameters, such as rain intensity, sound-pressure level or environmental event classifications, where those outputs are not intended to identify an individual.
Voices may occasionally be captured incidentally. Such recordings are subject to heightened access and retention controls.
6. How long we keep data (retention)
We keep personal data only for as long as reasonably necessary for the purposes described in this policy, including legal, accounting, scientific and reporting requirements. In some cases, we may retain data for longer where required by law, to establish or defend legal claims, or to respond to regulatory investigations.
6.1. Website and store
Web-server logs are typically kept for up to 12 months. Shopify order and invoice data is generally retained for 7 years to meet UK tax and accounting requirements. Cloudflare Web Analytics retains aggregate site-measurement data for up to six months.
6.2. Accounts, communications and CRM
Wx Labs account details and device registration information are kept while your account is active; after closure we may retain minimal records for up to 2 years for security and record-keeping. CRM notes and project correspondence are typically retained while the relationship is active and for up to 5 years after the last meaningful interaction. Mailing-list data is kept until you unsubscribe, with a minimal suppression record potentially retained for up to 2 years. Support communications are typically retained for up to 5 years after resolution.
6.3. Sky imagery and derived data
Because WxVision imagery is intrinsically valuable for meteorology, forecasting and climatology, we distinguish between identifiable and irreversibly anonymised forms.
Images and timelapses in which individuals, private property or other identifying features remain reasonably identifiable are generally retained for up to 5 years from capture, unless a longer period is justified for a specific project, legal claim or regulatory purpose. In practice, we aim either to delete or to anonymise such material within this period.
Where sky imagery or derived data has been irreversibly anonymised such that no individual is reasonably identifiable - for example through permanent removal of non-sky regions and other identifying elements - it is no longer personal data for UK GDPR purposes and may be retained indefinitely for meteorological, scientific, archival and commercial purposes.
Trained models and derived products may also be kept indefinitely where they do not permit reasonable re-identification of individuals.
6.4. Audio
Raw audio recordings used internally for feature development and training are retained for a maximum of 2 years from capture and are then deleted or irreversibly anonymised. Derived audio features may be retained indefinitely once they no longer relate to an identifiable individual.
6.5. Recruitment
For unsuccessful job applicants, we retain applications and related data for up to 2 years after the end of the recruitment process, unless law requires otherwise or you have agreed to a different period. For successful applicants, relevant information becomes part of the personnel file and is retained according to employment-law and internal HR requirements.
We review retention periods periodically and may adjust them as our services, scientific requirements and legal obligations evolve.
8. International transfers
Some of our service providers operate internationally, so personal data may be processed outside the UK or European Economic Area. Where required, we use appropriate safeguards such as UK adequacy regulations, the UK International Data Transfer Agreement or UK Addendum to approved standard contractual clauses, or other lawful transfer mechanisms. You can contact privacy@wxlabs.co.uk for further information about safeguards relevant to a particular service.
9. Your rights
Under UK data-protection law you may have rights including access to your personal data, rectification of inaccurate data, erasure in certain circumstances, restriction of processing, data portability, objection to processing based on legitimate interests, and withdrawal of consent where consent is the lawful basis.
For WxVision observational data, your ability to request deletion or object may be limited where the information has already been irreversibly anonymised or incorporated into models or derived products that no longer constitute personal data. We will consider each request and explain what action can reasonably and lawfully be taken.
To exercise your rights, email privacy@wxlabs.co.uk.
You also have the right to complain to the Information Commissioner's Office (ICO). Our ICO registration reference is ZB954744. Further information is available from the ICO.
10. Age limits and child privacy
Our products and services are not intended for children under 16, and we do not knowingly collect personal data directly from children for account or purchasing purposes. Accounts and purchases should be made by an adult, even where younger people assist with device installation or use. If you believe a child has provided personal data to us without appropriate involvement of a parent or guardian, please contact us and we will take appropriate action.
11. Information security and incident response
We use a combination of technical and organisational measures to protect personal data. These may include encrypted connections, role-based access controls, authentication and multi-factor authentication on key systems, software updates and security patching, encryption of storage where appropriate, and limiting access to personal data to authorised staff and contractors with a legitimate need.
No system can be guaranteed to be completely secure. If we become aware of a personal-data breach that requires notification under applicable law, we will notify the ICO and affected individuals as required.
12. Changes to this policy
We may update this Privacy Policy from time to time as our products, services, data uses or legal obligations change. Material changes will be brought to users' attention where appropriate. The version history and 'Last updated' date at the top of this document show the revision history.