w4app.com — Site Privacy Notice
This notice covers the website w4app.com and its product pages. Our apps are separate: each has its own privacy policy, linked from its page.
Who is responsible
Ilia Vlasov, operating as "w4app" (sole trader), domiciled in Finland, is the controller for the personal data described here. If the Service moves to a company we set up, that company takes over and we say so on this page.
To reach us about your data, use the contact form and choose "Your data". Every product privacy policy also carries an address you can write to directly.
Browsing the site
The site sets no advertising or analytics cookies, runs no tracking, and has no advertising identifiers, social widgets or third-party scripts that profile you.
Like any web server, ours records a technical log entry for each request: the time, the page requested, the status, the amount of data sent, the page you came from, your browser, and the IP address the request came from. It never contains what you type into the form. We use it to keep the site running and to see problems and abuse (GDPR Art. 6(1)(f)). The log is shared with the other sites on the same server, rotates daily and is deleted after 14 days.
When you write to us through the form
What we collect: the topic you pick, the product you pick if the topic is app help, your email address, your message, and your name if you choose to give it. Nothing else is required. Please don't put health details or documents into the form — for anything about your own data, a sentence is enough and we will ask for what we need.
What we do with it: the site's server sends your message to our mailbox as an email and does not store it on the website — there is no database behind the form. The email is sent through Amazon Web Services (Amazon SES) in Stockholm, Sweden, which acts as our processor, and it arrives in our iCloud mailbox, which is Apple's service. The reply address on the email is the one you typed, so when we answer, the answer goes to you.
Why we may do this: to answer you. That is our legitimate interest, and yours, in dealing with your enquiry (GDPR Art. 6(1)(f)); where your message is a request about your own data, we process it to comply with our legal obligation under the GDPR (Art. 6(1)(c)).
How long: your message lives in our mailbox. We keep support and general correspondence while it is useful and delete it when it is not; data-protection requests we keep for as long as we must be able to show we handled them. Amazon SES processes the message in order to deliver it; we have not configured it to archive messages or to record delivery events, and it is not a place we keep your message. The site's own log records only the topic of the message, whether it succeeded — including the technical error type if it did not — and how long it took; never your name, address or text. Those log files are deleted after about 30 days. AWS's own activity history does not record the sending of your message either: sending is a kind of event AWS logs only if the account switches that logging on, and ours has not.
Abuse protection: the form limits how many messages can be sent from one IP address in an hour. The counter lives in the website's memory, keyed by that address; it is never written to a file, a log or a database, and it is gone when the hour ends or the site restarts. The legal basis is our legitimate interest in not being flooded (GDPR Art. 6(1)(f)).
Who else sees your data
- Amazon Web Services (Amazon SES), Stockholm — sends the email, as our processor. AWS knows the domain we send from; we have not switched on its archiving or event-recording features.
- Apple (iCloud Mail) — hosts our mailbox.
- Nobody else. We do not sell or share your data, and no advertising or analytics company receives anything from this site.
Where your data goes
Our server and Amazon SES are in the EU (Stockholm). Apple may process mail outside the EU under its own terms and safeguards. To ask for a copy of the safeguards in place, write to us through the form.
Your rights
Under the GDPR you can ask us for a copy of your data, to correct it, to delete it, to restrict or object to how we use it, and to receive it in a portable form. Use the contact form with the topic "Your data". We answer within 30 days.
Because messages sent through this form are identified only by what you wrote in them, we may need to ask you which message you mean. If we cannot identify your data from what you give us, we will tell you (GDPR Art. 11).
You can also complain to your supervisory authority. In Finland that is the Office of the Data Protection Ombudsman (tietosuoja.fi).
Children
The site is not directed at children and we do not knowingly collect their data.
Changes
If we change this notice, the date at the top changes and the current version stays at this address.