GeoLira Privacy Policy, version 2.0, updated 5 November 2026. Details about the data controller, purposes and legal bases, data recipients, retention and user rights.
1. Controller and brand owner
The controller of personal data processed through GeoLira is BOMEGA SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ, Długa 2B, 56-416 Twardogóra, Poland, KRS 0000841054, NIP 9112034523. Contact [email protected]. GeoLira Team owns the GeoLira project and brand. Ownership of the brand does not automatically mean acting as the website's personal data controller. Send privacy requests to Bomega.
2. Scope
This Policy covers visits to geolira.com, user accounts, private functions, anonymous submissions, meditation, notification preferences, communications and technical information. External websites linked from GeoLira may process information under their own policies. Not all data categories below are collected from every visitor.
3. Types of data
Depending on the feature, GeoLira may process email addresses, account identifiers, session details, profile preferences, journal entries, dreams, synchronicities, meditation records, Telegram identifiers, notification preferences, submissions, contact messages and technical data such as IP address, request time, requested URL, browser type and diagnostics. The data processed depend on the actual functions used.
4. Purposes and legal bases
Account creation and requested private features generally rely on GDPR Article 6(1)(b), performance of a contract. Support and complaints may rely on Articles 6(1)(b), (c) or (f), depending on the matter. Security, abuse prevention and claims protection generally rely on the controller's legitimate interests under Article 6(1)(f). Consent, where necessary for a specific optional function or technology, relies on Article 6(1)(a). Legitimate interests include system safety, account protection and handling legal claims.
5. Registration and login
Providing registration information is voluntary, but the account-related function cannot work without required details. GeoLira uses WordPress authentication and session safeguards. Passwords should not be shared by email or via contact forms, and suspected unauthorized use should be reported.
6. Private records and sensitive information
Journals, dream notes, synchronicity entries and meditation sessions are intended for the signed-in owner and are not public by default. Users choose what to enter and should avoid unnecessary data about third parties or sensitive categories such as health or beliefs. If special-category personal data are supplied, further GDPR Article 9 conditions may become relevant and must be assessed separately.
7. Anonymous community submissions
Anonymous check-ins, intentions and place suggestions are not automatically linked to WordPress account IDs in the application record. The content or connection logs may nonetheless allow identification, so anonymous should not be understood as an absolute guarantee. Where provided, a one-time token and record identifier help users delete their submissions.
8. Telegram and notifications
When a user activates Telegram integration, the service may process a messaging identifier, account link, delivery status and preferences. This enables the selected functionality. Telegram is an independent service provider subject to its own rules. Integrations may be disconnected where available, or users can contact the operator.
9. Contact and complaints
When users contact GeoLira, the operator processes the sender's details, message and voluntarily provided information to respond, handle complaints or fulfill data rights requests. Do not include passwords, tokens or complete private journals unless essential. Communications may be kept as needed to manage the matter or legal claims.
10. Logs and IP addresses
Servers and infrastructure providers may process IP addresses, timestamps, accessed URLs, browser information and errors for website operation, diagnostics and security. The application's rate-limit records do not persist raw IP addresses, but separate server and traffic-protection logs may contain them.
11. External scientific data
Scientific observations may originate from independent providers. Viewing public scientific data does not itself involve disclosing a user's private journal to those sources. Following links to external sites may involve data processing by their independent operators.
12. Cookies and browser storage
GeoLira uses technologies necessary for sign-in and sessions, plus localStorage and sessionStorage for interface preferences, deletion receipts for anonymous submissions and safe software updates. The current web bundle contains no third-party advertising or analytics scripts. The Cookie Policy linked in the footer explains browser storage and user controls.
13. Recipients
Personal data may be accessed by authorized persons and technical providers acting for the controller, including hosting, email, web delivery, traffic protection and messaging services where needed. Website traffic protection and delivery infrastructure include Cloudflare. Telegram may receive relevant data if the user enables that integration. Public authorities may receive information when legally required.
14. Transfers outside the EEA
Some infrastructure and communications suppliers may process information outside the European Economic Area. Such transfers require an applicable mechanism and safeguards under GDPR Chapter V, such as an adequacy decision or Standard Contractual Clauses as relevant. Details of safeguards applicable to a specific transfer may be requested from the controller.
