Agro Notes app privacy policy

1. Who is responsible for your data

The controller of personal data related to the Agro Notes mobile application (the “App”) is Krzysztof Kołecki, ul. Oskara Kolberga 18C/31, 81-881 Sopot, Poland, Polish tax ID (NIP) 5862270852, REGON 389974516. For anything concerning personal data, contact us at contact@agronotes.app.

We have not appointed a data protection officer, because the conditions for a mandatory appointment under Article 37 of the GDPR are not met in our current business model. Requests go directly to the controller.

We are established in the European Union, so the EU General Data Protection Regulation (GDPR) applies to all processing described here, wherever you live. If the law of your country gives you additional rights, we respect them as well.

This document covers only the App. Data processing by the agronotes.app website is described in a separate website privacy policy.

2. Two roles: controller and processor

The App lets a farm owner invite collaborators, assign them to treatments and mention them in notes. Our role is therefore not the same for all data:

• We are the controller of your account data and technical data: email address, hashed password, user name, account ID, the version of the Terms you accepted, your chosen country and language, time of last use, platform and App version, activated promotional codes, notification token, security logs and crash diagnostic reports.
• We are a processor of personal data that someone enters into the App within a farm, in particular email addresses of invited people, assignments to treatments and tasks, and mentions of people in notes. The controller of that data is the farm Owner or the entity on whose behalf the Owner uses the App and which determines the purposes and means of processing. We process it on that controller’s instructions under the Data processing agreement.

If you run your farm on your own and do not enter other people’s data, in practice we act towards you only as a controller.

3. What data we process

Account data

• Email address and password, stored only as a cryptographic hash.
• User name, visible to the members of your farms.
• Account ID and creation date.
• The country and language you choose in the App.
• The version of the Terms accepted at registration or later in the App, and the date and time of that acceptance, stored on the server.
• Time of last use of the App, refreshed no more than every 10 minutes while the App is open. We store only the date and time, with no history of what you did in the App.
• The platform of that use (Android, iOS or web browser) and the App version.
• Activated promotional codes: promotion name, activation date and a technical description of the promotion linked to the account.

Farm and field data

• Farm name and country, the list of members and their roles.
• Collaboration invitations, including the email address of the invited person.
• Field names, crops, descriptions, area, crop codes, field boundaries as geographic coordinates and parcel identifiers.

Content you create

• Notes: content, type, date, author and editor, assigned people, task due date and status.
• Photos attached to notes.
• Spray records: product name, authorization number, date and time, rate, area, method and place of application, crop, growth stage, reason for the treatment, weather conditions, remarks, and the people assigned to and carrying out the treatment.

Technical data

• Push notification token and device platform.
• Technical and security logs kept by the infrastructure provider, including IP address and request time.
• Crash diagnostic reports: App version, operating system, device model, stack trace, IP address and error message. The error message may contain a fragment of data you entered if that data caused the error. We do not attach your email address to the report. A session recording may be attached: the sequence of screens and taps. Text, photos and vector graphics are masked in the recording, which is used only to fix errors.

What we do not process

• We do not store your location history. Device coordinates are used in real time to center the map and fetch the weather, and are then discarded.
• We do not use advertising, cross-app tracking or marketing profiling.
• We do not use session recordings for advertising or profiling. The diagnostic recording does not contain your email address and does not replace the farm content stored in your account.
• We do not make decisions about you based solely on automated processing that produce legal effects.

4. Purposes and legal bases

• Creating and running your account, providing the Service, syncing data between devices and farm members: Article 6(1)(b) GDPR (performance of a contract).
• Collaboration notifications (invitations, assignment to a treatment or task, a mention in a note): Article 6(1)(b) GDPR (performance of a contract).
• Recording the accepted version of the Terms, your country and language, and promotional codes activated on the account: Article 6(1)(b) GDPR (performance of a contract).
• Recording the time of last use, platform and App version: Article 6(1)(f) GDPR (our legitimate interest in maintaining the service, handling support requests and knowing which version you use). This is not used for marketing profiling.
• Security, abuse detection and crash diagnostics: Article 6(1)(f) GDPR (our legitimate interest in a secure and reliable service).
• Handling complaints and establishing, pursuing or defending legal claims: Article 6(1)(f) GDPR.
• Complying with our legal obligations: Article 6(1)(c) GDPR.

