CAT4OM Privacy Policy

Effective date: 27 June 2026
Last updated: 27 June 2026

This Privacy Policy explains how personal data is processed in connection with the public CAT4OM website, the CAT4OM software update and optional usage-statistics service, and restricted CAT4OM testing or download areas.

1. Data controller

The data controller is:

Daniele Pistollato – IW3HMH
Italy
Email: lele@pisto.it

For any privacy question or request, please use the contact address above.

2. Principles and scope

CAT4OM is designed to operate primarily on the user’s own systems. We do not sell personal data, build advertising profiles, or track users across unrelated websites.

This Policy covers:

the public website at www.cat4om.com;
update checks and optional statistics sent by CAT4OM Client or CAT4OM Server;
restricted alpha, beta, reporting, or download areas hosted on the CAT4OM website;
messages sent directly to the CAT4OM project;

It does not cover third-party websites or services linked from CAT4OM, which operate under their own privacy terms.

3. Data processed when visiting the website

The public website does not require an account, newsletter subscription, or submission of personal information merely to browse public pages or download public resources.

Like any web service, the hosting infrastructure necessarily receives technical data such as:

IP address;
date and time of access;
requested page or file;
HTTP status and technical error information;
browser, operating system, and user-agent information;
referring page, where supplied by the browser.

These data are used to deliver the website, maintain security, diagnose faults, prevent abuse, and produce limited operational statistics.

4. CAT4OM update checks and optional statistics

CAT4OM Client and CAT4OM Server can contact the CAT4OM update service. The two functions are controlled separately in the software settings.

Update checks

When update checking is enabled, the request may include:

whether the request comes from CAT4OM Client or CAT4OM Server;
the installed software version;
the station country configured in CAT4OM;
for CAT4OM Server, the identifiers of the configured radio handbooks or models.

The server also necessarily receives the source IP address as part of the internet connection.

Optional usage statistics

When Send statistics is enabled, CAT4OM may additionally send the station callsign entered by the user. Sending statistics is disabled by default and can be turned off in the CAT4OM settings. The callsign is not required for an update check.

Update and statistics data are used only to:

report whether a newer version is available;
deliver relevant project notices;
understand version adoption and hardware compatibility;
plan testing, maintenance, and documentation;
investigate abuse or faults affecting the service.

CAT4OM does not receive radio traffic, frequencies, QSO logs, messages, passwords, serial-port contents, or the user’s complete radio configuration through this service.

5. Restricted testing and download accounts

Access to restricted alpha, beta, reporting, or download areas may be granted to selected contributors and testers. For these areas we may process:

username or callsign;
password hash;
assigned access permissions;
session identifier;
login, logout, and download audit events;
downloaded filename and event timestamp;
technical security logs, including IP address where recorded by the hosting infrastructure.

Passwords are stored as password hashes and not as readable passwords. These data are used to authenticate users, protect non-public releases, administer permissions, and audit access to restricted material.

6. Communications and support

If you contact the CAT4OM project, we process the information you choose to provide, such as your name, callsign, email address, technical configuration, diagnostic information, attachments, and message contents. These data are used to answer the request, provide support, investigate reported problems, and maintain necessary project correspondence.

Please do not send passwords, private keys, or unrelated personal information in support messages or diagnostic files.

7. Website statistics

CAT4OM does not use Google Analytics or another third-party visitor analytics service. The hosting provider may produce technical traffic and infrastructure statistics as part of the hosting service under its own contractual and privacy documentation.

8. Web fonts

The website may retrieve open-source fonts from the Google Fonts Web API. When this remote service is used, the visitor’s browser connects directly to Google and sends the IP address, requested resource, user agent, and referrer required for the HTTP request. Google states that Google Fonts does not set cookies and does not use this information for targeted advertising. See Google Fonts privacy and data collection.

Where fonts are hosted locally by CAT4OM, no font request is sent to Google.

9. Embedded content from other websites

CAT4OM pages may include content hosted by another website, such as a video, image, document, or interactive component. Loading or interacting with embedded content may allow that provider to receive the visitor’s IP address and browser information, place cookies or similar technologies, and record the interaction as if the visitor had visited the provider’s website directly.

Where applicable, non-essential embedded content is blocked until the visitor has made the required consent choice. The external provider processes data under its own privacy terms.

10. Cookies and similar technologies

The website may use strictly necessary cookies for security, session management, restricted-area authentication, and storage of cookie preferences. These cookies are required for the requested function and cannot be used to create advertising profiles.

When an authorised administrator or restricted-area user signs in, WordPress or CAT4OM may use temporary and session cookies to test cookie support, authenticate the user, remember a requested login, protect forms, and save display preferences. Their duration depends on the selected function; WordPress login cookies normally last two days, or up to two weeks when “Remember me” is selected, while display preferences may last up to one year. Logging out removes the authentication cookies.

