Privacy Policy

PRIVACY STATEMENT — HARVESTED Effective date: 02-03-2026 1. Controller Information Harvested is operated by: Harvested ZZP Graaf Aelbrechtlaan 171 1181 SV Amstelveen The Netherlands Chamber of Commerce (KvK): 95741186 VAT number: NL005172182B56 Email: marco.broccoli@gmail.com Harvested ZZP is a sole proprietorship registered in the Netherlands and acts as the data controller within the meaning of the General Data Protection Regulation (EU) 2016/679 (“GDPR”). 2. Scope This Privacy Statement applies to: - The Harvested mobile application - The Harvested website - Community features within the application 3. Personal Data We Process We process personal data necessary to provide and improve the Harvested service. 3.1 Account Data - First name - Last name - Email address - Profile image - Garden number 3.2 Location Data - Approximate location (where enabled) - Manually entered garden location 3.3 Gardening & Community Data - Crop selections - Planting records - Harvest logs - Notes - Images of plants - Community posts and shared content Community content may be visible to other users within the App. 3.4 Technical and Usage Data - IP address - Device model - Operating system version - Crash logs - App interaction and analytics events 4. Legal Basis for Processing We process personal data on the following legal bases under Article 6 GDPR: - Performance of a contract: to create and manage accounts and provide gardening features - Legitimate interests: to ensure security, prevent abuse, improve functionality, and analyse performance - Consent: where required (e.g. website cookies, optional location access, AI diagnostics where applicable) - Legal obligation: where required under applicable law 5. Purpose of Processing Personal data is processed to: - Provide account-based access to the App - Enable gardening planning, tracking and diagnostics - Operate community features - Provide customer support - Send service-related notifications - Monitor performance and security - Improve the application Harvested does not sell personal data. Harvested does not use personal data for advertising purposes. 6. AI Plant Diagnostics Harvested offers plant disease diagnostics using artificial intelligence services provided by OpenAI. When you submit an image or plant description for diagnostic analysis: - The image or text is transmitted to OpenAI for processing. - Processing may occur outside the European Economic Area (EEA). - Appropriate safeguards are implemented in accordance with GDPR, including the use of European Commission Standard Contractual Clauses. Images are processed solely for diagnostic purposes and are not used for advertising. AI processing does not produce legal or similarly significant effects within the meaning of Article 22 GDPR. 7. Third-Party Service Providers We use the following processors to operate the service: - Auth0: authentication and account management (EU region) - OVH Cloud: infrastructure hosting (EU) - Bunny.net: content delivery network (EU) - Firebase: analytics and crash reporting - Mixpanel: analytics - Mailgun: transactional email delivery - OpenAI: AI plant diagnostics Each provider processes data under contractual arrangements compliant with Article 28 GDPR. 8. International Transfers Certain service providers, including OpenAI, may process personal data outside the EEA. Where such transfers occur, Harvested relies on appropriate safeguards, including Standard Contractual Clauses approved by the European Commission. 9. Data Retention Personal data is retained only as long as necessary for the purposes described above. - Account data is retained while the account remains active. - Upon account deletion, identifiable personal data is deleted. - Certain system logs or records may be retained in pseudonymised form for security, fraud prevention, or legal compliance purposes. - Backups are retained for a limited operational period. 10. Account Deletion Users may request deletion of their account by contacting: marco.broccoli@gmail.com Upon verification: - Identifiable account data will be erased. - Community content may remain in a non-identifiable or pseudonymised form where removal would impair service integrity. - Data required for legal or security purposes may be retained where necessary. 11. Children The App is primarily intended for adult users. Users under the age of 16 may only use the App with parental consent. Harvested does not knowingly collect personal data from children without appropriate consent. 12. Security Measures Harvested implements appropriate technical and organisational measures, including: - HTTPS encryption in transit - Secure bearer-token authentication - Access control restrictions - EU-based infrastructure hosting - Regular system backups 13. Website Cookies The Harvested website uses cookies for: - Essential functionality - Analytics Where legally required, user consent is obtained before placing non-essential cookies. 14. Your Rights Under GDPR You have the right to: - Access your personal data - Rectify inaccurate data - Request erasure - Restrict processing - Object to processing - Data portability - Withdraw consent at any time You also have the right to lodge a complaint with the Dutch Data Protection Authority (Autoriteit Persoonsgegevens). Requests may be submitted via: marco.broccoli@gmail.com 15. Changes to This Privacy Statement This Privacy Statement may be updated from time to time. The most recent version will always be available within the App and on the website.