Nebula Privacy Policy
Ler esta página em português (versão que prevalece legalmente)
This is a convenience translation. The Portuguese version at /privacidade.html is the legally governing text under Brazil's LGPD; in case of any conflict, the Portuguese version prevails.
In short: we collect the registration data you give us and the geographic boundaries of the fields you draw, to operate Nebula. We do not sell your data. Third parties that help run the service (Supabase, Stripe, Google Cloud) process some data on our behalf, as detailed below. You can request access, correction, or deletion of your data at any time.
1. Data controller
The controller of personal data processed by Nebula is [Legal company name to be confirmed], CNPJ [to be confirmed] ("Nativa Agro", "we"), under Brazil's Lei nº 13.709/2018 (LGPD). Privacy contact: contact@nativaag.com.br.
2. What data we collect
2.1. Data you give us
- Registration: full name, email, phone, organization, and how you work in agriculture (grower, consultant, etc.).
- Authentication: email and password are managed by Supabase Auth; we never store your password in plain text.
- Operational data: grower, farm and field names you register, and the geometries (coordinates) of those fields.
2.2. Data collected automatically
- Usage records: which analyses were run, when, duration, and area processed (to enforce your plan's limits).
- Basic technical access data (IP address, timestamp), retained by our cloud infrastructure for security and debugging.
2.3. Payment data
Payments for paid plans are processed directly by Stripe. We do not have access to or store your full credit card number; we only receive customer/subscription identifiers and payment status.
3. Why we use your data (purpose and legal basis)
- Contract performance: creating and maintaining your account, running requested analyses, enforcing your plan's limits.
- Billing: processing payments for paid plans and managing your subscription.
- Communication: sending transactional emails (signup confirmation, password recovery, subscription notices).
- Security and fraud prevention: detecting abusive use, enforcing rate limits.
- Legal compliance: when required by law or court order.
4. Who we share data with
We do not sell your personal data. We share data only with providers who operate Nebula's infrastructure, under contract:
- Supabase (authentication, database, file storage) — may process data on servers outside Brazil.
- Google Cloud Platform (application hosting) — may process data outside Brazil.
- Stripe (payment processing) — receives billing data needed to charge your subscription.
- Amazon Web Services (Open Data) — public source of the satellite imagery; does not receive your personal data, we only read public imagery from it.
4.1. International transfer
Because the providers above may host infrastructure outside Brazil, your data may be transferred internationally to provide the Service, always with providers that adopt security measures compatible with the LGPD (article 33).
5. Your rights as a data subject (LGPD, article 18)
You may, at any time, request:
- confirmation that we process your data, and access to it;
- correction of incomplete, inaccurate, or outdated data;
- anonymization, blocking, or deletion of unnecessary data or data processed unlawfully;
- portability of your data to another provider;
- deletion of data processed based on your consent;
- information about who we share your data with;
- withdrawal of consent, where applicable.
To exercise any of these rights, email contact@nativaag.com.br. This is currently handled manually by our team; we may ask you to confirm your identity before acting on a request, and we will respond within a reasonable time.
6. Data retention
We keep your data while your account is active. After your account is closed, we may retain data for an additional period when required by legal, tax, or litigation-related obligations, after which it is deleted or anonymized.
7. Information security
- All communication with Nebula is encrypted via HTTPS.
- Passwords are managed by Supabase Auth and never stored in plain text.
- Integration API keys are stored only as a hash (SHA-256), never in plain text.
- Access to the admin console is restricted to explicitly authorized accounts.
No system is fully immune to incidents; in the event of a relevant security incident, we will notify affected data subjects and Brazil's ANPD as required by the LGPD.
8. Local browser storage
Nebula uses your browser's localStorage/sessionStorage
to keep you signed in and remember preferences (like language) — we
do not use third-party advertising or profiling cookies.
9. Children
The Service is not directed at anyone under 18, and we do not knowingly collect data from minors.
10. Changes to this policy
We may update this policy periodically. Material changes will be communicated by email or in-app notice.
11. Contact
To exercise your rights or ask about how we handle your data: contact@nativaag.com.br.