Nebula Privacy Policy

1. Data controller

The controller of personal data processed by Nebula is NATIVA CONSULTORIA LTDA, Brazilian company registry number (CNPJ) 68.630.168/0001-14, headquartered in Campinas/SP, Brazil ("Nativa", "we"), under Brazil's Lei nº 13.709/2018 (LGPD).

Privacy contact channel: contact@nativaag.com.br. As a small-scale data processing agent (an EPP-classified company electing Simples Nacional taxation), Nativa is exempt from formally appointing a named Data Protection Officer under ANPD Resolution CD/ANPD No. 18/2024, and instead maintains this direct communication channel with data subjects.

2. What data we collect

2.1. Data you give us

• Registration: full name, email, phone, organization, and how you work in agriculture (grower, consultant, etc.).
• Authentication: email and password are managed by Supabase Auth; we never store your password in plain text.
• Operational data: grower, farm and field names you register, and the geometries (coordinates) of those fields.
• Billing data: where applicable, legal/company name, tax ID (CPF/CNPJ) and address used to issue your tax invoice (NFS-e).

2.2. Data collected automatically

• Usage records: which analyses were run, when, duration, and area processed (to enforce your plan's limits).
• Basic technical access data (IP address, timestamp), retained by our cloud infrastructure for security and debugging.

2.3. Payment data

Payments for paid plans are processed directly by Stripe. We do not have access to or store your full credit card number; we only receive customer/subscription identifiers and payment status.

3. Why we use your data (purpose and legal basis)

• Contract performance (LGPD art. 7, V): creating and maintaining your account, running requested analyses, enforcing your plan's limits.
• Compliance with a legal or regulatory obligation (art. 7, II): issuing tax invoices and other fiscal obligations.
• Legitimate interest (art. 7, IX): platform security, fraud and abuse prevention, rate limiting — always applied proportionally and without harming your fundamental rights.
• Communication: sending transactional emails (signup confirmation, password recovery, subscription notices), grounded in contract performance.
• Legal compliance: when required by law or court order.

4. Who we share data with

We do not sell your personal data. We share data only with providers who operate Nebula's infrastructure, under contract:

• Supabase (authentication, database, file storage) — may process data on servers outside Brazil.
• Google Cloud Platform (application hosting) — may process data outside Brazil.
• Stripe (payment processing) — receives billing data needed to charge your subscription.
• Tax invoice (NFS-e) issuer — receives the billing data needed to issue your subscription's tax invoice.
• Amazon Web Services (Open Data) — public source of the satellite imagery; does not receive your personal data, we only read public imagery from it.

4.1. International transfer

Because the providers above may host infrastructure outside Brazil, your data may be transferred internationally to provide the Service, always with providers that adopt security measures compatible with the LGPD (article 33).

5. Your rights as a data subject (LGPD, article 18)

You may, at any time, request:

• confirmation that we process your data, and access to it;
• correction of incomplete, inaccurate, or outdated data;
• anonymization, blocking, or deletion of unnecessary data or data processed unlawfully;
• portability of your data to another provider;
• deletion of data processed based on your consent;
• information about who we share your data with;
• withdrawal of consent, where applicable;
• review of decisions made solely through automated processing that affect your interests, where applicable.

To exercise any of these rights, email contact@nativaag.com.br. This is currently handled manually by our team; we may ask you to confirm your identity before acting on a request, and we will respond within a reasonable time.

6. Data retention

We keep your data while your account is active. After your account is closed:

• After your account is blocked, your operational data (fields, analyses) remains available for export for up to 30 days before being deleted or anonymized following the process described in our account deletion workflow, unless legally required to retain it.
• Fiscal documents (issued invoices, billing data) are retained for the period required by applicable tax and civil law (generally up to 5 years, under article 206 of the Brazilian Civil Code and Simples Nacional tax rules).
• Security and access logs may be retained for a further reasonable period for incident investigation or the regular exercise of rights in legal proceedings.

7. Information security

• All communication with Nebula is encrypted via HTTPS.
• Passwords are managed by Supabase Auth and never stored in plain text.
• Integration API keys are stored only as a hash (SHA-256), never in plain text.
• Access to the admin console is restricted to explicitly authorized accounts.

No system is fully immune to incidents; in the event of a relevant security incident, we will notify affected data subjects and Brazil's ANPD as required by the LGPD.

8. Local browser storage and external resources

Nebula uses your browser's localStorage/sessionStorage to keep you signed in and remember preferences (like language) — we do not use third-party advertising or profiling cookies. This page loads typefaces from Google Fonts, which may expose your IP address to Google when the page loads.

9. Children

The Service is not directed at anyone under 18, and we do not knowingly collect data from minors.

10. Changes to this policy

We may update this policy periodically. Material changes will be communicated by email or in-app notice.

11. Language

This document is also available in Portuguese, at /privacidade.html, which is the legally governing version under the LGPD; in case of any conflict or divergence in interpretation, the Portuguese text prevails.

12. Contact

To exercise your rights or ask about how we handle your data: contact@nativaag.com.br.