Privacy & Cookie Policy
1. Data Controller
NugLab is operated by NugLab de Daniele Pisu (NIF ESZ1872544G), domiciled at Calle Tinguafaya 90, Bloque 2, Planta A, Pta. A, Complem. Ed. Crisantemo, 38652 Santa Cruz de Tenerife, Islas Canarias, España. Contact for privacy matters: info@nuglab.app.
2. Data We Collect
- Account data: email address and display name when you register.
- Grow data: sensor readings, diary entries, nutrient schedules, photos and harvest records — the content you create inside NugLab.
- Device credentials: API tokens used to connect AC Infinity, Edenic, Pulse or other devices. These are stored encrypted in a secure vault and are never readable in plaintext by NugLab staff.
- Payment data: subscription status processed by Stripe. NugLab never stores full card numbers or CVV codes.
- Technical data: IP addresses (stored as irreversible HMAC hash, not plaintext), browser type, device model — retained for up to 90 days for security purposes.
3. Legal Basis
- Contract execution (Art. 6.1.b GDPR): account management, device connectivity, subscription billing.
- Legitimate interest (Art. 6.1.f GDPR): security, fraud prevention, service stability.
- Consent (Art. 6.1.a GDPR): anonymous website analytics via Google Analytics 4 (optional — only activated after your explicit acceptance in the cookie banner).
4. Data Processors
- Supabase Inc. (Ireland / USA — EU-US Data Privacy Framework): database, authentication, file storage.
- Stripe Inc. (USA — EU-US Data Privacy Framework): payment processing.
- Vercel Inc. (USA — EU-US Data Privacy Framework): website and application hosting.
- Google LLC (USA — EU-US Data Privacy Framework): anonymous website analytics via Google Analytics 4 (nuglab.app only). IP anonymisation is enabled.
We do not sell or share your personal data with advertisers or data brokers.
5. Data Retention
Account and grow data are retained while your account is active. After account deletion, data is removed within 12 months unless retention is required by law. Anonymised aggregate statistics may be retained indefinitely.
6. Your Rights (GDPR)
You have the right to: access your data, correct inaccuracies, request erasure ("right to be forgotten"), restrict or object to processing, and request data portability in machine-readable format.
To exercise these rights, email info@nuglab.app. We respond within 30 days. You may also lodge a complaint with the Spanish Data Protection Agency (AEPD) at aepd.es.
7. Cookies
NugLab uses strictly necessary session cookies for authentication and Google Analytics 4 cookies (_ga, _ga_*) on nuglab.app for anonymous traffic analysis. No advertising or behavioural tracking cookies are used. For the full cookie inventory, see our Cookie Policy.
8. Changes to This Policy
We may update this policy. Material changes will be notified by email. The date at the top of this page always reflects the latest revision.