15. Retention
Anonymous community check-ins are subject to an automated 30-day retention period, global intentions to 120 days and place suggestions to 365 days. Terminal Telegram delivery records with DELIVERED or DEAD status are subject to 30-day retention. Private account data have no automatic expiry period and are kept until user deletion or request, subject to overriding legal obligations. Logs, security backups and correspondence may follow separate periods appropriate to their purpose.
16. Export and deletion
Signed-in users can use My Data to export and delete supported categories of private records. Anonymous submissions may be deletable with a record identifier and one-time token where the relevant feature supports this. Losing the token may prevent self-service deletion. A request can also be made to [email protected].
17. Data subject rights
Subject to the GDPR and applicable exceptions, individuals may request access, copies, rectification, erasure, restriction and portability of personal data, and object to processing based on legitimate interests. Where consent is the legal basis it may be withdrawn without affecting prior lawful processing. Requests should be sent to [email protected].
18. Supervisory authority
Individuals have the right to complain to a competent data protection authority. In Poland this is the President of the Personal Data Protection Office (UODO), www.uodo.gov.pl. Contacting the controller first is optional, not a prerequisite for filing a complaint.
19. Automated decisions
GeoLira displays measurements, summaries and interpretations for users to view. The described functions are not designed to take solely automated decisions having legal or similarly significant effects on individuals within GDPR Article 22. Material changes in such processing require appropriate information and safeguards.
20. Safeguards
The website uses HTTPS, WordPress authentication, owner-specific controls for private entries and API request safeguards. No technology eliminates all risks. Suspected compromise or unauthorized disclosure should be reported to the operator promptly. Detailed defensive configurations are not disclosed where that would weaken security.
21. Voluntary data provision
Public information can be accessed without an account. Data required for registration or a chosen private feature are voluntarily supplied but may be necessary to provide that function. Omitting contact details may prevent an effective response. Users should share only information relevant to their request.
22. Updates and contact
The current Policy is linked in the footer. Where processing materially changes, information and renewed consent will be provided when legally required. Questions about purposes, recipients, transfers, retention or data rights can be sent to [email protected]. Updated 3 November 2026.
23. Data categories depend on the feature used
GeoLira may process different categories of information depending on whether someone only reads public charts, registers an Account, enables notifications, uses the journal, records dreams, submits an intention or reports a source problem. Opening a public page does not mean the Service acquires every category of personal information associated with protected features. Basic connection metadata, session identifiers and selected preferences may arise automatically when necessary. Information can originate from forms, Account operations, the visitor's device or appropriately authorised server processing. A new purpose requires a suitable lawful basis and must not be hidden in a broad statement about product development. Keeping categories distinct helps assess individual rights, supplier responsibilities and the proper confidentiality safeguards.
24. Private journals and wellness entries
Journal records can contain self-rated energy, mood, sleep quality, concentration, meditation time, timestamps, timezone and optional notes. They are self-observations provided by the member, not clinical measurements from a medical device. Depending on the notes, special-category health information may be included and requires additional safeguards under GDPR. Not every journal entry necessarily contains health data. Access to private entries should be controlled through the member's Account. These records must not be exposed to other members or placed in public community aggregates without a separate appropriate basis. Saving a value does not automatically authorise medical profiling or sale of information. Members can use available controls to export, amend or delete their entries.
25. Private dreams, symbols and synchronicities
Dream and synchronicity records may describe events, repeating motifs, numbers, vividness and personally significant coincidences. Depending on the member's wording, they can indirectly reveal information about family relationships, beliefs or health. The presence of a symbol should not automatically be used to infer someone's worldview or generate a diagnosis. Entries are designed for private organisation of experiences. Staff should not publish them to public pages or expose them to unrelated third parties merely because they are stored on the system. Members should avoid unnecessary identifying details about others. Erasure and restriction rights depend on the applicable legal conditions, and access should remain limited to authorised purposes.
26. Inputs and outputs of personal correlation tools
Personal correlations can process private journal observations alongside public environmental metrics such as Kp, solar-wind speed, a custom Schumann index or Moon illumination. The tool can use observation timestamps, timezone information, record limits, matching windows and statistical coefficient results. These data serve the function requested by the authenticated member. Correlation outputs should remain associated with the authorised member rather than unrelated people. The calculation does not establish causation or automatically decide someone's medical status. Deleting source observations can require dependent results to be removed or recalculated. Any unrelated purpose, such as behavioural advertising or sharing individual results with a partner, would require a separate legal assessment.