Providing an email address and password is necessary to create an account; without them we cannot provide the Service. Any other data is provided voluntarily, to the extent you want to use particular features.

5. Device permissions

The App asks for permissions only when you start a feature that needs them. You can refuse or revoke each permission in your system settings; this only limits that feature.

• Location: centering the map on your position and fetching weather conditions when a field has no boundary yet. Coordinates are not stored on the server.
• Camera and photo library: attaching photos to notes. Access covers only the photos you choose or take.
• Notifications: telling you about farm invitations and about being assigned to a treatment, task or note.

6. Who we share data with

We use external providers that process data only on our documented instructions and under data processing agreements with them. Current list:

• Supabase (Supabase, Inc. (USA), infrastructure in the EU): Database, authentication, photo storage, server functions and sync. Data: All account data and farm content, including note photos. Place of processing: European Union (Frankfurt, Germany).
• Resend (Resend, Inc. (USA)): Sending email invitations to collaborate on a farm. Data: Recipient email address, name of the person sending the invitation, farm name. Place of processing: United States.
• Expo Push (650 Industries, Inc. (USA)): Delivering push notifications to the device. Data: Device notification token and notification content (e.g. a farm or field name). Place of processing: United States.
• Google Firebase Cloud Messaging (Google Ireland Limited): Technical delivery of push notifications to Android devices. Data: Device notification token and notification content. Place of processing: European Union and United States.
• Apple Push Notification service (Apple Distribution International Ltd. (Ireland)): Technical delivery of push notifications to iOS devices. Data: Device notification token and notification content. Place of processing: European Union and United States.
• Sentry (Functional Software, Inc. (USA), operating as Sentry): App crash diagnostics: error reports and masked session recordings, so we can fix the errors. Data: App version, operating system, device model, stack trace, IP address, error message and a session recording (screen sequence and taps). Text, images and vector graphics in the recording are masked. The error message may contain a fragment of data entered in the App if that data caused the error. We do not send the email address. Place of processing: European Union (Frankfurt, Germany).
• Google Drive (Google Ireland Limited): Storing the encrypted backup of the database and note photos. Data: An encrypted archive. The archive password is not shared with Google. The archive contains account data, farm content and note photos. Place of processing: European Union or United States, depending on the Drive account settings.

Data may also be disclosed to public authorities where the law requires it, and to legal advisers to the extent necessary to pursue or defend claims.

7. Services your device contacts directly

Some features need a connection to external services. Your device sends the request to them directly; we do not act as an intermediary and do not pass on your account data. These services see your device’s IP address and the content of the request, and decide their own logging rules:

• OpenFreeMap / OpenMapTiles (OpenStreetMap data): The base map and the labels of places and streets. What the service receives: Device IP address and the coordinates of the visible map area.
• Open-Meteo: Suggested weather conditions when you fill in a treatment. What the service receives: Device IP address, field or device coordinates and the date and time of the treatment, only when you use this feature yourself.
• Geoportal (Polish Head Office of Geodesy and Cartography) and the Polish Agency for Restructuring and Modernisation of Agriculture: Aerial imagery, cadastral parcels and declared crop layers, used only in farms located in Poland. What the service receives: Device IP address and the coordinates of the visible map area.

If you do not want to send requests to the weather service, simply do not use the weather suggestion and enter the conditions by hand.

8. Transfers outside the European Economic Area

The core infrastructure of the App (database, accounts and photos) runs in this region: European Union (Frankfurt, Germany).

Some providers are based outside the European Economic Area. In those cases transfers rely on one of the mechanisms provided for in Chapter V of the GDPR:

• Supabase: Standard contractual clauses for any technical support access from outside the EEA.
• Resend: Standard contractual clauses.
• Expo Push: Standard contractual clauses.
• Google Firebase Cloud Messaging: Adequacy decision: EU–US Data Privacy Framework.
• Apple Push Notification service: Standard contractual clauses.
• Sentry: Adequacy decision: EU–US Data Privacy Framework; otherwise standard contractual clauses.
• Google Drive: Adequacy decision: EU–US Data Privacy Framework.

If you use the App outside the EEA, your device naturally sends and receives data across borders when it communicates with our infrastructure in the EU. You can get a copy of the safeguards applied by writing to the contact address.

