AgrowSky Privacy Policy
Version 1.0 · Effective September 25, 2026
This Privacy Policy explains how CASTTI TECNOLOGIA LTDA. (CNPJ 27.240.877/0001-06, São Paulo, SP, Brazil, [FULL HEADQUARTERS ADDRESS]), the owner of the AgrowSky brand and platform, collects, uses and protects personal information. We are based in Brazil and comply with Brazil's General Data Protection Law (LGPD). For U.S. residents, we also follow applicable state privacy laws, as described in Section 12.
It covers the AgrowSky website, platform, Farmer Portal, forms, support and communications. Capitalized terms are defined in our Terms of Use.
1. Summary
- We use your information to provide the service, bill you, support you, keep the Platform secure and, with an easy opt-out, send marketing emails.
- We do not sell personal information and do not share it for cross-context behavioral advertising.
- Card details are handled by PayPal. We never store card numbers.
- For operational data you upload (flight logs, pilots, growers, fields), you are the controller and we act as your service provider.
- To exercise your rights, email privacy@agrowsky.com.
2. Our two roles
As a controller, Castti decides how to process information about:
- website visitors;
- people who fill out our forms (free trial, contact, Farmer Portal);
- account owners and billing contacts;
- Platform usage and security data.
As a processor or service provider, Castti processes personal information contained in Customer Data on the Customer's behalf and instructions. Examples include pilots' names, licenses and certifications, and grower and field information. The Customer (the spray business, farm or co-op) is responsible for having a lawful basis to collect and share that information. Requests about it should go to the Customer, and we will help them respond.
3. Information we collect
| Category | Examples | Source |
|---|---|---|
| Identifiers and contact details | name, email, phone, company, role, fleet size | you |
| Commercial and billing information | company name, billing address, plan, invoices, payment status | you and PayPal |
| Payment information | payment method type and last digits of the card (if PayPal provides them) | PayPal. We never receive full card numbers |
| Operational data (Customer Data) | flight logs, telemetry, field coordinates and boundaries, dates and times, products applied, labels, applicator license numbers, aircraft details, grower information | the Customer and its Authorized Users |
| Internet and device activity | IP address, access times, browser, operating system, pages viewed, in-app events | collected automatically |
| Communications | support messages, notes from Founders Program feedback calls (with prior notice) | you |
| Cookies and similar technologies | country and language preference, session, usage metrics | your browser (see Section 10) |
Precise geolocation. Field boundaries and flight paths describe the location of farmland and aircraft. They are processed only to generate Records and are never used to track individuals.
Sensitive information. We do not request sensitive personal information, such as health data, biometrics or government ID images. Please do not upload it.
Children. The Platform is for professional use and is not directed to anyone under 18. We do not knowingly collect children's information.
4. How we use information, and our legal bases
| Purpose | Legal basis (LGPD art. 7) |
|---|---|
| Create and maintain accounts, provide the service, generate Records, host Customer Data | performance of contract. For Customer Data, on the Customer's instructions |
| Billing, invoicing and collections | performance of contract and legal obligation |
| Keep access logs | legal obligation (Brazil's Internet Civil Framework requires 6 months) |
| Fraud prevention, security and incident response | legitimate interests and legal obligation |
| Service communications (Allowance alerts, expirations, changes to Terms) | performance of contract |
| Respond to trial, contact and Farmer Portal requests | pre-contractual steps |
| Marketing emails about AgrowSky | legitimate interests, with an opt-out in every message, or consent where required |
| Analytics and product improvement | legitimate interests for essential metrics; consent for non-essential cookies |
| Aggregated, de-identified statistics | legitimate interests. De-identified data is not personal information |
| Establishing or defending legal claims | exercise of legal rights |
5. How we disclose information
We disclose information only as needed, to parties bound by confidentiality and security obligations:
- Cloud and infrastructure providers, for hosting, databases, file storage, content delivery and backups;
- PayPal, for payment processing. PayPal also acts as an independent controller under its own policies;
- Email, CRM, support and analytics tools, limited to what each one needs;
- Growers through the Farmer Portal, when the Customer chooses to share Records;
- Professional advisors (legal, accounting, audit), under confidentiality;
- Authorities, when required by law, court order or valid legal process;
- Successors in a merger, acquisition or reorganization, including an affiliated U.S. entity, subject to this Policy.