27. Community submissions without Account identifiers
An anonymous check-in can accept voluntary self-ratings, dream or meditation categories, a local date and possibly country-level information. Validation limits are designed to avoid names, precise locations and free-text medical histories. Public aggregates should not reveal an individual response associated with a particular person. Voluntary participation cannot be treated as a representative population diagnosis. Anti-abuse safeguards can inspect a current request without necessarily storing the raw IP address in the check-in record. The module's documented contract excludes persistent Account identity, raw IP and user-agent in that record. Anonymous entries follow a separate retention schedule. Truly anonymised information does not receive GDPR treatment in the same way as data that can identify an individual.
28. Community intentions and place suggestions
Selected features can record anonymous intentions or suggestions of places with historical, symbolic or cultural significance. Information should remain limited to the relevant purpose, and location descriptions must not automatically expose private addresses. A suggestion can contain a timestamp, category and details necessary to review the material rather than a complete Account profile. Different submission types follow different retention periods. Users should not include third-party names or contact details without a suitable basis. A technical submission acknowledgement does not establish publication, accuracy or endorsement by the team. Linkable information remains personal data even when a form does not request a name. Moderation can create separate limited records needed to explain and resolve a reported violation.
29. Location and map operations
Interactive maps can generate requests for layers, tiles and a selected geographic area. Where a visitor voluntarily grants browser location permission, the location may be used to display a relevant map view within the limits of the actual implementation. Refusing geolocation must not be interpreted as advertising consent and should not unnecessarily prevent access to unrelated public information. A map or tile provider may receive technical request information, and its own technologies can be governed by separate terms and privacy duties. Precise coordinates should not be retained without an appropriate purpose and lawful basis. Place-suggestion features require particular care with private addresses, vulnerable people's locations and details that could identify someone without their permission.
30. Telegram and related identifiers
When enabled Telegram features are linked, GeoLira may process an integration identifier, notification preferences, delivery status and event times. The external messenger processes part of the information necessary for the communication requested by the user. Enabling a space-weather notification must not be assumed to automatically transmit a private personal journal to Telegram. Technical messages can remain within the messenger's systems according to its independent policies. Disconnecting a bot can stop new deliveries without deleting all earlier correspondence held by the external provider. Members should check their Telegram privacy settings and avoid sending passwords. Terminal delivery records on GeoLira's side follow their own retention cycle.
31. Notifications, correspondence and Account safety
Notification settings can include an email address, selected event categories, quiet hours and delivery status. Account administration can also require messages about security, recovery or material changes to the Service. Operational communications are different from advertising, and direct marketing requires its own legally appropriate assessment. Support correspondence can include contact details, the topic, case reference, problem description and voluntarily supplied attachments. Members should provide only necessary information and never send passwords or API keys. Access to correspondence should be appropriately restricted and subject to a defined retention purpose. Personal-data requests can require proportionate verification to protect the Account.
32. Purposes and corresponding lawful bases
Processing needed to provide an Account function may rely on Article 6(1)(b) GDPR where an appropriate contract genuinely exists. Protecting infrastructure and preventing abuse can rely on a legitimate interest after a suitable assessment. Statutory duties may require Article 6(1)(c). Additional purposes such as non-essential analytics or marketing need their own legal qualification and information. Consent must not be presented as the universal basis for every necessary technical action, and accepting the Terms must not be treated as permission for unlimited data use. Where processing is genuinely based on consent, members should receive adequate information and a way to withdraw it. Withdrawal does not retrospectively invalidate lawful earlier operations but cannot justify continuing an unnecessary purpose.
33. Health information and other special categories
Voluntary descriptions of wellness, psychological concerns, beliefs or intimate experiences can in some cases amount to special-category personal data. Calling a feature a journal does not remove Article 9 GDPR protections. Where that provision applies, processing requires a valid Article 9 condition in addition to an appropriate general legal basis. Such information should not become publicly visible by default. Members should minimise unnecessary details and avoid recording another person's health or beliefs without a suitable ground. GeoLira is not a medical-record system or patient database. Any future feature seeking to disclose such information for another purpose would need prior legal assessment and appropriate safeguards.