9. How long we keep data

• Account data and farm content: for the term of the contract, that is until the account is deleted. This also applies to the last-use record, the accepted version of the Terms and activated promotional codes.
• After the account is deleted: the data disappears from the live database. An encrypted backup of the database and note photos is kept for 30 days and then deleted. Deleting an account does not immediately erase data that has already been copied into this backup.
• Notification token: until you sign out of the device or delete the account.
• Technical logs: no longer than 12 months.
• Crash diagnostic reports and session recordings: no longer than 90 days. They are not linked to the account email address, so deleting the account does not remove them earlier.
• Data needed to defend against claims: until the limitation period for contractual claims expires.
• Correspondence: for as long as needed to handle it and for the period in which we may need to show how the matter was dealt with.

Note one exception: notes and record entries you added in someone else’s farm stay with its owner. We remove their link to your account (after deletion the App can no longer show who wrote them), but the content itself stays with the controller of that farm, who may need it to keep legally required spray records. Details are on the account deletion page.

Backup. An encrypted backup of the database and note photos is kept for 30 days and then deleted. Deleting an account does not immediately erase data that has already been copied into this backup. The archive is stored on Google Drive. We also recommend exporting your records to PDF or CSV yourself.

10. Your rights

In connection with the processing of your data, you have the right to:

• access your data and obtain a copy,
• have inaccurate data corrected or incomplete data completed,
• have your data erased,
• restrict processing,
• data portability for data processed under a contract, in a structured, commonly used and machine-readable format,
• object to processing based on legitimate interest, on grounds relating to your particular situation,
• withdraw consent at any time where processing is based on consent, without affecting the lawfulness of processing carried out before the withdrawal.

Just send your request to contact@agronotes.app. We reply without undue delay and at the latest within one month. If the request is complex or we receive many requests, we may extend this period by a further two months, in which case we will tell you why. You can exercise some rights yourself: change your account details in Settings, export records and notes to PDF or CSV, and delete your account with one button.

If you believe we process your data unlawfully, you can lodge a complaint with a supervisory authority, in particular in the EU member state where you live or work, or with our lead supervisory authority: President of the Personal Data Protection Office (Prezes Urzędu Ochrony Danych Osobowych, UODO), ul. Stawki 2, 00-193 Warsaw, Poland.

Where we act only as a processor (for data entered into the App within a farm), please send your request to the controller of that farm (the Owner or the entity on whose behalf they use the App). If it reaches us, we will forward it to that controller and help them handle it.

11. Other people’s data you enter into the App

When you invite a collaborator, assign someone to a treatment or mention a person in a note, you enter their personal data into the App. For personal data of third parties entered into a Farm, the controller is the Owner or the entity on whose behalf the Owner uses the App and which determines the purposes and means of processing that data. If that is not you, you declare that you act on behalf of that controller. This means that:

• the controller must have a legal basis to process the data,
• the controller must inform that person about the processing, including that they use Agro Notes as a tool,
• that person sends requests for access, correction or erasure to the controller.

Our obligations to you in this respect are set out in the Data processing agreement. We will help you handle such requests and notify you of any personal data breach.

If you received a farm invitation from us and do not know why your email address is in the App, contact the person who sent the invitation; their details are in the message. You can also write to us and we will pass the matter on.

12. Data stored on your device

The App also works without internet, so it keeps a local copy of your farm’s data. On the device we store:

• a local database with fields, notes, treatments and a queue of changes to send,
• note photos until they are uploaded, and their drafts,
• the session token needed to keep you signed in,
• view settings, language and map preferences,
• downloaded map tiles for offline use; they contain only map data, none of your content.

Signing out removes the local copy of the data and the session. Uninstalling the App removes all data stored on the device but does not delete your account or the data on the server.

13. Security

We use technical and organizational measures appropriate to the risk, in particular: encryption in transit, encryption at rest by the infrastructure provider, database-level access separation so that each user sees only the data of their own farms, private photo storage without public addresses, two-factor authentication for administrative accounts, the principle of least privilege and an encrypted backup. An encrypted backup of the database and note photos is kept for 30 days and then deleted. Deleting an account does not immediately erase data that has already been copied into this backup.

If a personal data breach is likely to result in a high risk to your rights, we will notify you without undue delay and tell you what steps we recommend.

14. Children

The App is intended for people running a farm and is not directed at children. We do not collect dates of birth or verify age at registration. If we learn that an account was created by a child, we will delete it.

15. Changes to this policy

We will tell you about significant changes in advance by email or in the App. Each version has a number and effective date shown at the top of this page; previous versions are available on request.