Legal
Privacy Notice
Last updated 19 August 2026
Controller: Aira Labs Limited
This notice explains what personal information Aira Labs Limited (“Aira”, “we”, “us”) collects, why we use it, who we share it with, and the choices you have.
It covers:
- our website at airalabs.io and related pages (including waitlist and shop)
- the Aira mobile apps for iOS and Android
- Air Go and the Aira wearable, and the cloud services that pair, sync, and map them
- email, support, events, and other contact with us
If you do not agree with this notice, please do not use the Services.
Contact: hello@airalabs.io
1. In short
- We collect what we need to run an account, pair a device, show you the air around you, and support you.
- Location is for tagging readings and maps — not for advertising.
- Air-quality alerts are evaluated on your device in the current app. We do not need those alert events on our servers to notify you.
- We do not sell your personal sensor stream for ads, and we do not use it to build advertising profiles.
- You can delete your account in the app. You can unpair a device and delete that device’s cloud data. Export is available on request; a full self-serve export is still being finished.
- Aira is a consumer wellness product. It does not diagnose, treat, cure, or prevent disease.
2. Who we are
Aira Labs Limited is the data controller.
- Company number: 15668628
- Registered office: 3rd Floor, 86-90 Paul Street, London EC2A 4NE, United Kingdom
- Email: hello@airalabs.io
3. The information we collect
What we collect depends on whether you browse the site, join a waitlist, buy hardware, create an app account, or pair a sensor.
3.1 Account and contact
- Name and email address
- Password (stored as a hash) and session / auth tokens
- Email verification and password-reset tokens
- Profile fields you choose to save
- Support emails and the details you send us (serial, app version, photos of a device, and similar)
3.2 Device and sensor data
- Device registry: serial number (Air Go / wearable, typically
AQplus six digits), model, and related identifiers used to pair (Android may also send a MAC address, which we merge onto the serial) - Firmware / hardware metadata needed to support the device
- Sensor readings from a paired device: PM2.5, temperature, and humidity, with time
- On-device alert events and insight cards — generated on the phone and not uploaded in the current app
3.3 Location and motion
The Aira Android app and the Aira iOS app access location data when you allow it in the operating system. This includes approximate location, precise location, and background location if you grant “Always”.
If you allow it:
- Approximate or precise location, including in the background if you grant “Always”, so we can tag readings with where you were and show exposure on a map
- Motion / activity (for example driving) to improve how location is joined to readings — processed on the device; not typically sent to our servers
You can refuse location or motion. Sensing can continue; map and “where it happened” features will be limited.
We do not use location or motion to advertise to you.
3.4 Website, waitlist, and shop
- Technical logs: IP address, browser and device type, pages viewed, referring URL, language, and coarse location inferred from IP
- Waitlist details you submit (name, email, and any answers on the form)
- Order details if you buy from our shop: name, email, shipping address, product, and order status. Card payments are handled by Shopify (and its payment partners). We do not store full card numbers.
3.5 Ambient map data
The app may fetch public or licensed ambient air samples (today: Open-Meteo) to give context around you. That request can include a location needed to return the sample. Those samples are cached on the device and are not stored as your personal sensor history on Aira’s API.
3.6 What we do not collect as a product
We do not ask you for diagnoses, medication, racial or ethnic origin, religion, sexual orientation, or biometric identifiers (fingerprints, face templates, voiceprints).
We do not require health-condition fields to use Aira.
3.7 Information from others
We may receive:
- Checkout and fulfilment data from Shopify
- Sign-in / purchase receipts from Apple or Google if you use their stores
- Email delivery events from our email provider
- Ambient samples from Open-Meteo (see above)
4. How we use it, and the legal basis
We only use personal information when we have a legal reason. For UK / EU users the main bases we rely on are:
| Basis | What it means here |
|---|---|
| Contract | We need it to create your account, pair a device, sync readings, show your history and map, process an order, and support you |
| Consent | Optional permissions (precise / background location, motion, marketing email, non-essential cookies). You can withdraw in OS settings, email footer, or cookie controls |
| Legitimate interests | Keeping the Services secure, preventing abuse, understanding aggregated product use, improving reliability — balanced against your rights |
| Legal obligation | Tax, accounting, safety, and responding to lawful requests |
We do not rely on “vital interests” to run Aira. Aira is not an emergency or medical service.
| What we do | Typical data | Basis |
|---|---|---|
| Create and secure your account | Name, email, password hash, tokens | Contract |
| Pair hardware and keep a device registry | Serial, model, pairing identifiers | Contract |
| Store and show your readings and history | PM2.5, temperature, humidity, time | Contract |
| Tag readings and draw your map | Location you allow | Consent (OS permission) |
| Local alerts and on-device insights | Readings + preferences on the phone | Contract (the feature). Data stays on device in the current app. |
| Show ambient context | Coarse location sent to Open-Meteo | Contract |
| Process a hardware order | Checkout details via Shopify | Contract; legal obligation (tax) |
| Support, RMA, safety follow-up | Email, serial, diagnostics you send | Contract; legitimate interests; legal obligation if safety |
| Service email (verify, reset, order) | Contract | |
| Marketing email | Consent | |
| Security, fraud, abuse, backups | Logs, account, device | Legitimate interests; legal obligation |
| Aggregated / de-identified product and map statistics | Readings stripped of identity where reasonably possible | Legitimate interests |
| Website analytics (if you accept) | Cookie / device identifiers | Consent |
| Future subscription billing | Entitlement via Apple / Google / processor | Contract. Not live as of this notice. |
5. How location and permissions work on the phone
We ask only for what the feature needs, and the system prompt should match the behaviour.
| Permission | Why |
|---|---|
| Bluetooth | Talk to Air Go or the wearable |
| Location (while using) | Tag readings while the app is open |
| Location (always) | Keep tagging when the app is in the background |
| Precise location | Join a reading to a more exact place during sync |
| Motion | Detect activity (for example driving) so tagging is less noisy |
| Notifications | Local air-quality and battery alerts |
You can change or withdraw these in iOS / Android settings. Withdrawing location does not delete history we already stored; you can delete that separately.
