1. Who We Are
Noktura runs noktura.tech, where we sell the OWL camera, and the Canopy platform at app.noktura.tech, where you store, label and share agricultural images.
Data Controller
We are not required to appoint a data protection officer. Questions about this policy go to the email above.
2. Data We Collect
Account Data
- Email address (required)
- Name and profile picture (from Google if you sign in with Google)
- Organisation, country and region (optional)
Content Data
- Images you upload, including any GPS in them
- Metadata you add (crops, weeds, camera, weather, location)
- Annotations and labels
- Group comments, invitations and access requests
Quote Requests (OWL)
- Name, email, country, number of units, what you will use it for
- Optional: organisation, phone, CVR/VAT number
- Whether you buy as a business or a private person
Technical Data
- IP address and browser details in security records
- Sign-in and account events
- Visit statistics for noktura.tech (see section 3)
3. How We Use Your Data
| Purpose | Legal basis (GDPR Art. 6) |
|---|---|
| Provide Canopy: your account, storage, processing, sharing, groups, downloads | Contract, Art. 6(1)(b) |
| Reply to a quote request and apply the right VAT and consumer terms | Steps before a contract, Art. 6(1)(b) |
| Device records for OWL units you claim: build, claim and update history | Contract, Art. 6(1)(b), and legitimate interests in device traceability, Art. 6(1)(f) |
| Protect accounts and the service: security records, bot checks on forms | Legitimate interests, Art. 6(1)(f) |
| Visit statistics for noktura.tech (not the app) | Legitimate interests, Art. 6(1)(f) |
| Service emails: confirmations, invitations, password resets | Contract, Art. 6(1)(b) |
Visit statistics. We count visits to noktura.tech with Plausible, which uses no cookies and stores nothing on your device. Each page view sends:
- the page address (campaign tags only, no other query text)
- the site you came from
- your browser and device type
- your approximate location (country, region and city), worked out from your IP address
Plausible counts unique visitors using a hash of your IP address and browser that changes every 24 hours, and stores neither. We also record clicks on links to other sites and when a quote request is sent. The app at app.noktura.tech is not counted.
We do not use cookies or other device storage for analytics or advertising. We do not sell your personal data.
4. Data Sharing
We share data only with the providers below. Those that process personal data on our behalf (Supabase, Hetzner, Vercel, Cloudflare, Resend, Plausible, Beehiiv) do so under data processing agreements. Google acts on its own account when you choose to sign in with Google. The public data services (OpenStreetMap Foundation, Open-Meteo, GBIF) receive only what is needed for the lookup.
| Provider | What for | Where |
|---|---|---|
| Supabase | Database and sign-in | EU (Frankfurt) |
| Hetzner | Image storage and processing servers | EU (Finland) |
| Vercel | Website hosting | Global network (US company) |
| Cloudflare | Bot checks on sign-in, password reset and quote forms | Global network (US company) |
| Resend | Sending emails, including quote requests | US |
| "Continue with Google" sign-in and your Google profile picture | US | |
| OpenStreetMap Foundation | Map tiles and place search in Canopy | UK |
| Open-Meteo | Weather for a dataset's location and date | Switzerland |
| GBIF | Species names | Denmark |
| Plausible | Cookieless visit statistics for noktura.tech | EU (Estonian company) |
| Beehiiv | Our newsletter, only if you subscribe on Beehiiv | US |
Passwords are checked against known data breaches using Have I Been Pwned. Only the first five characters of a one-way hash of your password leave our servers, never the password itself or anything that identifies you.
5. GPS Data Privacy
Images often contain GPS coordinates in EXIF metadata. We understand this can be sensitive information, particularly for agricultural operations. Noktura provides granular privacy controls:
- Dataset owners always see and receive precise GPS coordinates in their own downloads.
- Group members receive GPS based on the per-group location visibility setting chosen by the dataset owner when sharing:
- All: All group members see precise GPS coordinates
- Admins only: Only group admins and owners see precise GPS; regular members see region only
- None: No group members see precise GPS coordinates
- Region and country are always included in downloads regardless of GPS visibility settings.
- Downloaded images contain embedded EXIF GPS data only when the downloader has precise access. The DOWNLOAD_INFO.txt and metadata.json files also respect these privacy boundaries.
- Public datasets without a direct group share path default to coarse (region-only) GPS in downloads.
6. Data Retention
| Data | How long we keep it |
|---|---|
| Your account and profile | Until you delete your account |
| Private and group datasets | Until you delete them or your account |
| Public datasets | Stay published under the Creative Commons licence you chose, also after account deletion (see the terms) |
| Download links | Expire after 24 hours; the download record stays in your list until you delete it or your account |
| Security records (sign-ins, account changes) | 12 months. IP address and browser details are removed after 90 days, and straight away when you delete your account |
| OWL device records | 7 years. IP address removed after 90 days |
| Quote requests | 2 years, or 5 years if a sale follows (Danish Bookkeeping Act) |
| Visit statistics | Plausible keeps only aggregated counts, with no IP addresses or identifiers |
7. Your Rights (GDPR Articles 15-22)
- Access (Art. 15): Request a copy of your data
- Rectification (Art. 16): Correct inaccurate data
- Erasure (Art. 17): Delete your data; you can delete your account yourself in Settings
- Restrict Processing (Art. 18): Limit how we use your data
- Data Portability (Art. 20): Receive your data in a machine-readable format, on request
- Object (Art. 21): Object to processing based on legitimate interests, including visit statistics
To exercise these rights: email support@noktura.tech. We reply within one month.
8. Cookie Policy
We only store what the site needs to work, such as keeping you signed in, and things you ask for, such as a saved upload draft. None of it needs consent, and we use no analytics or advertising cookies.
The full list of every cookie and browser storage item, what it is for and how long it lasts is at noktura.tech/cookies.
9. International Transfers
Your data is stored in the EU: the database with Supabase in Frankfurt, and images with Hetzner in Finland. Some providers are US companies or run global networks. For transfers to the US we rely on:
- EU-US Data Privacy Framework certification: Vercel, Cloudflare, Resend and Google
- The European Commission's Standard Contractual Clauses, in the providers' data processing agreements: Supabase and Beehiiv; Resend also includes them
The UK and Switzerland have EU adequacy decisions (OpenStreetMap Foundation, Open-Meteo).
10. Data Security
We implement appropriate technical and organisational measures:
- Encryption in transit (TLS) for all traffic
- Database encrypted at rest (AES-256, Supabase)
- Row-Level Security (RLS) database policies, so you only see what you are allowed to
- Security audit logging and regular security reviews
- Uploaded files checked against their real file type before processing
11. Children's Privacy
Noktura is not intended for users under 16 years of age. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us.
12. Changes to This Policy
When we change this policy, we update the version and date at the top. If you have an account, we show you the new version in the app and ask you to accept it before you continue.
13. Contact Us
For privacy questions or to exercise your rights: support@noktura.tech
If you are unhappy with how we handle your data, you can complain to Datatilsynet, the Danish Data Protection Agency: Carl Jacobsens Vej 35, 2500 Valby, Denmark, datatilsynet.dk. You can also complain to the data protection authority in the country where you live.