Clear data rules

Privacy Policy

DataSurfer has no user accounts, newsletter or advertising profiles. It processes the public ride information needed to build the report, the messages people choose to send, limited technical data needed to operate the service and — only with your consent — website usage data through Google Analytics.

1. Public session links and ride data

   When you submit a shared Fliteboard session link, DataSurfer processes that URL and the information made available through it. Depending on the session, this can include the Flite nickname, session date and time, route or location, speed, power, battery, roll, pitch, temperatures, board, wing, stabilizer, propulsion and other ride telemetry.

   The source is the publicly accessible shared link supplied through the upload form. DataSurfer does not ask for your Flite password or access to your private Flite account.

2. Why session data is processed

   The data is used to process the ride, build the public analysis report, let riders explore sessions and support technical learning. Where session information is personal data, the legal basis is the controller's legitimate interest under Article 6(1)(f) GDPR in operating a voluntary public eFoil analysis service.

   Only submit a link you are entitled to share. If the link concerns another rider, you must have a lawful reason to make it available through DataSurfer.

3. Public means public

   Submitted sessions are included in a public Power BI report. Anyone with access to the report can view, copy or reshare the information, and public content may be indexed or captured outside DataSurfer's control. Do not submit a ride you want to keep private.

   To request removal, email info@datasurfer.app and include the public session link or rider nickname needed to locate the ride.

4. Contact messages

   If you use the contact form, email or WhatsApp, the information you choose to provide can include your name, email address, phone number, WhatsApp profile details, message, session link and an optional screenshot. It is used only to understand and answer the request, handle a data request or manage a practical collaboration.

   Contact-form submissions are transferred through Microsoft Power Automate and stored in a restricted SharePoint list. The legal basis is legitimate interest in answering correspondence, or steps requested before entering a contract where applicable.

5. Technical data

   The hosting, security and workflow providers may process standard technical records such as IP address, browser or device type, request time, referring page and error or security events. This is used to deliver, protect and troubleshoot the service, not to build a marketing profile.

6. Cookies and external content

   DataSurfer uses Google Consent Mode. The Google tag is present on each page, but analytics storage and all advertising consent signals are denied by default. Google Analytics cookies and full analytics measurement are enabled only after you select “Allow analytics”. With consent denied, the tag may send limited cookieless technical pings to Google, without analytics cookies or advertising and personalisation signals. DataSurfer uses analytics reports to understand which pages and features are useful, not for advertising or personalised marketing. The legal basis for full analytics measurement is your consent under Article 6(1)(a) GDPR.

   Your choice is stored in your browser. You can change or withdraw it at any time through “Cookie settings” in the footer. Analytics remains disabled if you decline.

   The interactive report is third-party content delivered by Microsoft Power BI and loads automatically on pages where it is embedded. Microsoft may process technical data and use cookies or similar technologies needed for Power BI under the Microsoft Privacy Statement. Clicking WhatsApp likewise opens a separate Meta service governed by the WhatsApp Privacy Policy.

7. Service providers and recipients

   Session links, contact-form messages and report data can be processed using Microsoft SharePoint, Power Automate and Power BI. With analytics consent, website usage data is processed by Google Analytics. Technical data can be handled by website hosting and security providers. Messages are handled by the relevant email provider or, if you choose it, WhatsApp. Public report viewers are also recipients of submitted session data.

   These providers may process information outside the European Economic Area under the transfer safeguards described in their own policies and contracts.

8. How long information is kept

   Public session data is kept while it remains useful for the public report, until the service is discontinued, or until a valid removal request or objection is accepted. Contact messages are kept only as long as needed to answer and manage reasonable follow-up, unless longer retention is required to establish or defend a legal claim. Technical logs follow the security and retention settings of the relevant provider and are removed when no longer needed for those purposes.

9. Your GDPR rights

   Depending on the circumstances, you may request access, correction, deletion, restriction or a copy of your personal data, and you may object to processing based on legitimate interests. You may also complain to your local supervisory authority. In Poland, this is the President of the Personal Data Protection Office (UODO).

10. Questions, removal requests and changes

    Email info@datasurfer.app or use WhatsApp at @SkandaSurf. This policy may be updated when the service, report or providers change. Material changes will be reflected on this page.

Last updated: 5 September 2026.