6. Who we share it with
We share personal information only as needed to run Aira, and with people who are not allowed to use it for their own advertising of your sensor stream.
Service providers (processors or similar)
| Who | Role |
|---|---|
| Our hosting / infrastructure providers | Website, API (api.airalabs.io), database, backups |
| SendGrid (or the email provider we then use) | Transactional email |
| Shopify | Shop checkout, payments, shipping details |
| Cloudflare | Site security / performance, where used |
| Vimeo | Embedded video, where used |
| Notion | Hosted waitlist form, where used |
| Open-Meteo | Ambient samples requested by the app |
| Apple / Google | App distribution; later, in-app purchase |
| Professional advisers | Legal, accounting — only as needed |
We do not sell your personal information. We do not share your identified sensor stream with advertisers. We do not let third parties use your readings to target ads.
We may disclose information if required by law, to protect rights and safety, or as part of a real corporate transaction (financing, merger, or sale), under continuing confidentiality.
Aggregated and de-identified data. We may use or share statistics that do not reasonably identify you (for example, how air looked across a hex cell) to operate maps, improve models, or — later, and only if we say so clearly — for research or commercial data products. That is not a licence to re-identify you.
7. International transfers
Aira is a UK company. You may use the Services from other countries. Some providers (including Apple, Google, Shopify, and email) are in, or may access data from, the United States or other countries.
We will only transfer personal information internationally where a lawful mechanism applies, and we will update this notice with the specific mechanism when it is in place.
8. How long we keep it
We keep personal information only as long as we need it for the purposes above, including legal, tax, and dispute needs.
| Data | Retention |
|---|---|
| Account | Until you delete it, then a short wind-down for backups and legal holds |
| Device registry | Until you unpair / delete, or the account is deleted |
| Sensor readings on our servers | For the life of the account, then a short wind-down for backups and legal holds |
| Readings and alert events on the device | Device storage limits; the app currently prunes alert events on the order of about 90 days |
| Support email | A reasonable business period (typically 24 months unless a safety / legal file needs longer) |
| Shop / invoice records | Statutory accounting period (UK: typically 6 years) |
| Backups | Rolling backups, then expiry |
| Marketing consent records | For as long as we rely on the consent, then a proof period |
When we no longer need the information we delete or anonymise it. Copies in encrypted backups may remain until those backups expire.
9. Your rights
Depending on where you live (especially the UK, EEA, Switzerland, and several US states), you may have the right to:
- access a copy of your personal information
- correct it
- delete it
- restrict or object to certain processing
- withdraw consent
- data portability
- complain to a regulator
How to use them
- In the Aira app: delete account; unpair / delete device cloud data.
- Email hello@airalabs.io with the email on the account. We will need to verify it is you.
- Export: ask us by email. A full self-serve export is not finished. We will give you what we reasonably can (typically account and available reading history) while that work completes.
We will respond within the time the law requires (usually one month in the UK).
UK / EU complaints: Information Commissioner’s Office. EEA users may also contact their local authority.
You will not be discriminated against for exercising these rights.
10. Children
The Services are for people 18 or over. We do not knowingly collect personal information from children.
If you believe a child has created an account, email hello@airalabs.io and we will delete it.
11. Cookies and similar technologies
The website may use:
- Essential cookies or similar (security, load balancing, remembering cookie choice)
- Analytics cookies only if you accept them in the banner
- Third-party media (for example Vimeo) if a page embeds video
We do not use your sensor readings for advertising cookies.
If the banner and this notice disagree, the banner’s choice (accept / decline analytics) is what the site should honour.
We do not respond to browser Do Not Track signals. There is no single standard. Cookie choice and OS permissions are the controls that work.
12. Security
We use reasonable technical and organisational measures: encrypted transport (HTTPS), hashed passwords, access control, and least-privilege admin tools.
No internet service is perfectly secure. Please use a strong unique password and keep your phone updated.
Suspected breach: email hello@airalabs.io immediately. Internally this escalates to the CEO.
13. People in the United States
If you are in a US state with a consumer privacy law (including California), you may have rights to know, access, correct, delete, obtain a copy, and opt out of sale / sharing / targeted advertising.
How we classify this today:
| Category | We collect it? |
|---|---|
| Identifiers (name, email, IP, account) | Yes |
| Commercial information (orders) | Yes, if you buy from the shop |
| Internet activity on our site | Yes, at a basic log / analytics level if enabled |
| Geolocation | Yes, if you allow it in the app |
| Inferences | Limited product inferences (for example exposure over a period) — not ad profiles |
| Audio / biometric / education / employment | No |
| Sensitive personal information as defined by California (precise geolocation is treated as sensitive there) | Precise location yes, if you allow it, only to tag readings |
We do not sell personal information for money. We do not share personal information for cross-context behavioural advertising.
To exercise US rights: hello@airalabs.io. You may use an authorised agent where the law allows; we will need proof. If we say no, you can appeal to the same address.
14. Changes
We will change the “Last updated” date when we revise this notice. If a change is material, we will also post a note on the site or email the address on your account where required.
15. Contact
Aira Labs Limited
3rd Floor, 86-90 Paul Street
London EC2A 4NE
United Kingdom
hello@airalabs.io
To access, correct, or delete your information, use the app controls or email us from the address on the account.