CAT4OM does not use analytics or advertising cookies. If a page contains optional embedded content that uses cookies or similar technologies, that content is handled in accordance with the visitor’s consent choice where consent is required.

CAT4OM does not use advertising cookies.

11. Legal bases

Where the GDPR, UK GDPR, or equivalent rules apply, we rely on the following legal bases:

performance of a contract or steps requested by the user: provision of restricted access, downloads, update checks, and requested support;
legitimate interests: secure and reliable operation, abuse prevention, spam filtering, service diagnostics, compatibility analysis, and administration of the project, balanced against the rights of affected individuals;
consent: the optional transmission of the station callsign for CAT4OM usage statistics and other optional processing where consent is the appropriate basis;
legal obligations: retention or disclosure required by applicable law or a valid request from a competent authority.

12. Recipients and service providers

Personal data may be processed by providers used to operate the service, including:

OVHcloud, as website and server hosting provider;
providers of security, backup, and content-delivery services;
Google, where remotely hosted Google Fonts are enabled;
email providers used for support correspondence;
professional advisers or competent authorities where necessary and legally justified.

Providers receive only the data reasonably necessary for their function. We do not sell or rent personal data.

13. International transfers

The website is hosted by OVHcloud. OVHcloud processes website content and hosting data as a service provider under the applicable service terms and data-processing agreement. OVHcloud may also process certain account, infrastructure, security, and legally required records for its own documented purposes.

Some providers may process data outside the European Economic Area or the United Kingdom. Where required, transfers are made using an applicable adequacy decision, approved contractual safeguards, or another lawful transfer mechanism. Information about the safeguards relevant to a particular request can be obtained using the contact details above.

14. Retention

We apply the following retention rules:

hosting and infrastructure logs managed directly by OVHcloud: CAT4OM does not determine their exact retention period. Their retention is governed by the subscribed OVHcloud service, the applicable contractual and data-processing terms, and OVHcloud’s security and legal obligations. See OVHcloud Personal Data Protection and the OVHcloud Personal Data Usage Policy. CAT4OM does not independently archive these logs beyond their availability in the hosting service unless needed for a documented security incident or legal claim;
copies of hosting logs downloaded or separately stored by CAT4OM: no more than 30 days, unless needed for a documented security incident or legal claim;
identifiable update-check and optional usage-statistics records: no more than 12 months, after which they are deleted or converted into aggregate statistics that no longer identify a user;
restricted-area accounts: for as long as access remains authorised; obsolete accounts are removed during periodic access reviews;
restricted-area audit logs: no more than 24 months, unless needed for a security investigation or legal claim;
support correspondence: no more than 24 months after the request is closed, unless the message is needed for ongoing development history, security, or legal reasons;
backups: retained on a rotating basis for no more than 90 days, unless isolation of a backup is required for security or legal reasons.

Data required for an active dispute, security investigation, or legal obligation may be retained until that purpose ends.

15. Your rights

Subject to applicable law, you may request:

access to your personal data;
correction of inaccurate data;
deletion of data;
restriction of processing;
portability of data you supplied, where applicable;
objection to processing based on legitimate interests;
withdrawal of consent at any time, without affecting earlier lawful processing.

You may exercise these rights by emailing lele@pisto.it. We may need to verify your identity before acting on a request.

These rights are subject to the conditions and exceptions provided by applicable law and are not absolute. CAT4OM can act on personal data that it controls and can reasonably identify as relating to the requester. CAT4OM is not required to collect or retain additional identifying information solely in order to locate data that cannot otherwise be linked to a person.

Where a service provider processes identifiable data on behalf of CAT4OM, we will seek the provider’s assistance when this is legally required, appropriate, and technically feasible. Where a third party processes data for its own independently determined purposes, the request must be made to that third party under its own privacy procedures. CAT4OM cannot guarantee the deletion of infrastructure or security logs controlled by OVHcloud, Google, or another provider, particularly where an individual request cannot be identified in those logs or retention is necessary for security or legal obligations.

You also have the right to complain to the competent supervisory authority. In Italy this is the Garante per la protezione dei dati personali.

16. Automated decisions

CAT4OM does not make decisions producing legal or similarly significant effects through automated processing.

17. Security

We use reasonable technical and organisational measures appropriate to the nature of the service, including access controls, password hashing, encrypted HTTPS connections, restricted administrative access, backups, and software maintenance. No internet service can guarantee absolute security.

18. Changes

This Policy may be updated when CAT4OM features, providers, or legal requirements change. Material changes will be identified by a new revision date on this page.