Who is responsible

SALSA is run by Onsala Space Observatory, the Swedish National Facility for Radio Astronomy, hosted by Chalmers University of Technology. For any question about your data, or to use any of the rights described below, email salsa.onsala@gmail.com.

What we store

• Your account. When you log in with Discord, GitHub, Google or Microsoft, we receive your account ID at that service and a display name, and store both. The display name is your Discord username, your GitHub login name, your name on Google, or your email address on Microsoft. We never see your password for those services. Local accounts, created by SALSA administrators, store a username and a hashed password.
• Your preferences: timezone and language.
• Your bookings: telescope, time, the optional description you write, and the country you booked from. The country is looked up from your IP address using a database on our own server; the IP address itself is not stored.
• Your observations: the spectra you record and the telescope settings used.
• Guest sessions: a random guest name, the telescope, the times, and the country the session came from. Guest observations are not saved.
• Server logs: technical events, used to find and fix problems with the telescopes and the website. They may contain SALSA's internal user number, a running count that SALSA assigns to each new account and that has nothing to do with your account at the service you log in with. They contain no names and no IP addresses.

Cookies

SALSA sets two cookies: one that keeps you logged in, and one that remembers your language. Both are needed for the site to work. There are no analytics, tracking or advertising cookies, and no third-party scripts.

Why we store it

We use this data to let you book the telescopes, observe, and download your results, and to keep the service running. We also use bookings, guest sessions, observations and countries as statistics on how SALSA is used, to decide where to spend our resources. The legal basis is public interest: SALSA is part of the observatory's education and outreach work.

Who can see it

SALSA's administrators can see all stored data. Other users can see which hours are booked, but not by whom, and cannot see your name, booking descriptions or observations. Totals on how SALSA is used are published on the statistics page; they cover whole months and never show individual users. We do not sell or share your data with anyone. The service you log in with (Discord, GitHub, Google or Microsoft) knows that you logged in to SALSA; their own privacy policies apply to that.

How long we keep it

Your data is kept as long as you have an account. You can delete individual observations on the Observation archive page at any time. When you delete your account on the Account page, your upcoming bookings are cancelled and your account is anonymised: your name, your account ID at the service you log in with, timezone, language and booking descriptions are removed. Your past bookings and observations, and the countries they came from, are kept for the usage statistics, but can no longer be connected to you. If you want your observations removed as well, delete them before deleting your account.

For privacy reasons we keep no backups, so deleted data is really gone. To protect against a failing hard drive, the server's system drive is mirrored (RAID).

Your rights

You have the right to see the data we hold about you, to have it corrected or deleted, to object to or restrict how we use it, and to get a copy of it.

Everything we store is listed under What we store above, and you can see your own data on the site. The Account page shows your name, login service, user number, timezone and language, and lets you change your timezone and language. The Bookings page shows your upcoming and past bookings, with the country recorded for each. The Observation archive shows all your observations, which you can download as CSV or FITS files or delete. To use any of your rights, contact us as described under Who is responsible.

If you think we handle your data wrongly, you can complain to the Swedish Authority for Privacy Protection, IMY.