Privacy, cookies and terms

Data controller

CropMate is operated by SSCS Grow ApS, registration pending, Aarhus, Denmark. Data questions: privacy@cropmate.dk.

What data do we collect?

• Account: email, chosen region/language, hashed password (handled by Supabase Auth).
• Garden content you add: beds, plants, tasks, notes, photos, harvest log.
• Location: approximate position (postal code or city level) — used for weather and zone, never precise GPS without explicit choice.
• Technical events: performance and errors via Sentry, anonymous product metrics via PostHog (only after consent).
• Payment data: handled directly by Stripe — we never store card numbers or CVC.

Sub-processors and third parties

We use the following sub-processors. All have data processing agreements (DPA) or standard contractual clauses (SCC) where required.

• Supabase — Login, database, file storage (photos) (EU (Frankfurt)).
• OpenAI — AI diagnosis, plant identification, AI assistant (USA — SCC + opt-out of training on our prompts).
• Stripe — Payments, subscriptions, invoices (EU/USA (PCI-DSS Level 1)).
• Vercel — Hosting and CDN for the web app (EU + global CDN).
• Sentry — Error and crash reporting (anonymised) (EU).
• PostHog — Anonymous product analytics (consent-based) (EU).
• Loops — Transactional and marketing email (USA — SCC).
• Open-Meteo, DMI, SMHI, MET Norway — Weather data based on your location (EU/EEA).

Retention and access

Data is kept while your account is active. On cancellation you have 30 days to export — after which everything is permanently deleted within 90 days. Backup snapshots roll out within 30 days. Access is limited to CropMate staff on a need-to-know basis and is logged.

AI processing

When you use photo diagnosis, the AI assistant or plant identification, your input (text and/or photo) is sent to OpenAI to generate an answer. OpenAI does not retain prompts after processing and does not train models on our API traffic (per OpenAI Enterprise/API agreement). We anonymise photos before sending where technically possible.

Cookies and tracking

Strictly necessary cookies are used for login sessions and cannot be disabled. Analytics and marketing cookies (PostHog) are only set after active consent through the cookie banner. You can change your choice at any time in Settings → Privacy. We do not set third-party advertising cookies.

Your rights (GDPR)

You have the right to access, rectification, erasure, data portability and objection. Export and deletion can be initiated in Settings → Privacy or by contacting privacy@cropmate.dk. Complaints can be filed with the Danish Data Protection Agency (datatilsynet.dk).

Terms of service

See full terms at /terms. CropMate is a helper tool — recommendations are advice, not guarantees. Always follow local rules for chemicals, water rationing and safety.