We do not sell personal information and we do not "share" it for cross-context behavioral advertising, as those terms are defined under California law. In the past 12 months, we have not sold or shared personal information in that sense.
6. International transfers
Castti is located in Brazil. If you use AgrowSky from the United States, your information will be transferred to and processed in Brazil. Some of our providers also process data in the United States or elsewhere. We protect these transfers with contractual safeguards, such as the standard contractual clauses approved by Brazil's data protection authority (ANPD), and other safeguards required by law.
7. Retention
| Information | Retention period |
|---|---|
| Account data and Customer Data | while the Account is active + 90 days for export after termination, then deleted or de-identified |
| Backups | rolling cycles of up to 35 days after deletion from production |
| Access logs | 6 months, or longer if required by an authority |
| Billing and tax records | 5 years, or as required by tax law |
| Leads that did not convert | up to 24 months after the last interaction, or until you object |
| Unconverted free trials | operational data kept 30 days after the trial ends |
| Consent and privacy request records | as long as needed to demonstrate compliance |
8. Security
We use technical and organizational measures appropriate to the risk, including:
- encryption in transit (TLS) and at rest;
- role-based access and least privilege;
- audit logging;
- environment segregation, backups and monitoring;
- SHA-256 integrity checks on Records;
- confidentiality agreements with staff and vendors.
No system is completely secure. If a security incident affects your personal information, we will notify you and the relevant authorities as required by applicable law, including U.S. state breach notification laws and ANPD rules. When we act as a service provider, we will notify the Customer without undue delay.
9. Your rights
Depending on where you live, you have the right to:
- Know and access the personal information we hold about you and how we use and disclose it;
- Correct inaccurate information;
- Delete your information, subject to legal exceptions;
- Obtain a portable copy of your information;
- Opt out of the sale or sharing of personal information, targeted advertising and profiling with legal or similarly significant effects. We do not engage in these activities;
- Limit the use of sensitive personal information. We do not use sensitive information for purposes that require this option;
- Withdraw consent where processing is based on consent;
- Not be discriminated against for exercising your rights.
How to submit a request. Email privacy@agrowsky.com. We will verify your identity before responding, and an authorized agent may submit a request on your behalf with proof of authorization. We respond within the time required by law: 45 days under most U.S. state laws, extendable where permitted, and 15 days under the LGPD. Appeals: if we deny your request, you may appeal by replying to our decision. If you remain unsatisfied, you may contact your state Attorney General. Brazilian residents may also file a complaint with the ANPD.
10. Cookies
| Type | Purpose | Example | Consent needed? |
|---|---|---|---|
| Strictly necessary | operation, security, session | login session | no |
| Preferences | remember your country and language | country (12 months) |
no |
| Analytics and marketing | measure visits, conversions and campaign performance | Google Tag Manager / Google Analytics, when enabled | yes |
Non-essential cookies are only set after you consent, and you can withdraw consent at any time. We honor Global Privacy Control (GPC) signals as an opt-out of non-essential cookies and of any sale or sharing.
11. Marketing communications
You can unsubscribe from marketing emails through the link in each message or by emailing us. We will still send transactional messages, such as invoices, security notices and contract updates, while you have an Account.
12. U.S. state privacy disclosures
This section supplements the Policy for residents of California and other states with comprehensive privacy laws, such as Texas, Virginia, Colorado and Connecticut.
- Categories collected (past 12 months): identifiers; customer records; commercial information; internet or network activity; geolocation data relating to farmland and aircraft; professional information (applicator licenses and certifications); and inferences limited to product usage.
- Sources: you, our Customers, PayPal and automatic collection.
- Business purposes: those listed in Section 4.
- Disclosed for a business purpose to: the service providers and parties listed in Section 5.
- Sold or shared: none.
- Retention: see Section 7.
- Financial incentive notice: the Founders Program discount is offered in exchange for monthly product feedback calls, not for personal information. You may withdraw at any time by canceling or leaving the program.
13. Changes to this Policy
We may update this Policy. The current version will always be on this page, with its effective date at the top. We will notify you of material changes by email or in the Platform before they take effect.
14. Contact
CASTTI TECNOLOGIA LTDA. · CNPJ 27.240.877/0001-06 [FULL HEADQUARTERS ADDRESS] · São Paulo, SP, Brazil Data Protection Officer: [DPO NAME] · privacy@agrowsky.com General inquiries: hello@agrowsky.com