Privacy Policy
Document version
Choose the current document or view a previous version.
Last updated: August 25, 2026
Astra Prevention is a product and brand developed and operated by Nebulab Technologies Inc. This Privacy Policy explains how Nebulab Technologies Inc. ("we", "us", or "our") collects, uses, discloses, and protects personal information when you use the Astra Prevention services, including the Astra web and mobile applications, hardware, cloud services, integrations, and related services (the "Services"). Nebulab Technologies Inc. is the legal entity that provides and operates the Services and is the data controller for Astra Prevention user data. We design and operate the Services to comply with applicable obligations under Canada's Personal Information Protection and Electronic Documents Act (PIPEDA). This Privacy Policy is a legal agreement between you and Nebulab Technologies Inc. By accessing and using the Services, you confirm that you have read, understand, and accept this Privacy Policy and any updated versions we post. If there is any conflict between this Privacy Policy and any other privacy-related materials, the most recent version posted by Nebulab Technologies Inc. will control. You may not modify this Privacy Policy. You represent that you are of legal age and authorized to enter into this Privacy Policy on behalf of yourself and any organization you represent. The Services may be offered as a white-label app for installer companies, but Nebulab Technologies Inc. remains the operator of the Services and the data controller for end-user data at this time.
1. Application
This Privacy Policy describes how we collect, use, and disclose information in accordance with PIPEDA and other applicable privacy laws. For the purpose of this Privacy Policy, "Personal Information" means information about an identifiable individual, such as name, home address, email address, and phone number.
2. Contact
If you have questions or requests about this Privacy Policy, contact your installer.
3. Information We Collect
We collect information that helps us provide the Services, including:
- Account details (name, email, phone, language, timezone).
- Authentication data (email/password or OAuth via Google or Apple).
- Site and system details (addresses, system names, residence details, protected appliances, components, floors, rooms, and locations).
- Gateway data (site association, floor, location, latitude/longitude, model, and connectivity).
- Hardware identity and warranty data (serial number or DevEUI, model, SKU, first commissioning or legacy installation date, pairing history, replacement relationship and reason, warranty provider, provenance, status, and expiry).
- Events and notifications (alerts, delivery status, preferences, timestamps, and sensor readings).
- Device data for push notifications (device ID, push token, device model/OS/app version, IP address).
- Account access security data (browser or app install identifiers, browser/device fingerprint hashes, user agent, device model/OS/browser/app version, IP address, approximate IP-based location, network provider, and access timestamps).
- App usage data (session activity, cookies, survey responses, and crash logs).
- Session data (cookies or tokens required to keep you signed in).
- Connected-service data (linked provider and selected system identifiers, device identifiers and names, room and location metadata, device capabilities and states, account-linking credentials, status requests, control commands, and command results).
- Support communications and request history.
If Wi-Fi Mesh connectivity is enabled by the owner, an authorized administrator, or an installer, the configured Wi-Fi network for that site may act as the internet exit point for Astra system traffic from other panels at the same site. Each site uses its own distinct mesh SSID and mesh password. Wi-Fi Mesh credentials, including each site-specific mesh SSID and mesh password and any configured root Wi-Fi SSID and password, may be stored so panels at the same site can be configured consistently and maintain mesh connectivity. These credentials are used only to provide Astra mesh connectivity and related support, and are available only to authorized roles and systems.
4. How We Use Information
We use personal information to:
- Provide, operate, and maintain the Services.
- Authenticate users and secure accounts.
- Detect unusual access, new devices, new locations, potential account sharing, and possible account compromise.
- Send alerts, notifications, and service messages by email, SMS, or push.
- Support installers and site owners with system management.
- Maintain fleet traceability, determine recorded warranty status, and administer hardware replacements.
- Link user-selected Astra systems to connected services and respond to authorized device-status and control requests.
- Provide customer support and respond to requests.
- Ensure reliability, performance, and security.
- Improve products, services, and safety features.
We may use privacy-conscious analytics tools to understand product usage, reliability, and performance. We do not sell personal information, and we do not send marketing messages unless you have chosen to receive them.
5. How We Share Information
We do not sell personal information. We share data only with:
- Service providers that help operate the Services, including Supabase (auth and database), AWS (hosting and backups in Canada Central), ChirpStack (telemetry), Gmail (email notifications), Twilio (SMS), and Expo/Firebase (push notifications).
- Connected-service providers, such as Google, when you choose to link an Astra system and sharing is required to discover, display, monitor, or control the selected devices.
- Installer companies responsible for a site/system, when access is required to provide installation and support services.
- Consultants, representatives, and professional advisors assisting us in operating the Services.
- Government or law enforcement where required by law.
6. Google Home and Connected Services
When you link Astra Prevention to Google, we share only the information needed to make the Astra system you selected available through Google. This may include system and device identifiers, device names, rooms and locations, device types and capabilities, online or offline status, temperature, water-leak state, valve state, and command results. We receive device-status requests and control commands from Google and process them according to your Astra permissions. Account-linking credentials are used to maintain the connection securely.
You can unlink Google from the Google Home app or remove the connection from Astra's integration settings. Unlinking stops future sharing through the integration. Google may retain information already processed in accordance with Google's own privacy policy. Other connected services may operate under their own privacy policies and terms.
7. Aggregated and Anonymized Data
We may aggregate and anonymize information so it cannot reasonably identify you. We may use and share aggregated or anonymized data for analytics, reporting, and service improvement.
8. Data Storage and International Transfers
We host data in Canada (AWS ca-central-1). Some subprocessors and connected-service providers (for example, Google, Apple, Twilio, or Expo/Firebase) may process data outside Canada. Where cross-border transfers occur, we use appropriate safeguards.
9. Data Retention
Most data is kept while your account remains active. Detailed account access security events are generally retained for 90 days, and device access summaries are generally retained for one year after last seen. Connected-service credentials are retained while the connection remains active and are removed or revoked when the connection is deleted, subject to operational and backup retention. Durable hardware identity, warranty, and pairing-history records may be retained after a component is unpaired, replaced, or archived when reasonably required for fleet traceability, warranty administration, product safety, fraud prevention, or support, subject to applicable law and valid access or deletion requests. Some records may be archived rather than deleted. When data is deleted, it is removed from active systems, but it may persist in backups for up to 180 days.
10. Your Rights and Choices (Canada / PIPEDA)
You may request to:
- Access your personal information.
- Correct or update inaccuracies.
- Request deletion of your data.
- Withdraw consent where applicable.
To make a request or challenge our compliance with this Privacy Policy, contact your installer. We may need to verify your identity before responding. If there is a cost to access your Personal Information, we will provide an estimate before proceeding. You may withdraw consent at any time, but doing so may limit or prevent your use of the Services.
11. Business Transfers
We may transfer information as part of a merger, acquisition, financing, reorganization, or sale of assets. We will take reasonable steps to ensure the privacy of Personal Information is preserved.
12. Security
We use administrative, technical, and physical safeguards to protect personal information, including encryption in transit, access controls, least-privilege account access, secure cloud hosting, vulnerability review during development, and restricted support access. No system is 100% secure, so we cannot guarantee absolute security.
You may review recent account access and recognized devices in the Services where supported. Global administrators may review account access security data for support, abuse prevention, and security investigations. IP-based location is approximate and may be affected by VPNs, carrier networks, corporate networks, proxies, or privacy services.
13. Children
The Services are not directed to children. If you are not of legal age in your jurisdiction, do not use the Services.
14. Changes to This Policy
We may update this Privacy Policy from time to time. We will post the revised version with an updated date. Continued use of the Services means you accept the changes.