34. Retention periods by actual record type
Retention differs by category. The documented technical policy provides approximately 30 days for anonymous community check-ins, 120 days for global intentions, 365 days for sacred-place suggestions and 30 days for terminal Telegram delivery records. These periods refer to the relevant types of records, not to all information in an Account. Private journal records do not have one automatic expiry period under that same policy. Account records, security evidence, legal requests and disaster-recovery backups can follow other criteria reflecting purpose, legal duties and actual infrastructure. Removing a visible entry may not immediately destroy every isolated recovery copy that is unavailable during normal operation. Once the relevant purpose ends, data should be erased or effectively anonymised unless another lawful basis requires limited retention.
35. Account-linked exports and deletion
GeoLira offers controls related to exporting and deleting selected private records and personal information. Export scope depends on the module concerned; downloading a journal does not necessarily include every security event, external messenger record or independent provider's data. Before an irreversible deletion, a member should confirm that the exported copy includes the information they need and that the operation targets the correct part of the Account. Closing an entire Account can require additional confirmation of authority and consideration of other lawful duties. Effectively anonymised information may cease to be personal data if individuals can no longer be identified. Not every erasure request permits deletion of records legitimately needed to demonstrate compliance or protect others' rights. Applicable exceptions and information duties remain in place.
36. Recipients and technical hosting
Limited categories of information may be accessible to authorised support or to providers of hosting, backups, email, security and enabled external features, depending on the particular function. Merely operating a server does not in itself establish a company's legal role for every kind of processing. The actual purposes, means and responsibilities determine the relevant roles. Where a supplier acts as a processor, its arrangements should meet Article 28 GDPR. Independent controllers must be distinguished when the relevant transfer or relationship requires it. Not every provider receives a complete Account profile or private journal. Disclosures should remain limited to the data genuinely needed for a service.
37. Transfers outside the EEA
Where an external service processes personal data outside the European Economic Area, an appropriate transfer mechanism and safeguards under Chapter V GDPR are necessary. The assessment depends on what is actually disclosed, to whom and in connection with which enabled integration. Using a publicly available scientific data feed does not by itself imply that an entire private journal is exported to that provider. Telegram, email, map and infrastructure providers can have different operating models and terms. People may request information about relevant safeguards to the extent required by law. The Service should not claim without evidence that every category of data remains exclusively in Poland if actual integrations have not been assessed.
38. Security logs and incidents
Securing the Service involves protected Account access, HTTPS communications, controls over private data operations and infrastructure safeguards. Technical logs can include IP addresses, request times, errors, session references and indicators of excessive traffic. Access to logs should be controlled and proportionate to investigating failures and abuse. Pseudonymous technical information can remain personal data when linkable to an individual. A personal-data breach can trigger duties to assess risk, document the incident and notify the supervisory authority or affected people under GDPR where the relevant thresholds are met. Members should report suspected Account compromise through official channels and never send security codes by ordinary message. Safety controls do not authorise unrestricted processing of the private contents of personal notes.
39. Sorting and automated processing
GeoLira can organise charts, educational topics and community aggregates by source, time, geographic area, language and technical parameters. Ordinary filtering or visualisation does not automatically amount to solely automated decision-making with legal or similarly significant effects under Article 22 GDPR. Current personal correlations provide informational calculations rather than diagnoses or determinations of individual rights. Introducing significant advertising profiling, health-risk scoring or automated decisions substantially affecting people would require a separate compliance assessment and appropriate information. An authored index or matching timestamps must not be confused with establishing sensitive personal characteristics. Any new processing purpose should be assessed before launch.
40. Individual rights and supervisory complaints
Depending on the circumstances, people have rights of access and copies, rectification, erasure, restriction, portability, objection and withdrawal of consent where consent is the relevant lawful basis. Requests can be sent through the published privacy contact or appropriate Account controls. Proportionate verification may be needed to protect the requester's information, but support should not demand the Account password. Conditions and exceptions follow GDPR and other applicable laws. Individuals can complain to the competent supervisory authority, including the President of Poland's Personal Data Protection Office where appropriate. Statutory access to courts and relevant claims remains available. Choosing another interface language does not remove or reduce these protections.
Service operator
- Legal name
- BOMEGA SPÓŁKA Z OGRANICZONĄ ODPOWIEDZIALNOŚCIĄ
- Jurisdiction
- PL
- Contact
- [email protected]
- Privacy contact
- [email protected]
- Address
- ul. Długa 2B
56-416 Twardogóra
Polska - Registration ID
- KRS 0000841054, NIP 9112034523
- Contact URL
- https://geolira.com/contact